Privacy Policy

Tax Integrity Monitor — Shopify Tax Discrepancy Scanner

Effective date: April 1, 2026

This Privacy Policy explains how Alpenglow Software LLC ("we," "us," "our"), operator of Tax Integrity Monitor ("the App") collects, uses, stores, and protects information when you install and use the App through the Shopify platform.

1. Information We Collect

Data from Shopify APIs

When you install the App, we access the following through the Shopify Admin API:

• Order data (read_orders scope) — Order names, IDs, tax line amounts, tax line rates, tax line titles (jurisdiction names), refund amounts, refund tax details, financial status, and currency. We access order data in read-only mode to scan for tax discrepancies caused by partial refunds, undercollection, and collection in unregistered jurisdictions.
• Full order history (read_all_orders scope, if approved) — Same data as above but beyond the standard 60-day window. This protected scope requires separate approval from Shopify's Partner team and enables historical tax audits.

Access to full order history requires that Shopify has approved the read_all_orders protected scope for the App and that you have installed the App with this scope enabled. You may revoke this access at any time by reinstalling the App without granting the scope. The standard read_orders scope (60-day window) remains active regardless.

We do not request write access to your orders. We do not modify any order, refund, or financial data.

Data collected through Shopify session

Shopify provides the following data as part of the standard app authentication process:

• Shop domain
• Staff member name, email address, and user ID
• Account role (store owner or collaborator) and email verification status
• Locale preference
• Session tokens, access tokens, and refresh tokens

This session data is managed by Shopify's official session storage library and is required for the App to function within the Shopify Admin.

Merchant-provided configuration

• Nexus states — US states where you have declared sales tax registration. You provide this information voluntarily through the App's settings to enable unregistered collection detection.
• Monitoring preferences — Scan frequency and notification settings.

Data we do NOT collect

• Customer or shopper personal information (names, addresses, emails, phone numbers)
• Payment card or banking information
• Product catalog or inventory data
• Theme or storefront code
• Analytics or visitor behavior data
• Marketing or advertising data

We do not use AI or machine learning to process your data.

2. How We Use Your Information

We use the data we collect solely to provide and improve the App's services:

• Tax discrepancy scanning — We analyze order and refund data to detect tax overpayment from partial refunds, undercollection relative to known state base rates, and accidental tax collection in states where you are not registered.
• Scan results — We store findings (order ID, order name, finding type, jurisdiction, expected tax, actual tax, discrepancy amount, and severity) so you can review results in the App's dashboard.
• Subscription management — We store your current billing plan to gate features appropriately.
• App functionality — We use your shop domain and session data to authenticate requests and deliver the App within the Shopify Admin.

For the purposes of applicable data protection laws, you (the merchant) are the data controller for the order and business data you make available through the App. Alpenglow Software LLC acts as a data processor, processing this data solely on your behalf and as described in this policy. For any data we collect directly from you (such as support communications or nexus configuration you provide), we act as an independent data controller.

3. How We Process Order Data

Your order data is processed as follows:

1. Orders are fetched from the Shopify Bulk Operations API and downloaded as JSONL files.
2. Each order is analyzed in memory by our tax computation engine, which compares original tax amounts against current (post-refund) tax amounts.
3. Only the scan findings (metadata and discrepancy details) are stored in our database. We store order IDs and order names for reference but do not store full order contents.
4. JSONL files are processed and discarded — they are not retained after analysis.

4. Data Storage and Security

• All data is stored in a PostgreSQL database hosted on Railway (United States).
• Shopify access tokens are encrypted at rest using AES-256 encryption.
• All connections use HTTPS/TLS encryption in transit.
• We do not sell, rent, or share your data with third parties for marketing purposes.
• In the event of a data breach affecting your data, we will notify you and Shopify within 24 hours of discovery, in accordance with Shopify's Partner Program Agreement and applicable law.

5. Third-Party Services

The App uses the following third-party services to operate:

No full order data is transmitted to Inngest or any other external service. Order data is fetched directly from the Shopify API and processed on our application server.

If we add or replace a sub-processor in a way that materially affects how your data is processed, we will update this Privacy Policy and notify you through the App.

6. Data Retention

• While installed — Scan results, findings, and shop data are retained for as long as the App is installed on your store.
• On uninstall — All data associated with your shop is permanently deleted immediately and automatically. This includes: sessions, scans, findings, nexus configuration, and your shop record. Deletion is atomic and irreversible.
• GDPR shop/redact — If Shopify sends a shop data erasure request, all shop data is deleted within 48 hours.

7. Your Rights

You have the right to:

• Access — View all scan data and findings through the App's dashboard. Export findings as CSV.
• Deletion — Uninstalling the App immediately deletes all your data. You can also contact us to request deletion without uninstalling.
• Data portability — Contact us to request an export of your stored data in machine-readable format (CSV or JSON).
• Correction — Contact us if you believe any stored data is inaccurate.

We respond to all data requests within 30 days.

8. International Data Transfers

Your data is processed and stored on servers located in the United States. By using the App, you consent to the transfer of your data to the United States for processing.

9. Cookies and Tracking

The App does not use cookies, tracking pixels, or any analytics or advertising technologies. We do not track your behavior within the Shopify Admin.

10. Children's Privacy

The App is designed for use by Shopify merchants (business users) and is not directed at children under 13. We do not knowingly collect data from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the effective date at the top of this page. Continued use of the App after changes constitutes acceptance of the updated policy.

12. Contact Us