Privacy Policy

BlumacawTech (“we”, “us”) makes BMT B2B Wholesale Pricing, a Shopify app for wholesale pricing, registration forms, bulk ordering, order documents and related B2B features, and operates this website (blumacawtech.com). You can reach us at admin@blumacawtech.com.

This policy covers both the app and this website. If you shop at a store that uses our app, the store (the merchant) is the controller of your personal data; we process it on their behalf and on Shopify’s instructions. For merchants’ own account data and for visitors to this website, we are the controller.

When a merchant installs the app, we process, per the permissions granted through Shopify:

• Store data — shop domain, store details and contact email, theme information, products, collections and settings, used to run the features the merchant configures.
• Customer data — customer records Shopify sends us (such as name, email, tags and default address), used for customer-specific pricing, customer groups and approval workflows.
• Registration form submissions — the details a wholesale applicant enters on a merchant’s registration form (typically name, email, phone, company, address, tax or VAT numbers) and any documents they upload, such as business licences. Passwords collected by registration forms are encrypted at rest.
• Order data — orders and draft orders, used to generate invoices, packing slips and receipts, to run payment terms, order limits and related features, and to show the merchant usage analytics for their own store. When a merchant enables the tax number field, the number a buyer enters in the cart is saved on their order and printed on their invoice.
• Support conversations — messages sent through the in-app support chat or by email.

The app sends transactional emails that merchants configure — for example registration confirmations, approval notices, payment term notices and order documents. Recipients and content are determined by the merchant. Delivery goes through our built-in sender (delivered via Google’s Gmail service), or, where the merchant connects one, through their own email provider such as Klaviyo or their own SMTP/email API account — in which case that provider processes the recipient addresses and message content under the merchant’s agreement with them.

Merchants can optionally connect the app to their own Google Drive so that invoice documents are saved to a folder in their Drive. If a merchant connects Google Drive:

• We request the drive.file scope, which only allows access to files and folders this app creates — we cannot see, read or change anything else in the connected Drive — plus the account’s email address, which is shown in the app’s settings to label the connection.
• We use this access solely to create a “BlueMacaw Invoices” folder and upload the merchant’s own invoice documents to it. Documents are stored in the merchant’s Drive, not retained by us.
• The Google credential (refresh token) is stored encrypted and is never shared. Google user data is not used for advertising, is not sold, and is not read by humans except with the merchant’s explicit permission for support, or where required for security or by law.
• Merchants can disconnect at any time in the app’s settings — which revokes and deletes the stored credential — or from their Google account permissions. Uninstalling the app deletes the stored credential as well.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

The app runs on Google Cloud Platform in the United States and India. We use the following service providers (subprocessors):

• Shopify — the platform the app runs on; all app data originates from or is delivered through Shopify’s APIs.
• Google Cloud Platform — application hosting (Cloud Run), file storage for documents uploaded through registration forms (Cloud Storage), and webhook message processing (Pub/Sub).
• Managed MongoDB database hosting — the app’s database.
• Google (Gmail) — delivery of emails sent by the built-in sender.
• tawk.to — the support chat available to merchants inside the app’s admin pages.
• Klaviyo — only where a merchant connects their own Klaviyo account for email delivery.
• Google Drive — only where a merchant connects their own Google Drive for document sync, as described above.

• Uninstalling the app triggers an automated deletion of the data we store for that store, including uploaded files and stored credentials.
• Shopify data erasure requests — we honour Shopify’s customer and shop redaction webhooks automatically, deleting the relevant personal data when Shopify instructs us to.
• Operational logs are retained for a short, fixed period for security and troubleshooting, then deleted.

Data is encrypted in transit (TLS). Credentials merchants trust us with — such as API keys and connected-account tokens — and passwords collected by registration forms are encrypted at rest. Access to production systems is limited to the people who operate the app.

Depending on where you live (for example under the GDPR or CCPA), you may have rights to access, correct, delete or export your personal data, and to object to or restrict its processing.

If you are a customer of a store that uses our app, please contact that store first — they control your data, and we act on their instructions. We support merchants in fulfilling these requests. If you are a merchant, or cannot reach the store, contact us at admin@blumacawtech.com and we will respond promptly.

blumacawtech.com uses Google Analytics to understand aggregate site usage. We do not sell personal data, and we do not use it for third-party advertising. Forms on this site (such as the affiliate application) collect only what they ask for, used to respond to your request.

When this policy changes materially we will update it here and revise the effective date above. Questions and requests: admin@blumacawtech.com.