Version: 17 October 2026
This Privacy Policy explains how Extelynx ("we", "us", or "our") collects, uses, stores, shares, and deletes information when a Shopify merchant installs or uses COM Inbound (the "App").
COM Inbound helps made-to-order merchants track customer- or vendor-supplied materials associated with Shopify orders from expected shipment through receipt, inspection, issue resolution, and production approval.
1. Who is responsible for the App
Publisher and data controller: Extelynx
Privacy and support contact: support@extelynx.com
Security contact: security@extelynx.com
For personal data processed on the merchant's behalf, the merchant is the controller and we act as processor under our Data Processing Agreement. We act independently for our own business contact and legal-obligation processing. The Terms include the DPA and are accepted through use, without a separate checkbox. This does not replace any customer consent or other legal basis the merchant must establish.
2. Information we receive from Shopify
The App requests the Shopify read_orders permission. It reads only the order information needed to identify an order and determine whether it remains active:
- Shopify order ID;
- order name or number;
- order creation date;
- cancellation, closure, deletion, or availability state.
The App intentionally does not request or copy customer names, postal addresses, email addresses, phone numbers, or Shopify order-note contents. It reads a limited live summary of the first order line-item names and quantities to help the merchant identify an order. This line-item summary is not persisted in the App database.
Shopify provides authentication and webhook information needed to operate the App, including the shop domain, encrypted app-session credentials, webhook delivery identifiers, and lifecycle events such as app uninstall, order cancellation, order deletion, and mandatory privacy requests.
The App uses offline shop sessions. Staff profile IDs, names, email addresses, locale, and owner/collaborator/email-verification attributes are not retained in session storage. Staff authorship of operational actions is not recorded. Shopify still authenticates access to the embedded App.
3. Information merchants enter into the App
Merchants can enter operational information such as:
- material labels, expected quantities, units, sender types, and due dates;
- shipment references and optional HTTPS tracking links;
- received and accepted quantities and receipt timestamps;
- inspection condition, inspection notes, shortage, damage, and mismatch facts;
- approval, rejection, issue-resolution, and reopen reasons;
- app settings and an append-only operational activity history, including minimal facts that a receipt was corrected or deleted.
The App tells users not to enter personal information in free-text fields. Merchants should not enter customer names, contact details, addresses, payment information, passwords, access tokens, or other sensitive information into material labels, references, notes, or reasons.
4. Technical and usage information
We process limited technical and operational records needed to secure and run the App, such as:
- installation and authentication state;
- idempotency and webhook-delivery records;
- timestamps, controlled error states, and service logs;
- minimized exception reports containing an error class, stack-frame code locations, code-controlled component and operation tags, release identifier, and environment. Before transmission, we remove request URLs and headers, user or shop identity, messages, breadcrumbs, context, extra fields, order identifiers, material labels, notes, and other free text;
- public availability results and a success/failure heartbeat for scheduled operational health checks;
- privacy-request status;
- product events such as installation, app open, case creation, shipment or receipt recording, issue resolution, approval, rejection, and reopen.
Product analytics are designed not to include Shopify order IDs, customer identifiers, material labels, notes, or free-text contents.
5. How we use information
We use information to:
- provide the material receiving, inspection, issue, and approval workflow;
- associate merchant-entered material records with the correct Shopify order;
- prevent an order from being shown as production ready when required material is incomplete, rejected, affected by an unresolved issue, or the Shopify order is unavailable or cancelled;
- authenticate shops and maintain secure app sessions;
- process Shopify webhooks and privacy requests safely and idempotently;
- maintain security, reliability, support, and incident response;
- measure aggregate installation, activation, workflow completion, and service health without using customer PII for analytics;
- comply with applicable legal obligations and enforce our Terms of Service.
We do not sell personal data. We do not use Shopify order data for advertising, marketing profiles, or unrelated analytics.
6. Legal bases
Where the GDPR, UK GDPR, or similar law applies, we process information as necessary to provide the App under our contract with the merchant, to comply with legal obligations, and for legitimate interests such as securing, maintaining, and improving the service. Where consent is legally required, we will rely on consent for the relevant processing.
7. Service providers and disclosures
We disclose information only as needed to operate and protect the App, comply with law, or complete a business transition subject to appropriate safeguards. Current categories of recipients include:
- Shopify — platform authentication, Admin API, installation, and webhook delivery;
- Railway — application hosting, PostgreSQL hosting, networking, and deployment infrastructure;
- Better Stack — public availability monitoring, scheduled-job heartbeat, incident alerting, and minimized application exception tracking;
- professional advisers, regulators, courts, or law-enforcement authorities where disclosure is legally required.
We require service providers to process information only for the services they provide to us and to apply appropriate safeguards.
8. Hosting and international transfers
The primary application and PostgreSQL database are hosted in Railway's US East region in Virginia, United States. Better Stack monitoring and minimized exception telemetry are processed in the United States. The App does not promise EU data residency.
When information is transferred from the European Economic Area, United Kingdom, or Switzerland to the United States or another country without an equivalent level of protection, we use an applicable European Commission adequacy decision where available, including the EU–US Data Privacy Framework for participating recipients. Otherwise, we rely on the European Commission's 2021 Standard Contractual Clauses and supplementary safeguards where required.
9. Security
We use administrative and technical measures intended to protect information, including TLS in transit, private networking between the application and database, access controls, encrypted Shopify access and refresh tokens, limited OAuth permissions, tenant-scoped database access, webhook authentication, and sanitized operational logging.
No method of transmission or storage is completely secure. Merchants should contact security@extelynx.com promptly if they suspect unauthorized access or a security issue.
10. Retention and deletion
Our intended retention schedule is:
- active material cases: retained while operationally active;
- closed or cancelled cases and their activity history: up to 12 months;
- Shopify authentication sessions: until they expire, the App is uninstalled, or the shop is redacted, as applicable;
- operational, idempotency, and product-analytics records: up to 90 days;
- minimized exception reports: up to 90 days;
- privacy-request exports: up to 30 days.
Managed database backups and point-in-time recovery are not currently configured for COM Inbound's Railway PostgreSQL service. The App does not intentionally retain deleted live data in a separately configured backup copy.
Merchants can correct or delete individual receipts with confirmation and can delete eligible cases earlier through the App where that action is available or by contacting us. Receipt correction/deletion changes the current receipt data but retains a minimal activity event until the case is deleted. Shopify order-deletion and customer-redaction requests remove associated App records, including case-linked idempotency records. A customer data request omits previously redacted orders and produces an empty export when no non-redacted requested order remains. After uninstall, Shopify sends a shop redaction request; we target deletion of the shop's remaining App data from live systems within seven days of receiving that request, subject to data we must retain by law.
Deletion required for privacy compliance takes precedence over the App's normal append-only activity history.
11. Privacy requests
Merchants can download available customer-data request JSON exports from the App's Settings while signed in to their Shopify store. Copies downloaded to a merchant's device are under the merchant's control; expiry or deletion of an export in the App does not remove those downloaded copies.
Merchants may request access, correction, deletion, or other rights available under applicable law by contacting support@extelynx.com. Customers of a merchant should normally contact the merchant first because we cannot independently verify their relationship to an order.
We process Shopify's mandatory customer data request, customer redaction, and shop redaction webhooks. We may ask for information reasonably necessary to verify and complete a direct request. We aim to respond within the period required by applicable law.
12. Children's data
The App is a business tool for Shopify merchants and is not directed to children. Merchants should not enter children's personal data into the App.
13. Changes to this policy
We may update this policy when the App, our service providers, or legal requirements change. We will update the effective date and provide additional notice where required by law.
14. Contact
Questions or privacy requests can be sent to support@extelynx.com or mailed to:
Extelynx
Support information is available at https://extelynx.com/extensions/com-inbound/support/.
The legal notice sits within each page's content width and can be dismissed. Dismissal is remembered in browser local storage for the current notice version on this app origin, across stores opened in the same browser. It stores only a UI preference, with no staff identity, timestamp, or acceptance record, and is not sent to the server. Clearing site storage or a new notice version makes it appear again. If browser storage is blocked, dismissal lasts for the current app visit. Terms, DPA, and Privacy links remain available in Settings.
Credential maintenance may temporarily use current and previous encryption keys or authentication-verification secrets to preserve service during rotation. This does not add collected customer data or extend its retention. Rotation diagnostics contain aggregate counts rather than credentials or store identifiers.