Ladewell — Privacy Policy

Last updated: 3 September 2026

Ladewell is a supplier and purchase-order book for Shopify stores. This policy describes exactly what it reads from a merchant's store, what it keeps, what it never touches, and how long any of it lasts.

It is written to be checkable. Every claim below corresponds to code in the application, and where a figure is stated it is the figure the code uses.

Who this is about

Merchant — the person or business that installs Ladewell on their Shopify store. Ladewell holds information about merchants.
Customer — a person who buys from that store. Ladewell does not hold information about customers. The section on order data below explains precisely what it reads and what it discards.

What Ladewell reads from Shopify

Ladewell requests five access scopes and uses each of them for one purpose.

Scope	What it reads	Why
`read_products`	Product and variant title, SKU, barcode, vendor, status, price, inventory quantity, whether inventory is tracked, and the Shopify inventory item identifier	To list what a merchant sells and match it to suppliers
`read_inventory`	The quantity of each variant at each location	To say where stock is, not only how much there is
`read_locations`	Location name, whether it is active, whether it fulfils online orders	So a purchase order can be delivered somewhere
`read_orders`	Order identifier, created-at, cancelled-at, and for each line the quantity and the variant	To count units sold per day, which is what reorder suggestions are calculated from
`write_inventory`	—	See What Ladewell writes, below

Order data, specifically

Ladewell's order query requests these fields and no others:

orders {
  id
  createdAt
  cancelledAt
  lineItems { quantity, currentQuantity, variant { id } }
}

It does not request, receive, or store customer names, email addresses, phone numbers, billing or shipping addresses, payment information, or any customer identifier.

What is kept from an order is a count: this variant, this day, this many units. Order identifiers and customer identifiers are discarded at ingestion and never written to the database. This is why Ladewell's response to Shopify's mandatory customers/data_request and customers/redact webhooks is that it holds no personal data about any customer — that response is accurate.

Ladewell requests only read_orders, not read_all_orders. Shopify therefore exposes the last 60 days of orders. Every velocity figure Ladewell shows states the window it is drawn from.

What Ladewell writes

Ladewell is read-only with one deliberate exception.

Two operations change a quantity in Shopify, and both are operations that are writes by definition: moving stock between a merchant's own locations, and correcting what a location holds after a physical count. Both live on a single screen, Move stock, and both require a person to:

Enter the move, and
read the resulting arithmetic shown as plain sentences, and
press a second, separate button to apply it.

Every such write:

carries the quantity Ladewell expected to find, so Shopify refuses the change if the number moved since the screen was loaded. A sale that lands while a merchant is counting cannot be overwritten;
carries a reference identifying the Ladewell record that caused it, so the change is traceable from the merchant's own Shopify inventory history;
is recorded in an append-only log before the request is sent, and the outcome is written to that log exactly once.

Nothing in the background ever writes. No scheduled job, no webhook handler and no sync has the ability to change a quantity in Shopify.

What Ladewell stores

On its own servers, for each merchant:

Catalogue cache — the product and variant fields listed above, and the quantity at each location. A copy, kept so screens do not need an API call.
Sales counts — units sold per variant per day, for a rolling 60-day window. No order or customer identifiers.
What the merchant enters — suppliers and their contact details, lead times, payment terms, minimum orders, currencies; supplier-to-product mappings; purchase orders, their lines, and receipts.
Cost history — what was paid for a product, from whom, and when. Append-only, so a price history cannot be rewritten.
Stock moves — every transfer and count sent to Shopify, with the before and after figures. Append-only.
Operational records — sync successes and failures, notification preferences and a record of what was emailed, so nothing is sent twice.
Session data — the Shopify access token for the store, encrypted with AES-256-GCM before it is written.

Ladewell does not use a merchant's data to train models, does not sell or share it, and does not combine it with data from other merchants.

Who else processes it

Processor	Purpose	Where
Fly.io	Application hosting	Frankfurt, Germany
Supabase	Managed PostgreSQL database	European Union
Resend	Transactional email (reorder alerts and the weekly summary)	European Union / United States
Shopify	The source of the data, and the billing relationship	Per Shopify's own terms

Errors may be reported to Sentry for diagnosis when that integration is configured. Error reports carry a shop domain and a stack trace; they do not carry catalogue or order data.

Security

All traffic is over TLS. The database connection verifies the provider's certificate authority; verification is never skipped.
Data is encrypted at rest by the database host.
Shopify access tokens are additionally encrypted by Ladewell with AES-256-GCM before being stored, so a database copy alone does not yield a usable token.
Every database query against merchant-owned data is checked at runtime for a shop filter. A query without one is refused rather than executed.

How long it is kept

Sales counts — a rolling 60-day window, matching the order history Shopify exposes. Older days are pruned automatically.
Everything else — for as long as the app is installed.
On uninstall — Shopify sends a shop/redact request 48 hours after uninstall. Ladewell deletes every record belonging to that shop, including append-only history, in a single transaction. Nothing is retained.
A merchant can export everything Ladewell holds, as CSV, at any time and without asking, from the Export screen inside the app.

A merchant's rights

Merchants in the EEA and the UK have rights of access, correction, erasure, restriction, objection and portability under the GDPR. Ladewell is built so that most of these need no request at all: Export provides portability and access on demand, and uninstalling triggers erasure.

For anything else, or to ask a question about this policy, write to the support address published on the Ladewell App Store listing. Requests are answered within 30 days, and usually within one working day.

Where this policy lives, and how to reach us

This policy is published at https://ladewell.com/privacy, and the terms of service at https://ladewell.com/terms. The application serves the same two documents at https://app.ladewell.com/privacy and /terms. Both renderings are generated from the same source files in the application's own repository, so the published text and the text shipped with the code are the same text — there is no second copy that can fall behind.

Support and privacy enquiries: [email protected]. Requests are answered within 30 days, and usually within one working day.

Changes

This policy is versioned with the application. When a change to Ladewell alters what is read, stored or written, this document is updated in the same release, and the date at the top changes.