Last updated: 2026-08-16
1. Who operates MarginCraft
MarginCraft is provided by Automatify Handelsbolag, a Swedish handelsbolag (trading partnership), organization number 969782-2584, Körsbärsvägen 9, 616 90 Åby, Sweden. Automatify Handelsbolag is the data controller for the merchant-configuration and Shopify-authentication data described in this policy. "Automatify" is MarginCraft's developer/product brand; Automatify Handelsbolag is the registered legal entity behind it — see the MarginCraft Terms of Service for the same legal identification.
For privacy questions, data-access requests, or data-related concerns, contact support@margincraft.app — see §9.
2. Overview
MarginCraft is a Shopify embedded app that helps merchants calculate the profitability of their orders and products. This document explains exactly what Shopify data is accessed, what is stored, how it is used, and how it is protected.
The app holds two read-only Shopify API scopes: read_products and read_orders. No write scopes, no customer data scopes, and no payment scopes are requested.
One feature, Profit by Market, reads the destination country (not the rest of the address) from each order's shipping/billing address, to group order profitability by market. Shopify classifies country data as part of its Protected Customer Data policy (the MailingAddress "Address" field group) — a separate access gate from OAuth scopes, requested in the Partner Dashboard. See §3.1 and §4 below for exactly what is and isn't accessed.
3. Data we access
3.1 Order data — fetched from Shopify, processed transiently, never stored
Fetched on demand when the merchant views the app. Held in server memory only for the duration of the HTTP request that needs it, then discarded. Never written to the database, a log file, or any other persistent location.
| Field | Purpose |
|---|---|
| Order ID, reference number | Identify the order in the UI |
| Order creation date | Display in the orders table |
| Revenue, tax, discount, shipping totals | Profit formula inputs |
Payment gateway name(s) used (paymentGatewayNames) | Select the merchant's own configured payment-fee rule for that gateway, if any — no card, account, or transaction-level payment data; still covered entirely by the existing read_orders scope |
| Line item quantities and variant prices | Per-line cost calculation |
| Variant IDs on line items | Link to merchant-entered cost prices |
Shipping/billing address country only (shippingAddress.countryCodeV2/country, billingAddress.countryCodeV2/country) | Group order profitability by destination market ("Profit by Market" feature). No street address, city, zip, recipient name, or phone number is requested. Shopify classifies this as Protected Customer Data (Address field group) — see §2 above; falls back to "Unknown market" (never dropped, never a guess) when unavailable |
3.2 Product and variant data — fetched from Shopify, processed transiently, never stored
Fetched on demand. Same lifecycle as order data above.
| Field | Purpose |
|---|---|
| Product and variant IDs | Match cost prices to variants |
| Product title, variant title, SKU | Display in the products table |
| Variant sale price | Gross margin calculation |
Shopify's own "Cost per item" (inventoryItem.unitCost), when the merchant has set one | Preferred cost source, used ahead of a manually entered cost — see §3.3 |
Shop's own reporting currency (Shop.currencyCode) | Displaying amounts in the merchant's own store currency |
3.3 Merchant-configured data — stored in the database
Stored persistently, keyed to the merchant's Shopify shop domain, so configuration survives between sessions. All of this is data the merchant themselves types into MarginCraft's Settings/Products pages — none of it is fetched from Shopify's customer records.
| Data | Table | Contents |
|---|---|---|
| Merchant settings | MerchantSettings | Default payment-fee %/fixed amount, packaging cost, shipping/handling cost, VAT calculation mode and rate, payment-provider label, estimated return rate %, target contribution-margin % (used by Profit Opportunities), and whether the merchant has dismissed the onboarding card |
| Variant cost prices | VariantCost | Cost price and shipping-cost override the merchant entered per product variant |
| Payment-fee rules | PaymentFeeRule | Merchant-entered fee %/fixed amount per payment gateway (e.g. Klarna, PayPal), and whether each rule is enabled |
| Shopify session/authentication data | Session | See §3.4 below |
3.4 Shopify authentication data — stored in the database
MarginCraft authenticates with Shopify using the Admin API's standard offline (shop-level) access-token flow. One Session row per installed shop stores: the shop domain, the current offline access token (and, for Shopify's expiring/refreshable token grant, a refresh token and its expiry), token scope, and expiry metadata. This is required to make authenticated API calls to Shopify on the merchant's behalf and cannot be avoided by an embedded Shopify app.
The Session table's schema (defined by the standard @shopify/shopify-app-session-storage-prisma library MarginCraft uses, not by MarginCraft itself) also includes columns that can hold a Shopify staff member's name, email, and locale for a per-user ("online") session. MarginCraft does not use online sessions — it authenticates at the shop level only — so these columns are always empty in practice.
4. Data we do NOT access
MarginCraft never requests or processes the following:
- Customer names
- Customer email addresses
- Customer phone numbers
- Street address, city, or postal/zip code, for either shipping or billing addresses
- Any other customer identity information
No customer-scoped API permissions (e.g. read_customers) are requested, and no full address is ever fetched. The one exception, disclosed precisely: the country (only) of an order's shipping or billing address is read, solely to group order profitability by destination market (§3.1) — this is order-level geographic data, not a customer identity field, and it is never stored (§6).
5. Purpose of processing
All data is used exclusively to provide the merchant with profitability analytics for their own Shopify store:
- Calculate gross margin, profit, and cost breakdowns per order
- Rank products and variants by profitability
- Apply merchant-defined cost assumptions (fees, packaging, VAT, shipping)
- Authenticate the merchant's own store with Shopify's Admin API
Data is never used for:
- Advertising or remarketing
- Customer profiling or segmentation
- Resale or sharing with third parties
- AI model training
- Analytics unrelated to the merchant's own store
6. Data retention
| Data | Retention |
|---|---|
| Order and product data, including destination country (§3.1) | In-memory only; discarded at the end of each request that fetched it |
Merchant settings (MerchantSettings) | Until the shop's data is deleted — see §7 |
Variant cost prices (VariantCost) | Until the shop's data is deleted — see §7 |
Payment-fee rules (PaymentFeeRule) | Until the shop's data is deleted — see §7 |
Shopify session/authentication data (Session) | Until the shop's data is deleted — see §7 |
The retention and deletion behavior described above also covers uninstall, reinstall, customers/redact, and shop/redact.
7. Compliance webhooks
MarginCraft implements and responds to Shopify's mandatory privacy webhooks (customers/data_request, customers/redact, shop/redact) and the app/uninstalled lifecycle webhook:
| Webhook topic | Handler behaviour |
|---|---|
customers/data_request | No customer PII is held or stored (order destination country, §3.1, is processed transiently in memory only and never persisted — see §6). Acknowledged immediately; nothing to report. |
customers/redact | No customer PII is held or stored. Acknowledged immediately; nothing to delete. |
shop/redact | All merchant data (Session, MerchantSettings, VariantCost, PaymentFeeRule) is permanently deleted for the shop. |
app/uninstalled | The same deletion runs immediately on uninstall, not just 48 hours later at shop/redact, as described in this policy. |
All webhooks are HMAC-SHA256 verified before any action is taken.
8. Security summary
- All traffic uses HTTPS/TLS.
- Incoming webhooks are HMAC-verified before processing.
- API credentials are stored as platform-managed environment variables;
- Production data is stored in a managed PostgreSQL database.
never logged or exposed to clients.
9. Your rights and choices
Merchants can delete all stored MarginCraft data for their shop at any time by uninstalling the app from their Shopify admin — see §6 and §7 for what is deleted and when.
For data inquiries, access requests, or questions about this policy, contact support@margincraft.app.