Privacy Policy — Repoleo: Reorder List
DRAFT — pending approval. Not yet in force.
Last updated: 11 November 2026
1. Who we are
"Repoleo: Reorder List" (the "App") is a Shopify app provided by Dobeo, operated by Ricardo Carapeto (trading as Dobeo), Portuguese tax number (NIF) 229502075, Rua Zamenhof 4 2 dto, 2830-325 Barreiro, Setúbal, Portugal. For the data described here we act as a processor on behalf of the merchant who installs the App, and as a controller for the account and billing data we need to run the service.
Contact: support@dobeo.com.
2. Summary
- The App reads products, variants, inventory quantities and locations only, with the Shopify
read_products,read_inventoryandread_locationspermissions. It never changes your store. - It does not read orders or customers and does not request Protected Customer Data. It measures how stock goes down, not sales.
- We do not sell data, do not show ads and do not use your data to train AI or machine-learning models.
3. Information we collect
3.1 From your Shopify store (through Shopify APIs and webhooks)
| Data | Purpose | Retention |
|---|---|---|
| Products and variants: IDs, titles, SKUs, vendor, status, inventory policy, whether inventory is tracked | Build the reorder list, grouped by vendor | While the App is installed |
| Inventory quantities per location (available and incoming) and location names | Show current stock, measure daily stock outflow and suggest reorder quantities | Current quantities: while the App is installed. Daily stock movement: 90 days |
| Store domain, store contact email (only on paid plans, as the first weekly digest recipient), time zone, plan and subscription status | Identify your store, send the weekly digest at 8:00 local time, provide your plan | While the App is installed |
| Shopify access and refresh tokens | Read your products and inventory | Encrypted (AES-256-GCM) while the App is installed; deleted on uninstall |
3.2 From you
| Data | Purpose | Retention |
|---|---|---|
| Email addresses of the weekly digest recipients (paid plans only). These are members of your team, not your customers. | Send the weekly digest and test emails | Until you remove them or your store's data is deleted. Unsubscribed addresses are kept as "unsubscribed" so they are not emailed again |
| Settings: lead time, safety stock, cover days, minimum order quantity and pack size per vendor; locations included; digest day | Calculate suggestions the way you chose | While the App is installed |
3.3 Automatically
| Data | Purpose | Retention |
|---|---|---|
| Email log: kind of email, number of recipients and listed items, delivery status. Never the body or the addresses | Daily limits and diagnostics | 90 days |
| Hashed IP address (salted) on the unsubscribe page | Rate limiting | 24 hours |
| Technical logs of our hosting provider (no tokens, no email addresses) | Security and debugging | Up to 7 days |
| Usage milestones: dates of install, plan start, first reorder suggestion and uninstall, with the plan and days since install. Never email addresses. If enabled, install, first suggestion and uninstall are also emailed to our own support mailbox (support@dobeo.com) through Resend, with the store domain, plan and days since install | Understand how stores start using the App and help new stores with setup | Until your store's data is deleted (48 hours after uninstall). Daily totals without any store data are kept. Notices in our support mailbox are deleted on request |
4. Information we do not collect
Orders, customers, buyers' personal data, payment data, staff accounts, themes, discounts or store settings. The App does not use cookies of its own and has no analytics or advertising trackers.
5. How we use information
Only to provide the App: build the reorder list, calculate suggestions, send the emails you configured, apply your plan's limits and support you. Not for profiling, advertising or AI training.
6. Sharing and service providers (sub-processors)
| Provider | Service | Data |
|---|---|---|
| Shopify | Platform, billing | Data received from Shopify; subscription status |
| Cloudflare, Inc. | Hosting (Workers), database (D1) | All data in §3 |
| Resend | Email delivery | Recipient address, email content (reorder summaries); for the notices sent to us, your store domain and usage milestones |
We do not sell or rent data. We may disclose data if required by law.
7. International transfers
Our providers may process data outside your country, including in the United States, under the Standard Contractual Clauses (SCCs) and other contractual safeguards those providers offer.
8. Retention and deletion
- Daily stock movement is kept for 90 days. Email logs are kept for 90 days. Technical logs are kept for up to 7 days.
- Uninstall: processing stops immediately and the Shopify sessions are deleted.
- 48 hours later, when Shopify sends the
shop/redactrequest, every record of your store is deleted from our database. If you reinstall the App before that request arrives, your settings are kept and stock measurement starts again. - You can ask for earlier deletion at support@dobeo.com.
9. Security
Encrypted tokens at rest (AES-256-GCM), HMAC-verified webhooks, signed one-click unsubscribe links, least-privilege permissions (read_products, read_inventory and read_locations only), secrets kept out of the code.
10. Your rights
Depending on where you live (for example under the GDPR or the CCPA), you can ask for access, correction, deletion, restriction or portability of your data, and object to processing. Write to support@dobeo.com. You can also complain to your data-protection authority, including the Comissão Nacional de Proteção de Dados (CNPD) in Portugal.
We are established in Portugal, in the European Union, so we do not appoint a separate EU representative under Article 27 of the GDPR.
11. Customers of merchants
The App does not process data of your store's customers. Shopify's customers/data_request and customers/redact requests are answered with no data, because there is none.
12. Emails
Every email says why it was sent, links to this policy and has a one-click unsubscribe link (RFC 8058).
13. Children
The App is for businesses and is not directed at children.
14. Changes to this policy
We will update the date above and, for material changes, tell merchants in the App or by email.
15. Contact
Ricardo Carapeto (trading as Dobeo), Portuguese tax number (NIF) 229502075
Rua Zamenhof 4 2 dto, 2830-325 Barreiro, Setúbal, Portugal
Email: support@dobeo.com