Privacy Policy

This policy explains what data the SmileBulk Hub app (formerly "SmileBulk Dropship"; "the app") accesses and stores when a merchant installs it on their Shopify store, and how that data is used. The app connects a reseller's Shopify store to SmileBulk's wholesale fulfillment system so that orders are fulfilled on the reseller's behalf.

1. Who we are

The app is operated by SmileBulk (wholesale teeth whitening & oral care). For any privacy question or data request, contact hello@smilebulk.com.

2. What data the app accesses

With the merchant's authorization (Shopify OAuth), the app accesses:

• Fulfillment requests (read/write_assigned_fulfillment_orders, write_fulfillments, read_locations) — the app registers SmileBulk as a fulfillment service on the reseller's store. When the merchant requests fulfillment for an order, we read the items and the end customer's shipping details (name, address, phone) for that fulfillment order, accept or decline it, and later add the shipment tracking.
• Automatic fulfillment requests (write_third_party_fulfillment_orders, orders/paid webhook) — when an order containing SmileBulk items is paid, the app submits the fulfillment request to SmileBulk on the merchant's behalf, only for the fulfillment orders assigned to the SmileBulk location. Merchants can switch this off on the app home at any time; orders fulfilled from the merchant's own locations are never touched.
• Orders (read_orders) — the order number and payment status, so we only fulfill paid orders.
• Store email — on install we read the store's owner and contact email to match the store to the merchant's existing SmileBulk wholesale account, so no store address has to be entered. If a merchant enters a different email in the app, it is stored only as an activation request for our team to confirm.
• Products (write_products, write_inventory) — only when the merchant chooses to import SmileBulk products: we create them in the merchant's store with the wholesale cost and stock them at the SmileBulk location.

3. What we store

The app stores the minimum needed to operate:

• The installing store's domain and its Shopify access token (to receive orders and write tracking).
• A business mapping: the reseller's SmileBulk B2B company/location identifiers and billing email.

We do not keep a separate database of end-customer personal data. An order's shipping address is passed through to create the corresponding fulfillment (draft) order inside SmileBulk's own Shopify store, where it is held by Shopify under Shopify's terms — it is not retained separately by the app.

4. How we use data

Solely to provide the service: sync eligible orders, price and invoice them to the reseller, ship the goods to the end customer, and return tracking. We do not sell data or use it for advertising.

5. Who we share data with

Only as needed to fulfill orders: Shopify (the platform), and the shipping/fulfillment process required to deliver each order. We do not share data with unrelated third parties.

6. Data retention & your GDPR rights

The app honors Shopify's mandatory data-privacy webhooks:

• customers/data_request — the app stores no separate end-customer data, so there is nothing additional to return.
• customers/redact — no separate end-customer data is retained to erase.
• shop/redact — on this signal (sent ~48h after uninstall) the app deletes the store's record, including its token and business mapping.

On app uninstall, the stored access token is revoked immediately. To request access to or deletion of your data at any time, email hello@smilebulk.com.

7. Security

All traffic is served over HTTPS. Shopify webhooks are verified with HMAC signatures, and OAuth uses a signed state parameter. Access tokens are short-lived (expiring offline tokens), stored on an access-restricted private server and never exposed publicly. Backups are encrypted (AES-256), administrative access requires two-factor authentication, access to customer data is logged, and we follow a documented incident response procedure. Our processing of your customers' data is governed by our Data Processing Terms.

8. Changes

We may update this policy; the "last updated" date above reflects the latest version.