Privacy Policy

Last updated: August 7, 2026

1. Who we are

Quay is currently operated by Andrei Markov, an individual entrepreneur registered in Georgia, trading as “Simple Business”. Contact for privacy questions: [email protected].

For your store's data being processed by an app you've installed: you, the merchant, are the data controller for your buyers' personal data; Quay is the data processor, acting on your instructions per the Shopify Partner Program agreement and our Terms of Service.

These Terms of Service together with this Privacy Policy constitute the written processing agreement required under GDPR Article 28 between Quay (as processor) and you (as controller). If your business requires a separate bilateral Data Processing Agreement, contact us at [email protected].

By accepting these terms, you authorize Quay:

• To process your store's personal data only as needed to provide the service described in our Terms of Service §2.
• To process data only on your documented instructions, which are these Terms and this Privacy Policy (GDPR Article 28(3)(a)).
• To engage the subprocessors listed in Section 6 of this Privacy Policy (GDPR Article 28(3)(d), which incorporates the conditions of Article 28(2)). We will notify you in writing before any changes to the subprocessor list take effect, giving you a reasonable opportunity to object.

Quay personnel with access to your data are bound by confidentiality obligations consistent with GDPR Article 28(3)(b).

Quay is operated from Georgia and complies with the Law of Georgia on Personal Data Protection (No. 3144/2023, in force since 1 March 2024), overseen by the Personal Data Protection Service (PDPS). Because your store and your buyers may be located in the European Economic Area or the United Kingdom, we also process personal data in line with the EU GDPR and the UK GDPR; where those apply, the Article 28 commitments above govern our role as processor.

2. Data we read from Shopify

When you install Quay, the app calls Shopify's Admin API to read the following. We request only the scopes the service needs. One of them — read_all_orders — is a scope Shopify gates behind explicit justification; Quay requests it solely to read your full B2B order history (see Orders below), not just the most recent 60 days. We do not request scopes unrelated to credit management, such as write_payment_mandate or storefront pixel-tracking scopes.

• Companies — names, IDs, payment terms, contact information. Required to compute and assign credit policies per company.
• Customers — the association between a buyer (a company contact) and their B2B company. In the current version we read only this linkage (the customer ID and the company it maps to) to apply the correct company's credit context at checkout and in the buyer's account banner. Contact names and emails are read only when reminder emails ship in a future version; they are not used today.
• Orders — line items, totals, payment status, and fulfillment status, used to compute the outstanding-balance projection per company. Because B2B net terms can run to Net 90 and overdue invoices stay unpaid well beyond Shopify's default 60-day order window, Quay requests the read_all_orders scope so the one-time history import at install and the daily reconciliation can see your full B2B order history; day-to-day updates come from order webhooks.
• Payment terms (net-30, net-60, etc.). Required to determine when invoices are overdue.
• Staff identity (currentStaffMember) — name and email of the merchant staff member currently using the Quay admin UI. Used to show "who made this change" in the in-app audit log, and to name the person who placed an order in a blocked-order record — which means it can travel to Telegram in an alert if you have connected a chat (Sections 4 and 6).
• Shop name and address — for sender identity in future reminder emails (V1.1; not used today).

3. Data we write back to Shopify

Quay writes the results of its analysis to company metafields under the $app:billing namespace. These remain in Shopify while the app is installed:

• credit_limit — the credit limit you set for each company.
• available_credit — the computed amount the company can still charge.
• enforcement_state — off / hide_net_terms / hard_block, the runtime authoritative state read by checkout enforcement.
• enforcement_reason — human-readable cause of the current state.
• in_plan — whether the company is covered by your current subscription cap.

The $app: prefix means only Quay can write to these metafields, and they are set merchant-readable. On uninstall, Shopify's standard dialog offers a checkbox to delete the app's metafields with the app's data.

4. Data we store in our own database

To operate Quay, we maintain a Postgres database hosted by DigitalOcean (United States). For each shop, we store:

• Sessions — your Shopify offline access tokens, managed by Shopify's official session-storage adapter. Encrypted at rest by DigitalOcean's managed Postgres disk encryption.
• Shop settings — your in-app preferences (display name, sender email for future reminders, AR aging window, etc.).
• AR aging projection — a per-order outstanding-balance record computed from your Shopify orders. Not authoritative: refreshed from Shopify on each order webhook.
• Policy assignments — which credit policy (Standard, Trusted, VIP, Probation, or High Risk) applies to each company.
• Audit log — append-only record of policy edits, credit limit changes, and manual enforcement toggles. Records the Shopify staff user ID that made each change.
• Staff identity cache — names and emails of Shopify staff members who made audit-logged changes. Refreshed every 24 hours from Shopify.
• Subscription state — your Quay plan, status, and billing-period dates. Synced from Shopify's Billing API.
• Webhook deduplication table — Shopify webhook IDs we've already processed, to prevent double-counting under Shopify's retry behavior.
• Net Terms suspension state — for each company location Quay has placed on pay-on-order (because it is over its limit, overdue, or manually held), we record the original Shopify payment-terms template so we can restore it later.
• Dashboard metrics cache — a cached snapshot of your AR aging figures and the names of your top companies by outstanding balance, used to render the dashboard quickly. Derived from your Shopify data and refreshed hourly; never authoritative.
• Operational caches and a background-job queue — which of your companies are within your plan's limit, and a transient queue of background recompute/sync jobs. These hold only shop and company identifiers plus job bookkeeping (including the staff user ID that triggered a job), and are reconstructed from Shopify on demand.
• Reminder dispatch log — an append-only record of reminder emails sent. Reserved for the V1.1 reminder feature and currently empty (Quay sends no emails today).
• Blocked-order records — when an order gets past one of your credit blocks, we record what happened: the order's Shopify ID and number, the company's Shopify ID and name, whether the block was passed as the order was placed or when it was later edited upward, why the order should have been blocked (for an overdue invoice, that invoice's number and how many days late it was; for a manual hold, the reason text you typed; for an edit, the amount the order grew by), the order amount and currency, the company's available credit and credit limit at that moment, the sales channel the order came through, and the Shopify staff user ID and cached name of the person who placed it — which may be that person's email address, because the staff cache falls back to the email when no name has been stored. Alongside each record we keep the delivery state of its Telegram alert (queued, sent, failed or skipped, the number of attempts, the last error, and when it was sent). These records are written for every store, whether or not you use Telegram.
• Telegram connection — if you connect a Telegram chat, we store that chat's Telegram ID, its type (group or private chat), its title, whether the connection is active or revoked and why it was revoked (you disconnected it, the bot was removed from the chat, or you replaced it with a different chat), and the times it was connected, revoked, and last delivered to. If you connect a private chat rather than a group, the chat ID we store is the Telegram user ID of the person who set it up — a personal identifier for that individual. Our bot acts only on the connect command you send it; we do not read, store, or use anything else posted in the chat.
• One-time connection codes — the short-lived codes used to link a chat, stored only as a one-way hash, valid for 15 minutes and a single use. See Section 7 for how long the hashed row is kept.

We do not store your buyers' addresses, phone numbers, payment information, or browsing behavior. We do not store any data about visitors to your storefront.

Buyer-facing banner. Quay's Customer Account UI Extension shows the authenticated buyer a single banner on their Shopify customer account page when their company is over its limit or on credit hold, explaining the restriction and who to contact. The banner is composed at the company level: it does not list individual invoices, balances, or another contact's orders. Healthy accounts and direct-to-consumer buyers see nothing. It is shown only to the buyer through Shopify's Customer Account authentication, scoped to their own company — never another company's.

5. Marketing site (quayhq.com)

The marketing site at quayhq.com uses Cloudflare Web Analytics: a cookie-free, privacy-first analytics service that aggregates page views and referrer data without setting tracking cookies and without persistent visitor identifiers. We use it to understand traffic sources and content effectiveness. No personal data is collected. We believe no consent banner is required because the marketing site uses no cookies or persistent identifiers; if your jurisdiction's regulator takes a different view on cookie-free analytics, contact us at [email protected].

The app itself (everything under app.quayhq.com) uses no analytics.

6. Subprocessors

Data we entrust to operational vendors:

• Shopify — your platform of record. We read from and write to your Shopify store via the Admin API. Per the Shopify Partner Program agreement.
• DigitalOcean (United States) — application hosting and managed Postgres database. Disk encryption at rest; TLS in transit.
• Cloudflare (US/global) — DNS, CDN, and cookie-free Web Analytics for the marketing site.
• Telegram (Telegram Messenger Inc.) — used only if you connect a Telegram chat to Quay, and only to deliver the blocked-order alerts described below.

Quay does not sell your data, serve advertising, or share your data with advertising networks or third-party product-analytics services. If we engage a new operational subprocessor in the future — for example, an error-monitoring service to improve reliability, or the transactional email provider described below — we will add it to this list and notify installed merchants before it goes live.

Email transport. When reminder emails ship in V1.1, we will engage a transactional email provider (currently expected to be Resend or Postmark). We will update this page and notify installed merchants before the feature is enabled.

Telegram is not on the same footing as the other three. Shopify, DigitalOcean and Cloudflare are contracted subprocessors: we use them under their published data processing agreements, and the Article 28 commitments in Section 1 rest on those. We have no data processing agreement with Telegram. The Quay bot is used under Telegram's ordinary public terms, and it carries your data only because you chose to connect a chat. If that is not acceptable for your business, do not connect one — the feature stays off and nothing reaches Telegram.

What an alert contains. Once you connect a chat, each alert carries the order number and a link to that order in your Shopify admin, the order amount and currency, the company name, the reason the order should have been blocked (for an overdue invoice: the invoice number and how many days late it is; for a manual hold: the reason text you typed, word for word; for an order edited upward: the amount it grew by), the company's available credit before the order whenever a credit limit is set, the sales channel, and the person who placed the order — their name, or the email address if that is what our staff cache holds, or their Shopify staff ID if we have no name at all. The one-off message our bot posts when you first connect a chat names your store. We do not send your buyers' names or contact details, their addresses, or the order's line items — though a manual-hold reason is free text, so whatever you wrote there travels with the alert.

Telegram's own privacy policy governs what Telegram does with a message once it arrives. That policy states the service is provided by Telegram Messenger Inc., with group companies Telegram Group Inc and Telegraph Inc in the British Virgin Islands and Telegram FZ-LLC in Dubai, and names the European Data Protection Office, Avenue Huart Hamoir 71, 1030 Brussels, as its representative for EU data-protection matters. Disconnecting the chat in Quay's settings stops all further messages immediately and our bot leaves the chat; alerts already delivered remain in your Telegram chat and cannot be recalled by us.

7. Data retention

While Quay is installed, we retain operational data for as long as needed to run the service.

On app uninstall, Shopify revokes our access token and fires the app/uninstalled webhook. We delete your access tokens and session rows immediately, and we schedule the rest of your shop data for deletion 30 days later.

The 30-day grace window exists so an accidental uninstall — or a reinstall while you evaluate Quay — does not lose your configuration. If you reinstall within 30 days, the pending deletion is cancelled and your policies, company assignments, and history are preserved. If you do not reinstall, a daily cleanup job permanently and irreversibly deletes all of your shop's data once the window elapses — including the audit log, the order-invoice projection, your policies, and every operational cache and queue listed in Section 4. Nothing is retained indefinitely.

Your stored data is accessible only to Quay operations staff (currently a single founder) and is never shared with third parties beyond the subprocessors in Section 6. If you want your data deleted sooner than the 30-day grace window, contact us at [email protected]. We will acknowledge your request within 30 days and purge promptly.

Cache refresh schedules: the KPI cache refreshes hourly; the Shopify staff identity cache refreshes every 24 hours.

Telegram data. A one-time connection code stops working as soon as it is used or after 15 minutes, whichever comes first, but the hashed row itself stays in the database until you generate the next code for your store — which clears every code row we hold for you — or until your shop data is deleted. Your chat connection, the connection codes, and the blocked-order records all go with the rest of your shop data under the same 30-day uninstall rule above, or immediately if you uninstall with Shopify's "delete this app's data" option (Section 8). Messages already delivered to your Telegram chat are outside our control and stay there until you delete them.

8. Shopify GDPR webhooks

Every Shopify app must implement three GDPR-related webhooks. Quay implements them as follows:

• customers/data_request — when one of your buyers asks for their data, Shopify forwards the request to Quay. Today Quay stores no buyer-keyed personal data (the audit log and AR projection are keyed by company and order, not by buyer). We acknowledge receipt and return success.
• customers/redact — when one of your buyers asks for their data to be deleted, Shopify forwards the request. We acknowledge receipt and return success (no buyer-keyed records to delete in V1).
• shop/redact — when you uninstall and opt into deleting the app's data, Shopify fires this webhook approximately 48 hours later. We immediately and irreversibly delete all of your shop's stored data across every table — access tokens, audit log, order-invoice projection, policies, and every operational cache — rather than waiting out the 30-day grace window in Section 7.

When reminder emails ship in V1.1, the customers/data_request and customers/redact handlers will be extended to export and delete reminder-log entries that include buyer email addresses.

9. Your rights

As a merchant, you can:

• Access your data inside Shopify at any time — we write results back to your metafields.
• Export records through Shopify's standard reports.
• Request deletion of your stored data sooner than the 30-day post-uninstall grace window by emailing [email protected].
• Lodge a complaint with your local data-protection authority.

As one of a merchant's buyers: route data-subject requests through the merchant first. If a request involves data that touches Quay, the merchant can contact us and we will support them in responding.

10. Security

The following applies to the Quay application at app.quayhq.com. The marketing site at quayhq.com is a static site hosted on Cloudflare Pages with no servers or PII storage.

• All data in transit is encrypted with TLS. HTTPS-only, with HSTS enabled.
• Postgres connections use TLS (sslmode=require) over a private VPC network between the app and database.
• Postgres disk is encrypted at rest by DigitalOcean's managed Postgres service.
• Application database queries are scoped by shop ID through a Prisma client extension that throws when the scope is missing; the few low-level maintenance queries are explicitly shop-scoped. One merchant's data cannot be queried by another merchant — a constraint built into how the database client is constructed.
• Shopify webhooks are verified by HMAC signature before any processing.
• Embedded admin requests are verified by Shopify session token (JWT).
• Secrets are stored only in DigitalOcean's encrypted environment variables. Never in source code, never in logs.

Security incidents. If we become aware of a confirmed security incident affecting your data, we will notify you in writing without undue delay, and in any event within 72 hours of becoming aware for incidents involving EU/UK data subjects — so you can meet your own GDPR Article 33 obligations toward your supervisory authority. We will include details of the incident, its scope, and the steps we are taking to mitigate it.

11. International transfers

Our database is hosted by DigitalOcean in the United States. If you are based in the European Economic Area, the United Kingdom, or another jurisdiction with cross-border data-transfer restrictions, your data is transferred to and processed in the United States. We rely on:

• Shopify's Data Processing Addendum, which you accepted as a Shopify merchant.
• For onward transfers to our subprocessors (DigitalOcean, Cloudflare), we rely on their published Data Processing Agreements, which include Standard Contractual Clauses or equivalent transfer mechanisms. Standard Contractual Clauses are not signed bilaterally between Quay and individual merchants.
• DigitalOcean's and Cloudflare's published security and compliance posture.
• If you connect a Telegram chat, the alert messages are delivered through Telegram's infrastructure. Telegram's privacy policy states that if you signed up for Telegram from the UK or the EEA, your data is stored in data centres in the Netherlands, and it names the European Data Protection Office in Brussels as its EU representative. That is Telegram's own statement about Telegram account data; we do not offer it as an assurance about where an alert is routed or stored, and we hold no transfer agreement with Telegram (Section 6). This transfer happens only because you chose to connect a chat, and only for the alert content described in Section 6.

12. Children

Quay is a business tool intended for use by merchants and their B2B customers. We do not knowingly collect data from anyone under 16. If you believe we have, contact [email protected].

13. Changes to this policy

We will post material updates to this page and update the "Last updated" date. For substantive changes that affect installed merchants, we will notify you directly — by email to the contact address on file for your store — before the changes take effect.

14. Contact

For privacy questions, data-subject requests, or to inquire about retained records: [email protected].