Legal
Privacy Policy
Last updated: Jul 25, 2026
Privacy Policy
Effective date: July 25, 2026
This Privacy Policy explains how Emersoft handles personal information through https://emersoft.co, the Emersoft Books Shopify application, related documentation, support and business communications.
1. Who We Are
The relevant Emersoft entity depends on the service, contract, invoice or interaction involved:
EMERSOFT LLC, EIN 92-1707678, 9620 Las Vegas Blvd S, Ste E4 #612, Las Vegas, Nevada 89123, United States.
EMERSOFT LTD, company number 10977747, 21 Navigation Business Village, Navigation Way, Preston, Lancashire, England, PR2 2YP, United Kingdom.
For merchant account, billing, website, support, security and business-contact information, the applicable Emersoft entity generally acts as a controller or business. For end-customer order and fulfilment information processed through Emersoft Books on a merchant’s instructions, Emersoft generally acts as a processor or service provider to that merchant.
Privacy enquiries and requests: [email protected], with “Privacy Request” in the subject line, or https://emersoft.co/contact. We do not claim to have appointed a statutory Data Protection Officer unless separately notified.
2. Scope and Merchant Responsibilities
This Policy covers Emersoft’s own processing. Shopify merchants are independently responsible for their customer-facing privacy notices, lawful bases, consent mechanisms and responses to customer requests. If you are a customer of a merchant, you should normally contact that merchant first because the merchant controls how your order data is used.
Shopify, suppliers, payment providers and other independent third parties process information under their own privacy notices.
3. Personal Information We Collect
Merchant and business contact information
We may collect names, business names, roles, postal addresses, email addresses, telephone numbers, Shopify store identifiers, account settings, supplier account references, support communications and subscription or billing status.
End-customer and order information
When a merchant enables fulfilment, the App may receive customer name, shipping address, email address, telephone number when provided, Shopify customer or order identifiers, ordered titles, quantities, fulfilment status, tracking details and related order information. The App does not request Shopify customer-resource scopes solely to build customer profiles; protected customer fields are obtained through authorised order and fulfilment resources as required for fulfilment.
Technical, device and usage information
We may collect IP address, approximate geolocation derived from IP, browser and operating-system information, device identifiers, timestamps, logs, authentication events, integration status, API events, error details, performance metrics and security signals.
Payment information
Subscription charges are generally processed by Shopify or another payment provider. We may receive billing status, plan, transaction identifiers and payment-failure information, but we do not collect or store full payment-card numbers through Emersoft Books.
Information we do not intend to collect
The App is not designed to collect special-category data under UK/EU data-protection law, government identifiers, full card data or information about children. Merchants should not submit such information unless expressly supported and lawfully authorised.
4. Sources of Information
We obtain information directly from merchants and website visitors, from Shopify APIs and webhooks, from authorised suppliers and fulfilment partners, from service providers, and automatically from devices and systems used to access the Services.
5. Why We Use Information and Our Lawful Bases
Providing and administering the Services
We use information to install and operate the App, authenticate stores, import and synchronise products, transmit fulfilment orders, return status and tracking information, manage subscriptions, provide support and communicate service notices. For controller processing, the usual lawful basis is performance of a contract or steps requested before a contract.
Security, fraud prevention and service reliability
We use logs, device information and account activity to prevent abuse, investigate incidents, protect systems, enforce terms and maintain availability. The usual lawful basis is our legitimate interest in providing a secure and reliable business service, and legal obligation where applicable.
Service improvement and analytics
We may analyse operational and usage information to diagnose errors, measure performance and improve features. We do not use identifiable merchant-customer order information for advertising, profiling or unrelated product training. Where possible, improvement analytics are aggregated or de-identified.
Business communications and marketing
We may respond to enquiries and send service communications. We may send business-to-business marketing where permitted by law and based on consent or legitimate interests, as applicable. Recipients can unsubscribe at any time.
Legal and corporate purposes
We may use information to comply with law, respond to lawful requests, maintain records, establish or defend legal claims, complete audits, and manage a merger, financing, acquisition or sale. The lawful basis is legal obligation or legitimate interests, as applicable.
Cookies and similar technologies
Strictly necessary technologies are used to operate and secure the website. Non-essential analytics, functionality or advertising technologies are used only with consent where required. See the Cookie Policy and consent manager.
We do not make decisions based solely on automated processing that produce legal or similarly significant effects on individuals.
6. Processing on Behalf of Shopify Merchants
For merchant-customer personal data, the merchant is the controller and Emersoft is the processor or service provider. We process that data only on documented merchant instructions, including configuration of the App, order submission, fulfilment choices and written support requests, unless law requires otherwise.
Our Data Processing Agreement governs this processing and addresses confidentiality, security, subprocessors, data-subject requests, incident assistance, deletion or return, audits and international transfers. Merchant-customer data is not sold, used for cross-context behavioural advertising, or used for Emersoft’s unrelated marketing.
7. Shopify Permissions and Privacy Webhooks
The App requests only permissions reasonably needed for its functions, including product, inventory, fulfilment-order, location, publication and order permissions. The exact permissions are shown during installation and may change when features change, subject to Shopify’s approval process.
The App implements Shopify’s mandatory privacy webhooks, including customers/data_request, customers/redact and shop/redact, and also uses app/uninstalled. A verified customer data request is recorded and handled with the merchant. Customer-redaction requests delete App-stored data associated with the relevant order identifiers. Shop-redact triggers final deletion of remaining shop-scoped data after Shopify’s required delay.
8. How Information Flows Through Emersoft Books
A merchant installs the App and grants the Shopify permissions shown during installation.
The merchant imports or synchronises catalogue, product, inventory or publication information through supported suppliers and Shopify.
When fulfilment is enabled, Shopify makes authorised order and delivery fields available to the App.
The App transmits the minimum required order and delivery information to the merchant-selected supplier, such as Ingram CDF Lite or Gardners home delivery.
The supplier may return acceptance, hold, rejection, fulfilment, shipment or tracking information, which the App synchronises with Shopify.
Google, Meta, TikTok or similar platforms are not used to market to merchant customers using order data. They may be used for separate website analytics or advertising only as described in the Cookie Policy and consent manager.
9. Disclosures and Service Providers
We disclose information only as reasonably necessary for the purposes described above, including to:
Shopify, for app installation, authentication, billing, APIs, webhooks and store functionality;
merchant-selected suppliers and fulfilment partners, including Ingram and Gardners, to process orders and return fulfilment information;
Pubnet and other catalogue or purchasing integrations selected by the merchant;
Hetzner Online GmbH for application hosting and compute in Ashburn, Virginia;
DigitalOcean LLC for managed database hosting in New York, New York;
Amazon Web Services, Inc. for encrypted off-site backups in the US East region;
Cloudflare for content delivery, network security and web application firewall services;
Grafana Cloud for application logging, monitoring and alerts;
Google Analytics, HubSpot and similar website tools where enabled and consented to;
professional advisers, auditors, insurers, regulators, courts and law-enforcement bodies where necessary; and
a buyer or successor in connection with a corporate transaction, subject to appropriate safeguards.
Service providers may act as processors, subprocessors or independent controllers depending on the service and law. We require appropriate confidentiality, security and data-processing terms where applicable.
10. International Data Transfers
The production application is hosted in Ashburn, Virginia, and the managed database is hosted in New York, United States. Encrypted off-site backups are stored in the AWS US East region. Personal information may therefore be transferred to and processed in the United States and other countries where approved providers operate.
Where UK or EEA transfer rules apply, restricted transfers are covered by an applicable adequacy mechanism or appropriate safeguards, such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or EU Standard Contractual Clauses, together with supplementary measures and transfer-risk assessment where required. A copy or summary of relevant safeguards may be requested through our privacy contact.
11. Retention and Deletion
We retain information only for as long as necessary for the purposes described, the merchant’s documented instructions, security, dispute resolution and legal obligations. Specific periods include:
On app/uninstalled, the App marks the shop uninstalled, stops relevant jobs, and deletes operational shop data such as active sessions, configuration, fulfilment services, fulfilment orders, certain provider rows, caches and non-App-imported mappings.
The shop record, billing history and App-imported product mappings may remain temporarily to support billing and reinstall reconciliation until Shopify sends shop/redact, normally about 48 hours after uninstall.
On shop/redact, remaining shop-scoped data is permanently deleted, including the shop record, related billing cascade, sessions, provider files, compliance-request records and queued or cached shop data, subject to legally required retention and protected backup cycles.
On customers/redact, App-stored personal data associated with the order identifiers supplied by Shopify is deleted.
Twice-daily encrypted database backups are retained for approximately three weeks. Managed point-in-time recovery is available for up to seven days. Deleted information in backups is placed beyond ordinary use and removed through the normal backup cycle.
Account, billing, tax and legal records are retained for the period required by applicable law or reasonably needed to resolve claims. Support and security records are retained according to operational need and risk.
Because some retention operations are currently handled manually, verified deletion and rights requests are routed to authorised personnel and documented. We are working to automate additional retention controls as the service matures.
12. Security
We use risk-appropriate technical and organisational measures, including TLS/SSL in transit, LUKS database encryption at rest, IP allow-listing for database access, Cloudflare routing and web application firewall, restricted production access, separated production and non-production environments, encrypted off-site backups, uptime monitoring, logging and deployment alerts.
Production data is not intentionally copied into non-production environments. Access to the Kubernetes cluster and database is limited to authorised operational personnel and controlled deployment processes. No system is completely secure, and merchants must also protect their Shopify and supplier accounts.
13. Your Rights
Depending on your location and our role, you may have rights to access, correct, delete, restrict or object to processing, receive portable data, withdraw consent, and complain to a regulator. Rights may be limited by law, our processor role, the merchant’s instructions or legitimate retention requirements.
Where we act as a processor for a merchant, we will normally refer the request to the merchant and assist the merchant. We may request information reasonably necessary to verify identity and authority.
UK and EEA rights
UK and EEA residents may exercise the rights described above. We aim to respond without undue delay and normally within one month, subject to lawful extensions for complex or numerous requests. You may complain to the Information Commissioner’s Office in the UK at https://ico.org.uk or to the supervisory authority where you live, work or believe an infringement occurred.
California and other US state privacy rights
Where applicable law applies to Emersoft, residents may request access, correction, deletion, portability and information about categories, sources, purposes and disclosures. They may also opt out of sale, targeted advertising or sharing, and limit certain uses of sensitive personal information where the relevant law provides those rights.
Emersoft does not sell personal information for money and does not sell or share merchant-customer order data for cross-context behavioural advertising. If website advertising technologies constitute “sharing” or targeted advertising under applicable law, visitors may use the cookie settings or a recognised opt-out preference signal where supported. We will not unlawfully discriminate against a person for exercising privacy rights. Where a state law provides an appeal right, you may appeal a refusal by replying to our decision or contacting [email protected]. We will provide appeal instructions and information about contacting the relevant state attorney general where required.
Canadian rights
Where PIPEDA applies, individuals may request access to and correction of personal information and may withdraw consent subject to legal and contractual limits. Access is provided at no or minimal cost, and requests are generally addressed within 30 days, subject to permitted extensions.
Australian rights
Where the Australian Privacy Act applies, individuals may request access or correction and complain about our handling of personal information. We take reasonable steps in relation to overseas recipients as required by the Australian Privacy Principles.
14. Cookies and Similar Technologies
Our website uses cookies and similar technologies as explained in the Cookie Policy. In regions requiring consent, non-essential technologies are not activated until valid consent is provided. You can reject or withdraw consent through the consent manager.
15. Children
The Services are business services and are not directed to children. We do not knowingly collect personal information directly from children. Order-recipient information may incidentally relate to a minor when supplied by a merchant, but it is processed only for fulfilment on the merchant’s instructions and should be limited to what is necessary.
16. Data Protection Complaints
You may raise a data-protection complaint through [email protected] or our contact page. For complaints subject to UK requirements, we will provide a clear route to complain, acknowledge the complaint within 30 days, investigate without undue delay, keep the complainant appropriately informed, and communicate the outcome. You may still complain to the ICO or another competent regulator.
17. Changes to This Policy
We may update this Policy when our services, providers, data practices or legal obligations change. The effective date will be updated, and material changes will be communicated through the website, email, the App or another appropriate method.
Privacy requests and questions may be sent to [email protected] or submitted through https://emersoft.co/contact.