Rep Portal Privacy Policy

Last updated: November 7, 2026

Quick summary. Quay: B2B Sales Rep Portal lets the sales reps of a Shopify store order for the store's B2B companies. It reads your companies, catalogs and orders from Shopify. It keeps your reps' names and email addresses, which companies they look after, their carts and orders, and which sales count for which rep. It emails your reps their invitation, their sign-in links and a notice when an order they placed is paid. It sends a notice of each new order to the address you save in its settings. When a buyer asks for their data, we email the store owner what the app keeps from that buyer's orders, if it keeps any. It keeps no buyer's name, email, phone number or payment details from an order, except what a rep types into a PO number or note.

We do not sell data, run ads, or put analytics or trackers in the app. Besides writing orders and contact roles into your own Shopify store, the app shares personal data only with the subprocessors in Section 6.

This policy covers the Rep Portal only. Quay: B2B Credit Limits, our other app, has its own privacy policy.

1. Who we are

The Rep Portal is operated by Andrei Markov, an individual entrepreneur registered in Georgia, trading as “Simple Business”. Contact for privacy questions: hello@quayhq.com.

For the data of your store, your reps and your buyers that the app processes: you, the merchant, are the data controller; we are the data processor, acting on your instructions as set out in the Rep Portal Terms of Service and this policy. We are also bound by the Shopify Partner Program Agreement.

Those Terms together with this Privacy Policy are the written processing agreement required under GDPR Article 28 between us (as processor) and you (as controller). If your business needs a separate Data Processing Agreement, write to hello@quayhq.com.

By installing the app, you authorize us:

To process your store's personal data only as needed to provide the service described in Section 2 of the Terms.
To process it only on your documented instructions, which are the Terms and this Privacy Policy, together with what you set in the app (GDPR Article 28(3)(a)).
To engage the subprocessors listed in Section 6 (GDPR Article 28(3)(d)). We will notify you in writing at least 14 days before a change to that list takes effect. If you object and we cannot resolve it, you can uninstall the app before that date, and your store's data is deleted as Section 7 describes.

Anyone at Quay with access to your data is bound by confidentiality consistent with GDPR Article 28(3)(b). On request, we give you the information you need to check that we meet our duties as your processor. We allow and help with reasonable audits, including inspections, by you or an auditor you appoint (GDPR Article 28(3)(h)).

We operate from Georgia and comply with the Law of Georgia on Personal Data Protection (No. 3144/2023), overseen by the Personal Data Protection Service. Because your store, your reps and your buyers may be in the European Economic Area or the United Kingdom, we also process personal data in line with the EU GDPR and the UK GDPR.

2. Data we read from Shopify

Companies and locations: names, the city, region and country of each location, its currency and payment terms, and which company contacts can order there. Only the company and location names go into our database (Section 4); the rest is shown in your admin and in the portal.
Names of the contacts who can order, shown in your admin. Not stored.
A location's full shipping and billing address, with the phone number and recipient name it holds: read when a rep's cart is priced and when they place an order, and passed straight to Shopify to work out shipping and tax and to create the draft order. Not stored.
Your store: its name, domain, time zone and currency, and the store owner's email address. The app suggests that address for order notices, and we read it to send you the answer to a buyer's data request (Section 8). It is kept only if you save it for notices or invite it as a rep.
Your catalog: products, variants, collections, prices for the company location, and stock, shown in the portal. A cart and a placed order keep the title, SKU and image link of their products (Section 4).
Shipping rates and tax: Shopify works these out for a rep's cart from your store's shipping settings, and the portal shows them. Not stored, except the rate on a placed order (Section 4).
Orders: number, dates, payment status, totals and refunds, the company and location, the line items, and the order's tags and extra fields, which show whether a rep placed it. Not the buyer's name, email, phone number, addresses or payment details. From Shopify's order notifications we take only the order's ID and, for a cancelled order, when it was cancelled.
Buyers' privacy requests: from Shopify's notification we take only the request's ID and the IDs of the orders it lists, not the buyer's details.
Your subscription to the app: plan, trial end and status.

3. Data we write to Shopify

Draft orders, when a rep places an order: the company, location and contact, the items, the location's addresses and payment terms, the shipping rate the rep picked, the PO number and note the rep typed, how long to hold the stock if you set that, the tag quay-rep, and two extra fields with our IDs for the rep and the order. Depending on your setting, we then ask Shopify to email the buyer the invoice, or to complete the order as unpaid. When a rep or manager cancels an order that is not finished, we delete its draft.
A company contact's role: a draft order needs a contact who can order at the location. If none can, we give that role to the company's main contact (or its first contact) when a rep orders there. You can also pick the contact in the admin.

We write nothing else to your store.

4. Data we store

In our database:

Reps: email address, name, role (rep or manager), whether they are active or deactivated, when they were invited and when they last signed in.
Sign-in: the one-time sign-in links and the sessions of each rep, with their expiry, stored only in a scrambled form that cannot be turned back. No IP address or browser details.
Assignments: which companies each rep looks after or used to, with the dates, and which rep is a company's primary rep.
Carts: the company, the location, and each item's product, quantity, title, SKU and image link.
Rep orders: the company, the location, the items, the shipping rate and its price, the total and currency, the PO number and note the rep typed, the Shopify draft and order numbers, the payment status, and, when Shopify refused an order, its error code and message, with any email address in it replaced.
Sales records: for each order that counts for a rep, the order number, company, location, totals, refunds, currency, payment status and dates, and whether the rep placed it or the company did.
Your store: domain, name, install and uninstall dates, your settings for the app (such as the email address for order notices and how orders are finished), your subscription's plan, trial end and billing period, and when the app asked you for a review and what you answered. When a plan limit turned reps off or removed companies from reps, also those reps' names or email addresses and those companies' names, to tell you which.
Portal logo: the image you upload in the app's settings, until you replace or remove it.
Company and location names, kept up to date from Shopify.
Buyers' data requests: when a request covers orders we hold, the request's ID, the IDs of those orders, when it arrived and when we answered it. No name, email address or phone number.
Erased orders: the ID of each order named in a Shopify erasure request, and the time. No name, email address or phone number.
Shopify access: the keys the app uses to reach your store. They belong to the store, not to a staff member, and are deleted the moment you uninstall.
Records of Shopify notifications: their ID, topic, your store's domain and the time, deleted after 7 days. These records hold nothing else from the notification.

Logs. Our server logs each request without IP addresses, browser details or the part of the address after the question mark. Log lines carry the store's domain, IDs and error messages, with email addresses replaced; only a server crash report can still show one. Logs stay with DigitalOcean (Section 6) for as long as it keeps them and are not copied anywhere else.

In a rep's browser. The portal keeps the rep's sign-in session (it ends after 30 days without use or on sign-out), the location they last picked for each company, and their light or dark theme. Our code sets no cookies; the portal opens on your store's address, so Shopify's own storefront cookies apply there. Product images load from Shopify, and the portal's code, styles and logo from our app.

5. Emails

To your reps: the invitation and each sign-in link, with your store's name (and, in an invitation, the names of the companies assigned to them); a notice when an order they placed is paid, with the order number, company, location and total.
To you, at the address in the app's settings: a notice of each new rep order, with the rep's name and email address, the company, location, order number, number of items, shipping, total, PO number and note. At the store owner's email address: our answer to a buyer's data request (Section 8).
To your buyers: nothing from us. The invoice a buyer receives is sent by Shopify, in your store's name.

6. Subprocessors

DigitalOcean (United States, New York data centre): runs the app, its database and its logs. The app reaches the database only over a private network. The database disk is encrypted, and its backups are kept for 7 days.
Cloudflare (United States and worldwide): every request to the app passes through its network, which DigitalOcean's App Platform uses.
Resend (Resend, Inc., United States): sends the emails in Section 5. It keeps each email as written, with its delivery record and logs, for 30 days, and its backups for 7 days. An address that bounced or was marked as spam stays on its do-not-send list until removed. Resend lists its own subprocessors at resend.com/legal/subprocessors.

7. Data retention

While the app is installed, we keep the data in Section 4 for as long as the service needs it. Each emailed link works once: a sign-in link for 15 minutes, an invitation for 7 days. A rep stays signed in until they sign out, are deactivated, or go 30 days without opening the portal.
A rep you deactivate can no longer sign in. Their name, email address, orders and sales records stay, so your reports stay complete, until your store's data is erased. To have a rep's details erased sooner, write to hello@quayhq.com and we erase them by hand.
When you uninstall, the Shopify access tokens are deleted at once and your reps can no longer use the portal. All your store's data in our database is erased within 31 days of the uninstall, unless you install the app again before then. Database backups keep it for up to 7 more days: at most 38 days in our database and its backups. To have it erased sooner, write to us. Uninstalling does not erase our server logs, which stay with DigitalOcean for as long as it keeps them (Section 4), or Resend's copies of emails and its do-not-send list (Section 6).
A buyer's data request stays until we answer it, and 30 days after that, so we can check it was answered.
The ID of an erased order stays until your store's data is erased.

8. Privacy requests from Shopify

Customer data request: when one of your buyers asks for their data, Shopify tells us which of their orders the request covers. If we hold any of them, we record the request (Section 4) and, within 30 days, email the store owner's address these details of those orders, so you can pass them on: order number, company, location, items with their variants and SKUs, totals, refunds, payment status, dates, whether a rep placed it through the portal and how it was finished, PO number and note. If we hold none of them, there is nothing to send. We store no buyer's name, email address, phone number or Shopify customer ID, unless a rep typed one into a note or PO number.
Customer erasure: for the orders Shopify names, we delete the sales records and erase the PO number and note from our copy of the rep's order. The rest of that copy stays, such as the items and totals. We keep the order's ID so that a later notification from Shopify cannot bring the sales record back.
Shop erasure: Shopify sends it 48 hours after an uninstall; the erasure in Section 7 covers it.

Both buyer requests reach a rep's order only through its Shopify order number. An order that does not have one in our records yet, such as an invoice the buyer has not completed, is not covered.

9. Your rights

As a merchant, you can:

See your reps, their companies and their sales in the app at any time.
Download the sales report as a CSV file on the Growth and Pro plans.
Ask us to erase a rep's details, or your store's data, sooner than Section 7 says, by writing to hello@quayhq.com.
Lodge a complaint with your local data-protection authority.

As a rep or one of a merchant's buyers: make requests about your data to the merchant you work with or buy from. We help the merchant answer them.

10. Security

The app is reached only over HTTPS.
Every read of a store's reps, companies, carts and orders is limited to that store, and tests check that one store's data cannot be read for another.
In our database, sign-in links and sessions are kept only in a scrambled form that cannot be turned back.
Shopify's notifications to the app are checked by their signature before anything else.
Every portal request for data reaches us signed by Shopify, and we check the signature. After sign-in, each request also has the rep's session checked, including whether the rep is still active.
Secrets are kept in DigitalOcean's encrypted environment settings and in our password manager, never in the source code or the logs.

Security incidents. If we become aware of a security incident affecting your data, we will notify you in writing without undue delay, and within 72 hours of becoming aware for incidents involving people in the EU or UK, with what happened, its scope, and what we are doing about it.

11. International transfers

The app and its database run at DigitalOcean in the United States. If you are in the European Economic Area, the United Kingdom or another place that restricts transfers, your data is transferred to and processed in the United States. For our subprocessors (DigitalOcean, Cloudflare, Resend) we rely on their published Data Processing Agreements, which include the EU Standard Contractual Clauses or an equivalent transfer mechanism.

12. Children

The Rep Portal is a business tool for merchants and their sales reps. We do not knowingly collect data from anyone under 16. If you believe we have, write to hello@quayhq.com.

13. Changes to this policy

We will post material updates to this page and update the "Last updated" date. For substantive changes that affect installed merchants, we will notify you directly, by email to the store owner's email address, before the changes take effect.

14. Contact

For privacy questions and data requests: hello@quayhq.com.