Privacy Policy — Serial & Lot Tracking

Last updated: 30 September 2026. Developer: Merchant Tools. Contact: support@merchanttools.eu.

What the app does

Serial & Lot Tracking lets merchants record serial numbers and lot/batch numbers for their products and assign them to order lines, so they know which unit or lot shipped in which order (warranty, recalls, expiry dates).

Data we store

• Store data: the store domain, the store name and the store contact email (used only for one setup email after installation and for support replies), an access token (encrypted at rest) and the app settings, including an optional alert email address chosen by the merchant.
• Product data: serial numbers, lot numbers, expiry dates, quantities, and the product/variant they belong to.
• Order data: the order identifier and order number, and the line items to which serials or lots were assigned. We do not store customer names, emails, addresses or payment details.
• Write log: a record of every metafield write sent to Shopify.

Camera images used for scanning are decoded on the device and never uploaded.

Warranty lookup page (optional)

If the merchant turns it on (Standard and Plus plans), the store shows a page where anyone holding a product can type its serial number and see the product name, the warranty start and end (month and year, or the exact day if the merchant chooses) and whether it is still covered. The page never shows an order number, a customer name, an email or an address. Unknown, unsold or mismatched numbers all get the same “not found” answer. To prevent abuse, each lookup counts toward a rate limit: we keep a one-way keyed hash of the visitor's IP address (never the address itself) with a counter; it is deleted automatically within 24 hours of the visitor's last lookup. The serial numbers typed are not stored.

Permissions

read_products to find products; read_orders to list unfulfilled orders of the last 60 days; write_orders used only to write the order metafields merchant_tools.serials and merchant_tools.serials_text (the same serial and lot numbers as readable text, for printing). The app never modifies orders, products, prices or customers.

Where data is processed

Servers and the database are hosted by OVHcloud in Gravelines (France), within the European Union. Encrypted backups are stored by Scaleway in Paris (France) and kept for at most 35 days. Alert emails are sent through OVHcloud's mail servers.

Emails

We keep the store's contact email to send one setup email after installation, with the steps to activate the app, and to answer your support requests. We send no newsletters and no marketing emails. Reply STOP to that email, or write to support@merchanttools.eu, and we will not email you again except to answer your own support requests. If you reply STOP, we keep only a record of that choice (your store domain and a one-way hash of the email address), even after you uninstall, so that it is still respected if you reinstall. Expiry alerts are sent only to the address you enter in Settings, and stop as soon as you remove it.

Retention and deletion

• When the app is uninstalled, all data for that store is deleted immediately, and again on Shopify's shop/redact request 48 hours later; it leaves our encrypted backups within 35 days.
• On customers/data_request we return the serials/lots assigned to the customer's orders; on customers/redact we anonymise the order numbers in our records.

Sharing

We do not sell or share data with third parties. Data is only processed by our hosting providers (OVHcloud, and Scaleway for encrypted backups).

Changes

We may update this policy; the date above indicates the latest version.