Privacy policy

Last updated 15 October 2026

Maddy: B2B Company ("the app") is a Shopify app made by MaddySpace ("we"). It adds B2B company accounts to Shopify stores: company users and roles, checkout rules, order approvals, quotes, budgets, purchase rules and related emails. This policy explains what personal data the app processes, why, and for how long.

Who is responsible

The merchant who installs the app decides how it's used and is the controller of their customers' data. We process that data on the merchant's behalf, only to provide the app (see our terms and data processing). Questions about a store's own privacy practices go to that store. Questions about the app: sprajapat770@gmail.com.

What we collect

When a merchant installs the app, Shopify gives it access to the store. The app stores:

Store and staff: the store's domain, settings and plan; for staff who open the app, the session Shopify creates (name, email, locale) so they stay signed in.
Company users (the store's B2B customers): name, email and Shopify customer and contact IDs of company contacts, with the team and role the store or the company's administrator gives them.
Orders waiting for approval: the requester's name and email, the company and location, the amount, who approved or rejected it and any reason given.
Quotes: the requester's name and email, products, prices and the messages between the buyer and the store.
Company registration applications: the details entered in the store's registration form (company, contact name, email, and the address and phone it passes on to Shopify).
Requisition lists: the products a buyer saves, with their name, and their email when they ask for reorder reminders.
Activity log: who did what in the app (name or customer ID, the action, the time).
Sent emails log: the recipient's address, subject and whether it was sent, so the store can check delivery; and unsubscribe choices for summary and reminder emails.
Sales reps: names and emails of store staff the merchant adds as reps.
The store's email account: the sending account the merchant connects (server, username and password, the password encrypted).

Budgets, purchase rules, approval workflows, teams and roles contain amounts, product SKUs and names of roles and teams, not personal data. The app doesn't read customers' phone numbers or addresses back from Shopify, doesn't store payment details, and doesn't use cookies or tracking on the store.

Why we use it

To provide the app's features: enforce checkout rules, route orders for approval, run quotes, registrations and requisition lists, and show company users in the store's customer accounts.
To send the emails the store has turned on (approvals, quotes, registrations, reminders, summaries) from the store's own email account.
To keep the app secure and working, and to answer the merchant's support requests.

We don't sell personal data, share it for advertising, use it for marketing or profiling, or make automated decisions with legal effects. Limits applied at checkout are the rules the merchant or the company's administrator set.

Who we share it with

Shopify, which runs the store; the app reads and writes data through Shopify's APIs.
Oracle Cloud Infrastructure, which hosts the app's server and database.
The store's email provider, which the merchant chooses and connects; emails go through it.
Authorities, only when the law requires it.

How long we keep it

Activity log entries: 12 months.
Sent emails log: 90 days.
Decided approval requests and registration applications: 2 years.
Everything else: while the app is installed. When a store uninstalls the app, all its data is deleted 48 hours later (Shopify's shop data erasure request).
Backups: kept 14 days, then overwritten.

Security

Data travels over HTTPS and is stored on encrypted disks. The database isn't reachable from the internet, only the app's server can use it, and access to the server is limited to our staff with personal keys. If a breach affects a store's data, we tell the merchant without undue delay and within 72 hours of finding it.

Your rights

Customers of a store can ask that store to access, correct or delete their data. When they do, Shopify sends us the request and the app answers it: a data request sends the merchant what the app stores about that customer, and an erasure request deletes or anonymizes it. Merchants can ask us directly at sprajapat770@gmail.com.

Where the data is

The app's server and database are in an Oracle Cloud data center. Data may be processed outside the country of the store or its customers; we protect it the same way wherever it's processed.

Changes

If we change this policy, we update the date at the top. If a change affects how a store's data is used, we tell merchants in the app before it takes effect.