GDPR commitment

The General Data Protection Regulation (GDPR) is the European Union's data-protection law. It gives EU residents specific rights over how their personal data is collected, used, and stored, and places obligations on the businesses that process that data.

Although Inventory Genius is a New Zealand company, we offer the Service to merchants in the EU and EEA and process personal data that may relate to EU residents (for example, when a Shopify storefront's customer data is involved in a webhook payload). We meet GDPR's substantive requirements as part of our standard product and legal posture.

For our merchant users (the people who install Inventory Genius), we process:

• Account information — name, email, hashed password.
• Organisation details — business name and (optionally) business address.
• Service usage data — log files, IP address, browser, access times.

For the merchant's underlying Shopify data, Inventory Genius reads only the data needed to provide its features: products, variants, inventory levels, locations, orders, fulfilments. We do not access end-customer personal data, payment information, or storefront content.

Under GDPR Article 6, we rely on (a) contract — processing necessary to provide the Service you signed up for; (b) legitimate interests — operating and securing the Service; and (c) consent — for optional analytics cookies and product marketing communications, which you can withdraw at any time.

If you are an EU/EEA resident you have the following rights under GDPR Articles 15–22:

• Right of access — receive a copy of your personal data.
• Right to rectification — correct inaccurate or incomplete data.
• Right to erasure ("right to be forgotten") — request that we delete your data.
• Right to restrict processing — pause our use of your data while a question is resolved.
• Right to data portability — receive your data in a structured, commonly used format.
• Right to object — to processing based on legitimate interests or for direct marketing.
• Right not to be subject to automated decision-making with legal effect.

To exercise any of these rights, email privacy@inventory-genius.com. We will respond within one calendar month, as required by Article 12.

If you are a Shopify storefront customer (i.e., a shopper at a store that uses Inventory Genius), data-subject requests should be made through the merchant whose store you bought from. The merchant will forward the request to Shopify, and Shopify will route applicable requests to Inventory Genius via Shopify's compliance webhooks. We respond to three Shopify webhooks:

• customers/data_request — we package any data we hold relating to the customer and return it to the merchant within 30 days.
• customers/redact — we redact or delete any data we hold relating to the customer.
• shop/redact — when a store uninstalls and 48 hours pass, we delete all data relating to that shop.

Our hosting infrastructure may be located in New Zealand, Australia, or the United States. For transfers of personal data from the EU/EEA to these jurisdictions, we rely on Standard Contractual Clauses (SCCs) and on the European Commission's adequacy decision for New Zealand.

• Encryption of data in transit (TLS) and at rest.
• Sensitive credentials encrypted with a dedicated encryption key.
• JWT-based authentication.
• Multi-tenant isolation between organisations.
• Regular security reviews and access control audits.

In the event of a personal-data breach that is likely to result in a risk to the rights and freedoms of individuals, we will notify the competent supervisory authority within 72 hours of becoming aware of the breach, as required by GDPR Article 33, and will notify affected merchants without undue delay.

For any GDPR-related question, request, or complaint:

Kakariki Green Ltd trading as Inventory Genius — Privacy
Email: privacy@inventory-genius.com

You also have the right to lodge a complaint with your local supervisory authority. For the full Privacy Policy, see the Privacy Policy.