Last updated: July 15, 2026
B2Bargain is a wholesale/B2B app for Shopify stores, operated by TecZila ("we", "us"). This policy explains what personal data we process on behalf of the merchants who install our app, why, and how we protect it. We act as a data processor for the merchant (the data controller); merchants remain responsible for their own privacy obligations to their customers.
| Data | Why |
|---|---|
| Store & staff data (shop domain, OAuth access tokens, app configuration, staff email in audit logs) | Authenticate the app and operate its features. |
| Wholesale applicant details (business name, contact name, email, tax ID) submitted through the app's registration form | Let merchants review and approve wholesale/B2B accounts. |
| Buyer saved lists (keyed by a Shopify customer ID) and quote requests (contact, email, items) | Provide reorder lists and quote-request workflows. |
| Order and draft-order records (via the Shopify Admin API, Protected Customer Data Level 1 — not customer name, email, phone, or address) | Create B2B draft orders, export orders for accounting, and track net-terms credit balances. |
We share data only with the infrastructure providers needed to run the service:
| Provider | Purpose |
|---|---|
| Shopify | App platform and Admin API (data source) |
| Hetzner Online GmbH (EU) | Application and database hosting |
| Resend | Transactional email (approval and quote notifications) |
| Anthropic | AI features (rule building, quick-order parsing, help) — processes merchant inputs, not customer PII |
We keep personal data only as long as needed. We delete it (a) on a customer's redaction request via
Shopify's customers/redact flow, (b) when the app is uninstalled via shop/redact,
and (c) on scheduled retention windows for operational records (e.g., audit logs 365 days, config backups
180 days, resolved quotes 365 days, declined applications 180 days).
Data is encrypted in transit (TLS/HTTPS) and sensitive credentials (Shopify OAuth tokens) are encrypted at rest with AES-256-GCM at the application layer. We follow data minimization, restrict access to production systems, and log administrative access.
Buyers should direct access or deletion requests to the merchant whose store they purchased from; merchants can fulfil them through Shopify's customer data request and redaction tools, which we honour automatically. Merchants may contact us to export or delete their store's data at any time.
We process personal data in line with the data-protection laws applicable to the merchants we serve and their customers — including, where applicable, the EU General Data Protection Regulation (GDPR), the UK GDPR, and the California Consumer Privacy Act (CCPA/CPRA) — together with the Shopify API License and Terms of Use that govern all Shopify apps. Except where mandatory local law provides otherwise, this policy is governed by the laws generally applicable to software-as-a-service providers in the jurisdiction in which TecZila is established. Nothing here overrides any rights you have under laws that apply to you.
We may update this policy; material changes will be reflected by the "last updated" date above. Questions: privacy@b2bargain.com.