Privacy Policy

Who we are

Amipi Diamonds is a Shopify app published by Amipi Inc. that lets Shopify merchants browse and resell live diamond inventory sourced from the Amipi wholesale catalog. This policy explains what data the app collects, how it's used, and how to request its removal.

What data we collect

From your Shopify store (with permission you grant on install):

• Shop domain (e.g. your-store.myshopify.com)
• An access token to call the Shopify Admin API on your behalf
• Product and inventory data you create through the app (diamond products it lazily creates when a customer adds one to cart)
• Order data for diamonds purchased through the app

From your activity in the app:

• The Amipi Retailer ID you connect on the Settings page
• Search filters and pagination state (kept in the URL, not stored)

From customers on the storefront:

• Shopify-supplied identifiers in cart and order requests (the app does not directly collect customer PII; standard Shopify checkout handles that under Shopify's own privacy policy).

How we store it

Session tokens and the retailer connection record are stored in a managed PostgreSQL database (Neon, EU/US region). The data is accessed only by the app's server to authenticate API calls to Shopify and Amipi. We do not sell, share, or rent any of this data.

Where the data goes

• Shopify Admin API — to create diamond products, set prices, manage inventory, and read orders.
• Amipi API (api.amipi.com) — to fetch diamond inventory, prices (with your retailer markup), and verify retailer access.
• No third-party analytics, advertising, or tracking pixels.

Data retention & deletion

When you uninstall the app from your Shopify store, Shopify sends us shop/redact and customers/redact webhooks. On receipt, we delete the shop's session token and retailer connection. You may also request immediate deletion by emailing support@amipi.com with your shop domain.

Diamond products and orders created in your Shopify store remain in your Shopify account — they are governed by Shopify's data retention, not ours. We do not retain copies of order data after uninstall.

Customer data requests (GDPR)

If a customer of your store submits a data access or deletion request via Shopify, Shopify forwards a customers/data_request or customers/redact webhook to us. Because the Amipi Diamonds app does not persistently store customer PII, our response confirms that no additional customer data is held outside what Shopify already shows.

Cookies

The embedded admin UI relies on Shopify's session cookies (set by Shopify, not by us) to authenticate the merchant inside the iframe. The storefront search page does not set cookies of its own.

Security

All connections use HTTPS. App Proxy requests from Shopify are verified against the signed HMAC parameter on every request. Admin GraphQL calls are made with the shop's access token, scoped to the permissions you granted at install (read/write products, inventory, orders, publications).

Changes to this policy

We may update this policy as the app evolves. Material changes will be communicated via the app's admin UI or by email to the registered Amipi retailer.

Contact

Questions or requests: support@amipi.com
Amipi Inc., address line as appropriate.