Supplier Monitor Privacy Policy

Version: 2026-10-19. This policy takes effect when first published at https://elmnova.com/privacy. Preparing this version does not make it effective before publication.

Operator and contact

Supplier Monitor is operated by 邓玉聪, an individual using the ELMNOVA brand, not a separately represented registered company. Contact us for privacy, security, support or legal requests at 48817160@qq.com. Our business correspondence address is Taoyuan West Road, Maba Town, Qujiang District, Shaoguan, Guangdong 512100, China.

What the service does

Supplier Monitor analyzes manually uploaded supplier CSV feeds against the merchant's last successfully synchronized Shopify catalog. It saves selected canonical feed Snapshots and shows changes and estimated risks. It does not automatically download supplier feeds, read Shopify orders or buyer profiles, or change Shopify products, prices, SKUs or inventory.

Information we process

We process the Shopify shop domain and internal identifiers, installation status, authentication Sessions and tokens, subscription status and limits, and application settings. The official Shopify Session library can also store merchant or staff identifiers, name, email and locale when Shopify supplies them. Not every Session contains all these fields.

Catalog information includes product and Variant identifiers, titles, SKUs, list prices, currency, inventory quantities and synchronization times. Supplier information includes supplier names and descriptions, column mappings and canonical Snapshot rows such as SKU, name, cost, currency, stock, matching status and validation issues. Uploaded filenames and import/result metadata may be retained, but original CSV files are parsed transiently and are not permanently stored as files or blobs.

When you enable email summaries, we process the destination email address, supplier name, Snapshot time, aggregate risk counts, delivery result and an authenticated detail link containing internal record identifiers. Summary emails do not attach the CSV or list individual SKU costs and stock quantities. Email still discloses merchant information to the delivery provider and recipient mailbox. Support messages contain information you choose to send. Please do not send passwords, tokens, card details or supplier files by ordinary email, or upload unnecessary personal or sensitive information in CSV files.

We also process limited operational, security, queue and webhook metadata, including timestamps, status, internal identifiers, hashes and technical request information necessary to operate and protect the service. We do not intentionally retain full supplier feeds or access tokens in ordinary logs.

Purposes and processing roles

We use information to authenticate authorized access, synchronize the catalog, analyze the merchant's feeds, preserve requested history, enforce Shopify-confirmed plan limits, deliver enabled summaries, answer support and rights requests, prevent abuse, investigate incidents and meet applicable legal and Shopify obligations. We do not sell merchant information, use it for advertising, or use it to train AI models.

For merchant-controlled supplier and catalog information, we process data on the merchant's instructions to provide the service. For our own account administration, security, support and legal obligations, we determine the relevant purposes. Where a law requires a lawful basis, this may be performing the applicable contract, complying with a legal obligation or a necessary legitimate interest where that basis is legally available, with consent obtained when required. No single basis or contract is asserted to cover every jurisdiction or purpose. Applicable processing terms and transfer safeguards must match the actual relationship; contact us about the terms relevant to your organization.

Service providers and locations

Our current application and PostgreSQL database run on the existing Tencent Cloud server in Hong Kong. App-operated database backups are held on that same server. These backups are not independent off-site disaster recovery.

Enabled summaries are delivered through Resend using mail.elmnova.com. Tokyo is the sending region, not the storage location. Resend states that stored data is held in the United States, normally retains email and log data for 30 days on its Free plan, and deletes remaining customer data within 90 days after account termination; account, usage and compliance records may have different periods. Its provider processing and transfer terms apply to that relationship, not automatically to every transfer involving Supplier Monitor.

QQ Mail is used for the published support and privacy mailbox. Mailbox and recipient copies are governed by the relevant provider's handling and retention in addition to our support procedure. Healthchecks.io is used for operational Worker and backup signals, not merchant business emails: signals contain no CSV, SKU, cost, inventory or merchant email payload. Service providers necessarily process connection and account metadata. We use no third-party advertising analytics in the app. Enabling email open or click tracking is not an approved purpose of Supplier Monitor.

The operator works in mainland China, so administration or support can involve access from there. Cross-border processing may therefore involve Hong Kong, mainland China, the United States and the locations used by these providers. Identifying a destination does not by itself establish a lawful transfer mechanism. We assess applicable safeguards and provider terms for the processing concerned; we do not claim universal regional data residency or that a sending-region setting keeps stored data in that region.

Retention and deletion

Canonical supplier, mapping, catalog and Snapshot data is kept while needed to provide the installed service and requested history, subject to valid deletion requests and narrowly applicable legal obligations. An authorized merchant can delete a Snapshot through the app; this deletes its live items, not every existing backup or already delivered email.

On processing a verified uninstall notification, we deactivate the installation, remove its Sessions and cancel unfinished notifications. Workers check eligibility before further work. An email request already transmitted to a provider cannot always be recalled. Shopify's shop/redact notification normally follows uninstall after 48 hours. Our target is to erase the relevant primary-database shop data within 24 hours of receiving a valid deletion notification, not 24 hours after uninstall. Other valid rights requests do not have to wait for that webhook.

App-operated backups are for disaster recovery. Their configured rolling retention is seven days, with scheduled pruning beginning up to 30 minutes before expiry. Actual scheduled expiry has been tested. This is not a guarantee of seven full days of recoverability or an assertion that outages cannot delay disposal. Failed cleanup is investigated and affected copies restricted and disposed of as part of remediation; it is not authority to keep them indefinitely. Deletion from the primary database does not instantly remove older backup copies.

To prevent deleted data from reappearing after restoration, we keep restricted deletion-protection records outside the database: shop-domain hash, internal tenant identifier when available, timestamp and format version. These are pseudonymous, not anonymous. We retain a relevant record until all corresponding restorable copies have expired, then target disposal within a further seven days, normally within fourteen days of recording under the seven-day backup schedule. Before deleting protection records, the operator verifies the copy inventory. An exceptional retained recovery copy requires documented restrictions and a disposal/review date; protection must not be removed while that copy can restore erased data. Restores must replay deletion protection before Web or Worker processing resumes.

Routine targets are 30 days after terminal notification status, 14 days for terminal catalog-webhook metadata, and no more than 30 days after queue completion or final failure; shorter configured queue periods are retained. Pending work is kept only while necessary for eligible processing, and tenant erasure removes associated queue payloads. Scheduled cleanup and retry behavior determine disposal execution; a configured TTL alone is not proof of immediate deletion.

Necessary redacted operational logs have size and rotation limits. Our ordinary retention target is 30 days, but not all shared host/security logs currently have a verified strict day-based cap. We do not claim that every log is deleted within exactly 30 days. Ordinary support correspondence is targeted for disposal within 90 days of case closure. A specific statutory duty, dispute or security incident may require narrowly scoped records for longer, with the purpose, minimum fields, restricted access and end/review condition documented. There is no generic legal exception permitting indefinite retention of complete supplier histories. Provider and recipient copies have their own periods described above.

Security

Controls include Shopify authentication and Session validation, verified webhook signatures, tenant-scoped database access, restricted runtime database roles, HTTPS, private environment-based credentials, upload limits and validation, and bounded queues and logging. No system is completely secure. We do not represent unverified encryption-at-rest, off-site recovery or a particular uptime guarantee as implemented controls. Report suspected incidents to our contact without including credentials or unnecessary merchant data. We investigate and provide notifications required by applicable law and Shopify obligations.

Requests and rights

Contact 48817160@qq.com with the shop domain and a description of your request. Depending on applicable law and processing role, rights can include access, correction, deletion, restriction, portability, objection and withdrawal of consent, and complaint to a competent authority. We verify authority proportionately and coordinate with the relevant merchant when appropriate. Do not send account passwords or identity documents unless a justified secure verification process is separately agreed. There is no self-service export promise, and we cannot recover information already lawfully erased.

We respond and act within applicable legal time limits. Our support target of an initial reply within two business days, Monday–Friday 09:00–18:00 UTC+8 excluding public holidays, is not a substitute for a legal deadline or a guaranteed resolution time. The app is for business merchants and is not directed to children.

Changes

The current version will be published at the permanent privacy URL. For ordinary materially adverse changes we intend at least 30 days' notice through the app and published support channel. Urgent security or legal changes may take effect sooner with an explanation as soon as reasonably possible. Any legally required consent or contractual acceptance must be obtained; continued use is not assumed to cure inadequate notice.