Automatic stock sync by location for every variant in your Shopify catalogue.
Effective date: 10 August 2026 Last updated: 10 August 2026
Zarbo Stock by Store (the "App") is developed and operated by JUMPINGBOX, LDA ("Zarbo", "we", "us"), a company registered in Portugal, with registered office at Rua do Espido 164C, Sala 102, 4470-177 Maia, Portugal, registered under company number (NIPC) 515424552, VAT number PT515424552. Zarbo is a trading name of JUMPINGBOX, LDA.
This policy explains what personal data we process when a merchant installs and uses the App, why we process it, and what rights people have. It applies to the App only. It does not apply to the merchant's own store or to Shopify.
The App reads inventory levels from a Shopify store and writes the on-hand quantity at each location into a metafield on each product variant, inside that same store. We designed it so that we hold as little data as possible:
Under Shopify's protected customer data framework, the App operates at Level 0: no customer data.
Data protection law distinguishes between the party that decides why data is processed (the controller) and the party that processes it on someone's instructions (the processor).
| Data | Our role |
|---|---|
| Account and contact details of the merchant who installs the App, billing records, support correspondence | Controller — we decide how this data is used |
| Store data accessed through the Shopify APIs on the merchant's instructions | Processor — the merchant is the controller |
Where we act as a processor, the merchant's own privacy policy governs the relationship with their customers, and our processing is limited to what the merchant instructs through their use of the App.
When a merchant installs the App, we receive from Shopify and store:
myshopify.com domain and Shopify shop ID;We use this to provision the merchant's account, authenticate API calls, provide support, and send service messages about the App (for example, a notice that a sync has failed). Legal basis: performance of a contract (Article 6(1)(b) GDPR) and, for service messages, our legitimate interest in operating the App (Article 6(1)(f) GDPR).
We store the configuration the merchant creates in the App: which metafield the App writes to — the one the App creates, or a pre-existing one the merchant selects — together with its namespace, key, and structure. These are schema settings and contain no personal data.
Legal basis: performance of a contract (Article 6(1)(b) GDPR).
To keep the metafield current, the App reads from the Shopify Admin API:
The App writes this information back into the merchant's own store, as a metafield on each product variant. The data does not leave Shopify's platform except in transit through our infrastructure, and we do not retain a copy of it beyond the transient buffering required to complete a write operation.
Inventory data is commercial rather than personal. A location address, however, can be personal data — for a sole trader or a home-based business, the location address may be that person's home. Where a merchant configures the App to include location addresses in the metafield, that is done on the merchant's instructions, and the merchant should consider that the metafield may then be readable on their storefront.
Our servers keep operational logs of API calls and sync jobs, recording timestamps, the store domain, the operation performed, and any error returned. These logs exist to diagnose faults and protect the service against abuse. Legal basis: legitimate interest (Article 6(1)(f) GDPR).
The App adds nothing to the merchant's storefront. Specifically, the App does not:
Because the App writes data into the merchant's store rather than serving it, we have no visibility of whether, how often, or by whom that data is read on the storefront.
The metafield the App writes belongs to the merchant's store and is under the merchant's control. Once written, it is subject to Shopify's own processing and to the merchant's configuration — including whether the merchant exposes it to the Storefront API and displays it publicly.
Merchants choose whether the App writes to the metafield it creates for this purpose, or to a metafield that already exists in the store. Where a merchant selects a pre-existing metafield, the App overwrites whatever that metafield contains, on every variant, and continues to overwrite it on each update. Merchants should select a metafield that no other app or process depends on.
We use the following sub-processors to deliver the App:
| Sub-processor | Purpose | Processing location |
|---|---|---|
| Scaleway SAS (France) | Application hosting, database and storage, and transactional email | France (European Union) |
Scaleway SAS is our only sub-processor.
Shopify Inc. is not a sub-processor: Shopify is both the source and the destination of the store data the App processes, and an independent controller of the merchant's store data.
We will update this list before engaging any new sub-processor. Merchants may ask to be notified of changes by writing to the address in section 11.
All personal data processed through the App is stored and processed in France, on infrastructure operated by Scaleway SAS, a French company. We do not transfer personal data outside the European Economic Area, and we do not use sub-processors established outside the European Union.
If this ever changes, we will update this policy before the change takes effect and rely on an adequacy decision or on the Standard Contractual Clauses approved by the European Commission, together with any supplementary measures required.
| Data | Retention |
|---|---|
| Merchant account data and App configuration | For as long as the App is installed |
| All of the above, after uninstall | Deleted within 48 hours of receiving Shopify's shop/redact webhook, and in any event no later than 30 days after uninstall |
| Technical logs | 3 days, then deleted automatically |
| Billing records | Retained for the period required by Portuguese tax law (currently 10 years) |
Metafields written into the merchant's store are not covered by the retention periods above, because they are the merchant's data held on Shopify's platform, not ours. What happens to them on uninstall depends on which metafield the merchant configured:
As Shopify requires of every public app, we implement and respond to the three mandatory privacy webhooks:
customers/data_request — a request to view stored customer data. Because the App stores no customer data, we confirm receipt and respond that we hold none.customers/redact — a request to delete a customer's data. We confirm receipt; there is no customer data to erase.shop/redact — sent 48 hours after uninstall. On receipt we delete all data associated with that store, as described above.We apply measures appropriate to the risk, including: encryption of all data in transit (TLS) and at rest; encryption of stored Shopify access tokens; encrypted backups; separation of test and production environments; access to production data limited to staff who need it, protected by strong authentication; access logging; and a documented incident response procedure.
If a personal data breach occurs that is likely to result in a risk to individuals, we will notify the competent supervisory authority within 72 hours of becoming aware of it, and affected merchants without undue delay.
Individuals whose personal data we process as controller have the right to request access to that data, to have it corrected or erased, to restrict or object to its processing, and to receive it in a portable format. Where processing rests on consent, that consent can be withdrawn at any time without affecting processing carried out beforehand.
Requests can be sent to the address in section 11. We respond within one month, as required by Article 12(3) GDPR.
Anyone who believes we have handled their data improperly may complain to the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD), at www.cnpd.pt, or to the authority in their country of residence.
Requests from a merchant's own customers should be addressed to the merchant, who is the controller of that data. If such a request reaches us, we will forward it to the merchant.
We do not sell personal data, do not share it for cross-context behavioural advertising, and do not use it for targeted advertising — as those terms are defined under the California Privacy Rights Act and comparable state laws. We have never done so.
The App is a business tool for merchants and is not directed at children. We do not knowingly process the personal data of anyone under 16.
JUMPINGBOX, LDA (trading as Zarbo) Rua do Espido 164C, Sala 102 4470-177 Maia, Portugal NIPC 515424552 · VAT PT515424552
Privacy enquiries and support: [email protected]
We will post any change to this policy on this page and update the "last updated" date. If a change materially affects how we process personal data, we will notify merchants by email at least 10 days before it takes effect.