Privacy Policy

1. Introduction & Scope

OnlineFlyers Inc. ("OnlineFlyers", "we," "our," or "us"), operating the application OnlineFlyers The Merchant Loop accessible via app.onlineflyers.io, is committed to preserving data privacy and operational security for independent retail partners. This policy outlines how merchant and store information is handled when using our synchronization suite.

2. Data Processing Roles

Under international frameworks (including GDPR, CCPA/CPRA, and PIPEDA):

• Data Controller: The merchant acts as the Data Controller regarding their store profile, inventory configurations, and catalog metrics.
• Data Processor: OnlineFlyers Inc. acts as a Data Processor executing automated catalog indexing, synchronization, and routing.
• Data Minimization: We strictly operate on a least-privilege principle. We do not harvest, scrape, or retain end-customer PII (e.g., shopper names, emails, addresses, or payment credentials).

3. Information We Access & Collect

To provide real-time offer discovery, our system requests access to authorized GraphQL and REST scopes:

• Merchant Identifiers: Store name, primary myshopify.com domain, public domain, admin email, country, and shop currency.
• Catalog Data: Active products/variants published to our discovery channel, titles, pricing, inventory status, tags, and image URLs.
• OAuth Tokens: Encrypted API tokens used strictly to maintain operational background synchronization.

4. Mandatory Webhooks & Data Retention

We maintain active compliance handlers for Shopify’s mandatory privacy webhooks:

• customers/redact & customers/data_request: Because no shopper PII is processed, zero entries exist to redact or report.
• shop/redact: Triggered upon application uninstallation; purges linked database records, cached catalog feeds, and access tokens within 48 hours.