PU Connect

1. Overview

This document describes how PU Connect (“App”, “we”, “us”) collects, uses, stores, and protects data in connection with your Shopify store. It also constitutes a Data Processing Agreement (“DPA”) between you, the merchant (“Merchant”, “you”), and the App developer.

Developer: Brett Morse — support@partsconnectpro.com

2. Legal Roles

You (Merchant) are the data controller. You determine the purposes for which personal data is processed.
We (App developer) are the data processor. We process data only as necessary to operate the App on your behalf.
Parts Unlimited (WPS) is a sub-processor. Order and fulfillment data is transmitted to their API to process dropship orders.

3. Data We Collect and Why

Data	Source	Purpose
Staff email, first name, last name	Shopify OAuth	Identify users in access logs and app sessions
Shopify OAuth access token	Shopify OAuth	Authenticate API requests to your store
Parts Unlimited API credentials	Entered by merchant	Authenticate requests to the Parts Unlimited API
Shopify order & fulfillment IDs	Shopify Admin API	Submit and track dropship orders with Parts Unlimited
Shipping address (transient)	Shopify Admin API	Transmitted to Parts Unlimited for fulfillment; not persisted after order submission
Tracking numbers & carrier info	Parts Unlimited API	Update Shopify fulfillment records
Product, inventory & pricing data	Parts Unlimited API	Sync catalog and pricing to your Shopify store
App activity logs	App-generated	Audit sync operations; troubleshoot errors
Data access logs (user, IP, action)	App-generated	Security audit trail for access to protected data

The App does not store your customers’ email addresses, phone numbers, payment information, or any other end-customer PII beyond transient order processing.

4. Data Retention

Activity logs: deleted after 90 days
Pricing history: deleted after 1 year
Access logs: deleted after 1 year
Order raw API responses: cleared after 1 year
All shop data: permanently deleted within 48 hours of app uninstall, upon receipt of the shop/redact webhook from Shopify
Customer order data: redacted upon receipt of the customers/redact webhook from Shopify

5. Data Protection & Security

All data is encrypted in transit via TLS
Sensitive credentials (OAuth tokens, API keys) are encrypted at rest using AES-256 (ActiveRecord::Encryption)
Access to the app is rate-limited to prevent automated extraction
Bulk data exports require shop-owner authorization and are capped at 1,000 rows per request
All exports and access to order data are recorded in a tamper-evident access log
Staff passwords require a minimum of 12 characters including uppercase and numeric characters
Test and production environments are fully isolated; no real merchant data is used in testing

6. Sub-Processors

We use one sub-processor to operate the App:

Sub-processor	Purpose	Data transferred
Parts Unlimited (WPS)	Dropship order fulfillment	Order details including shipping address, line items, and dealer credentials

Data transferred to Parts Unlimited is governed by your existing dealer agreement with them. We do not control their data handling practices.

7. Your Rights as Merchant

Access: You may request a copy of all data we hold about your store at any time by contacting us
Deletion: Uninstalling the App triggers immediate deletion of all your store’s data via the shop/redact webhook
Portability: We will provide a machine-readable export of your data within 5 business days of a written request
Correction: You may update your stored credentials and settings at any time within the App

8. Data Transfers

The App is hosted in the United States. By installing the App, you acknowledge that your store data may be processed in the United States. Data transferred to Parts Unlimited (WPS) is transmitted directly from our servers to their US-based API endpoints over encrypted TLS connections.

9. Changes to This Policy

We will notify merchants of material changes to this policy by updating the “Last updated” date above and, where required, by direct notification. Continued use of the App after changes take effect constitutes acceptance of the updated policy.

10. Contact

For privacy requests, data exports, or questions about this policy:

support@partsconnectpro.com

Privacy Policy & Data Processing Agreement