StateWise privacy policy
1. What StateWise reads from a merchant's Shopify store
Order data, and only these fields:
| Field | Why |
|---|---|
| Order id | Deduplication and idempotent updates |
| Order date | Which measurement window a sale falls in |
| Ship-to province code and country code | The whole product: which state a sale counts toward |
| Bill-to province code and country code | Used only when an order has no shipping address at all. Tagged billing_fallback on screen so the weaker signal is visible |
| Order total (and currency) | Measured against the state's dollar threshold |
| Test flag | Test orders are excluded from every number |
| Refund total | Stored for display. Never subtracted from a threshold |
| Sales channel | Whether a sale was marketplace-facilitated |
What StateWise does NOT read, ever: customer names, email addresses, phone numbers, street addresses (line 1 or line 2), postal codes, geolocation, IP addresses, or line items.
This is architectural rather than a promise. StateWise holds Level 1 protected customer data access and requests none of Shopify's individually-approved protected fields (name, address, email, phone). Its access scopes do not permit reading them, and no query selects them.
Shop-level data: the store's domain, timezone, currency, Shopify shop id, and the contact email already on file in the Shopify admin. See section 3, because that last one is collected without the merchant typing it.
2. What a merchant uploads
Marketplace order exports (Amazon, Etsy, eBay, Walmart) and, where the merchant chooses, a Shopify order CSV export.
The uploaded file is parsed and discarded. Only the normalized fields in section 1 are stored. If a merchant's export contains customer names or addresses, StateWise does not read those columns and does not retain them.
3. The contact email, stated plainly because the merchant never typed it
At install, StateWise reads the store's contact email from the Shopify Admin API and uses it for lifecycle email: onboarding, threshold alerts, digests, and a single post-uninstall message asking why.
The merchant did not enter this address into StateWise. Every such email carries a working one-click unsubscribe (RFC 8058) and a postal address, and unsubscribing is sitewide and immediate. StateWise will not send lifecycle email to a store that has opted out, and the software refuses to send at all if the postal address is unconfigured.
4. Analytics
StateWise records product-usage events (an app was installed, a channel was imported, a map was viewed, an export was generated) keyed to the store domain, with numeric and closed-set properties only. No event carries customer data, and no event carries free text.
No third-party analytics service is used. There is no analytics SDK, no external telemetry, and no tracking pixel served to shoppers. Event rows live in StateWise's own database and are read only by its operator.
Email open and click tracking is used on lifecycle email sent to the merchant, and is authorized by a signed token rather than by a cookie.
5. Retention
| Data | Retained |
|---|---|
| Order rows, jurisdiction verdicts, physical-nexus flags, import records | While the app is installed, then purged on uninstall (section 6) |
| Uploaded CSV files | Not retained. Parsed in memory, discarded |
| Analytics event rows | Indefinitely, in pseudonymized form (section 6) |
6. Uninstall, erasure, and the two clauses policies usually get wrong
On uninstall, StateWise schedules deletion of the store's data. The delay exists because merchants uninstall and reinstall routinely, and deleting a live merchant's history is the failure mode worth guarding against. StateWise also honours Shopify's mandatory shop/redact, customers/redact and customers/data_request requests.
customers/redact has nothing to erase: StateWise holds no customer identifier of any kind. The request is still received, recorded and answered.
Two clauses stated precisely, because both are commonly misstated:
- Retained analytics rows are pseudonymized, not anonymous. At purge, the store domain in event
rows is replaced with a keyed pseudonym so that install-cohort history survives. That is pseudonymization under GDPR, not anonymization: the rows remain personal data in the legal sense, and StateWise does not claim otherwise.
- An erasure request is DISCHARGED if the store reinstalls and authenticates afterwards. If a
merchant uninstalls, an erasure is scheduled, and they then reinstall and open the app before it runs, their data is kept and lifecycle email resumes. Claiming the data was erased in that case would be false.
A merchant who wants their data deleted after reinstalling should uninstall and not reinstall, or write to [email protected].
7. Sharing
StateWise does not sell, rent or share merchant data. It is not shared with advertisers, data brokers or any third party for their own purposes.
Processors used to run the service: Amazon Web Services (hosting, database, and Amazon SES for email) and Cloudflare (DNS and email forwarding for inbound replies). No AI or model provider processes any merchant data: StateWise has no LLM surface.
8. Not tax advice
StateWise is a monitoring tool. It does not file, remit, calculate checkout tax, or register a merchant anywhere, and it does not provide tax, legal or accounting advice. See docs/MERCHANT_TERMS.md.
9. Rights and contact
Merchants may request access to, correction of, or deletion of their data by writing to [email protected]. Shopify's own privacy request tooling reaches StateWise through the mandatory compliance webhooks and is answered the same way.
Changes to this policy are published with a new "last updated" date. Material changes are announced to installed merchants by email.