Legal / Privacy Policy

Privacy Policy.

Effective July 1, 2026

AutoDataWorx (“the App”) is operated by AutoDataWorx LLC (“we”, “us”). The App provides automotive catalog synchronization and order routing services to Shopify merchants. This policy describes what information the App collects, how it is used, and the choices available to merchants and their customers.

Who this policy covers

The App is installed by Shopify merchants. For information about a merchant’s store, we act as a data controller. For personal information about a merchant’s customers (such as order shipping details), we act as a service provider / data processor on the merchant’s behalf: we process that information only to provide the App’s services to the merchant.

Information we collect

Store and account information. When a merchant installs the App we receive the store’s Shopify domain, store name, and an API access token that lets the App operate on the store. Merchants may also provide a store contact phone number and record acceptance of our terms; we store both.

Distributor credentials. Merchants connect distributor accounts (for example Turn 14 Distributions or ASAP Network) by entering API credentials. These are stored encrypted (AWS Systems Manager Parameter Store, SecureString) and are used only to communicate with that distributor on the merchant’s behalf.

Product and catalog data. We receive product, pricing, inventory, and vehicle fitment data from the distributors the merchant connects, and we create and update products in the merchant’s store. This is commercial data, not personal information.

Order information. To route and fulfill orders, we receive order details from Shopify when an order is placed, including the items ordered and the recipient’s name and shipping address. We do not request access to customer email addresses or phone numbers, and Shopify does not provide them to the App; where a distributor requires a contact phone number for a shipment, we use the merchant’s store phone number, not the customer’s.

Operational records. The App keeps an internal audit log of application events (such as sync runs, order routing decisions, and webhook receipts) identified by store domain. This log exists for reliability, support, and compliance reporting.

What we do not collect

• Customer email addresses and phone numbers (not requested from Shopify)
• Payment or credit card information (payments are handled entirely by Shopify)
• We place no advertising or analytics trackers in your storefront or in the App

How we use information

• To synchronize catalog, pricing, and inventory between distributors and the store
• To route orders to distributors, submit them for fulfillment, retrieve tracking, and reconcile shipments
• To operate, secure, troubleshoot, and improve the App
• To communicate with merchants about the service

We do not sell personal information, and we do not use it for advertising.

Sharing

We share information only as needed to run the service:

• Distributors the merchant connects (for example Turn 14 Distributions): recipient name and shipping address for orders the merchant routes to them.
• Shopify: the App operates on the merchant’s store through Shopify’s APIs and is billed through Shopify.
• Infrastructure providers: the App runs on Amazon Web Services in the United States (us-west-2). Data is encrypted in transit and at rest.

We may also disclose information if required by law.

Retention and deletion

Order and fulfillment records are kept while the App is installed, as an audit trail of what was ordered and shipped. When a merchant uninstalls the App, Shopify sends a store-redaction request approximately 48 hours later, and we permanently delete the store’s data, including its order records, sessions, and credentials. Merchants can also request deletion at any time by contacting us.

When we receive a customer redaction request (forwarded by Shopify on a customer’s behalf), we remove that customer’s personal information — including their name and shipping and billing address — from the order records we have stored, keeping only the non-personal order and audit information needed for our records. We process customer data and redaction requests upon receipt, and in any case within 30 days.

Security

• All traffic is encrypted in transit (HTTPS/TLS); stored data is encrypted at rest
• Distributor credentials are stored in an encrypted secrets store, never in code
• Access to production systems uses short-lived, role-based credentials; we do not use long-lived static access keys
• Order records are append-only within the application to preserve audit integrity

Your rights

Merchants and their customers may have rights under applicable law (such as GDPR or CCPA/CPRA) to access, correct, or delete personal information. Customers should direct requests to the merchant they purchased from; merchants can contact us at the address below and we will assist, including honoring Shopify’s standard data-request and redaction webhooks.

Changes

We may update this policy as the App evolves. Material changes will be reflected by a new effective date on this page.

Contact