FirmUp
Legal

Privacy policy

FirmUp (“FirmUp: Supplier Confirmations”) is a Shopify app that watches a store's stock, emails the store's suppliers to confirm restocks when the merchant approves it, reads the suppliers' replies, and creates purchase orders. This policy explains what FirmUp collects when a merchant installs it, how it is used, and the merchant's choices.

Effective November 10, 2026

In short

  • FirmUp stores no customer personal information.
  • Nothing is emailed to a supplier without the merchant clicking Send.
  • All of a store's data is deleted after it uninstalls FirmUp.

What FirmUp collects

From the merchant's Shopify store

  • Store details: store name, store email, myshopify domain, timezone and currency.
  • Products and variants mapped to suppliers: product and variant names, SKUs and Shopify IDs.
  • Inventory levels and the store's location addresses.
  • Existing purchase orders: supplier names, items, quantities and prices, used to pre-fill suppliers and count stock already on order.
  • Orders from the last 60 days, read only to total units sold per variant. FirmUp stores those totals, not the orders. It does not store customer names, emails, addresses or any other customer personal information.

Entered by the merchant

  • Suppliers: names, email addresses, lead times, minimum orders, case packs and prices.
  • Settings: brand name, the email address copied on supplier emails, safety buffer, cover period and digest time.

Emails

  • Emails FirmUp sends for the merchant (availability checks, reminders and purchase orders), and suppliers' replies to them, including attachments. Replies may contain the supplier contact's name, email address and signature.
  • The structured result of reading each reply (quantity, price, dates and the quoted evidence), and the purchase order PDFs FirmUp generates.

How FirmUp uses it

Only to provide the app: working out which products are running low, drafting and sending supplier emails the merchant approves, reading replies, creating purchase orders, sending the merchant a daily digest and enforcing the plan's limits. FirmUp does not sell data, does not use it for advertising and does not send anything to a supplier without the merchant clicking Send.

Services that process data for FirmUp

  • Shopify: store data, sign-in and billing.
  • Resend: sends and receives the supplier emails.
  • Anthropic (Claude API): reads supplier replies and their attachments to extract quantities, prices and dates. Under Anthropic's commercial terms, this content is not used to train its models.
  • Fly.io (app hosting) and Supabase (database), in the United States.

Retention and deletion

Data is kept while FirmUp is installed. When a merchant uninstalls the app, FirmUp stops accessing the store immediately, and deletes all of the store's data when Shopify sends its shop deletion request (48 hours after uninstall). Because FirmUp stores no customer personal information, customer data and deletion requests from Shopify have nothing to return or remove.

Security

All connections use HTTPS. Access to Shopify uses Shopify's session tokens and the minimum read-only permissions FirmUp needs. Incoming email webhooks are signature-verified.

The merchant's choices

Merchants can edit or delete suppliers and settings in the app at any time, and uninstall FirmUp to have their data deleted. Merchants and suppliers can ask for a copy of their data, or for it to be corrected or deleted, by contacting support@getfirmup.com.

Changes

If this policy changes, the new version will be posted here with a new effective date.

Contact

Questions about privacy: support@getfirmup.com.