Shopify App Privacy & Merchant Data Terms

Who we are

R.B. Fabrication Inc., 2296 N. Batavia St. STE "B", Orange, CA 92865. Contact: orders@rbfabrication.com · 714-998-2700.

The dealer (merchant) who links a Shopify store is responsible for their own customers' data and for their own storefront privacy notice. RB processes the data described below on the dealer's behalf, to fulfil the dealer's RB wholesale orders.

What we store

Product sync (always): the store's .myshopify.com address and name, granted permissions, an encrypted Shopify access token, product/variant mappings, sync settings and activity logs, and the RB dealer account that owns the connection.

Order import (optional, only if the dealer turns it on and grants order access): for Shopify orders containing RB products — the Shopify order ID, name and number; order dates, status and test flag; line items (RB SKU, quantity) and line-item properties, which can contain personalization text; the order note; and the shipping name, company, address, city, state/province, postal code, country and phone.

We do not store the end customer's email address, Shopify customer ID, billing address or any payment information from Shopify.

Why we use it

Only to show the dealer their imported order for review, and — if the dealer chooses — to pre-fill a drop-ship address and notes in the dealer's own RB checkout, where the dealer confirms every field before placing an RB wholesale order.

Nothing is submitted to RB automatically, and no automated decision with legal or similarly significant effect is made about anyone. Shopify order data is not used for marketing, advertising or profiling, and is not sold, rented or shared for anyone else's purposes.

Who can see it

The RB dealer account that owns the store connection, and RB staff with administrator access who support orders. Every view of imported order details through RB's website is recorded (who, which store, which orders, when — never the details themselves). Signed-in accounts cannot read those details directly; RB's own automated order processing and privacy-request handling run on RB's servers.

How long we keep it, and deletion

Imported personal details are removed when the store uninstalls the RB app, when Shopify sends a customer redaction request for listed orders, or when Shopify sends a shop redaction request (which also removes the store connection).

In addition, an automatic time limit is active: 90 days after RB first stores an imported order, its shipping details, order notes, personalization text and the matching copies in RB's inbox records are cleared. The 90 days are counted from that first import; viewing the order or a later Shopify update does not restart the clock. Cleanup runs once a day in limited batches, so large backlogs may take more than one day to clear. Non-personal order details (order number, status, items and quantities) are kept.

Personalization text copied from an imported order into a dealer's unsubmitted RB cart is cleared on the same schedule. If the dealer has edited that text, it is treated as the dealer's own wording and kept.

When a dealer places an RB wholesale order, the ship-to and notes the dealer confirmed in RB checkout become part of that RB order, which RB keeps as a business record of its sale to the dealer. Shopify deletion requests remove the imported Shopify copy, not those RB order records. To ask about an RB order record, contact us at the address above.

For customer data requests received through Shopify, RB records which fields it holds for the listed orders and provides them to the store owner.

Security

Connections to RB use HTTPS. Shopify access tokens are encrypted by RB's application before storage. Access to imported orders is limited by account and role as described above.

Merchant data terms

By linking a store, the dealer agrees that:

1. RB processes the data above only to provide the integration and fulfil the dealer's RB orders, following the dealer's instructions given through the app.
2. The dealer has a lawful basis and provides any notices required to share their customers' order details with RB, and enables order import only when needed.
3. RB limits access to the dealer and authorized RB staff, logs access to imported order details, and does not sell or use the data for marketing.
4. RB handles Shopify's customer data request, customer redaction and shop redaction notices and deletes data as described above.
5. RB will notify the dealer without undue delay if it becomes aware of unauthorized access to that dealer's imported data.
6. The dealer may disconnect at any time by uninstalling the RB app in Shopify.

Dealers acknowledge these terms when connecting a store, and again before using imported orders after the terms change. The acknowledged version and date are stored with the dealer account and store.