Vendor Tally privacy policy

Last updated: 17 October 2026

Vendor Tally ("the app") is a Shopify app made by Elektraset, s.r.o. ("we", "us"). It allocates the order lines of a multi-vendor Shopify store to the store's vendors, keeps a commission ledger, and prepares vendor statements and payout batches. This policy explains which data the app processes when a merchant installs it, and why.

Who is responsible

Elektraset, s.r.o. processes store data on behalf of the merchant who installed the app (as a processor). For merchant account data, we are the controller. Contact: help@elektraset.com. Website: elektraset.com.

Data the app processes

From the merchant's Shopify store (Shopify Admin API and webhooks, scopes read_orders, read_products and write_products):

the store's domain, currency, and whether it is a development store
order ids, order names (for example "#1042"), order dates, payment and fulfillment status, and whether an order is a test order
for each order line: product and variant ids, title, SKU, quantity, amounts (price, discounts, tax, shipping share), fulfilled and refunded quantities and amounts
product ids, titles, the product "vendor" field, and the app's own metafields on products and variants (the vendor assignment)
the store's app subscription (plan, price, status) from the Shopify Billing API

The app does not store customer names, email addresses, phone numbers, addresses or payment details. It does not request these fields from Shopify.

From the merchant about its vendors: vendor names, an optional email address, commission and payout terms, an optional bank reference text chosen by the merchant (the app asks not to enter full account numbers), and an optional Stripe connected account ID.

From the merchant's Stripe account (optional): a Stripe secret or restricted key, stored encrypted (AES-256-GCM). The app uses it only to read the balance and to create the transfers that the merchant starts.

From vendors in the vendor portal: product submissions (title, price, SKU, description). The portal uses no cookies and no tracking.

Why we process the data

To allocate order lines to vendors, calculate commissions, refunds, tax and shipping, and show balances, statements and payout batches to the merchant and, through the portal, to each vendor. Legal basis: performance of the contract with the merchant.
To write vendor assignments to the store's product metafields and to create draft products that the merchant approves.
To send Stripe Connect transfers when the merchant starts them.
To charge for paid plans through Shopify's Billing API.
To count anonymous, aggregated usage figures per store (for example how many stores settled a first payout). Development stores and test orders are excluded. These figures contain no personal data.

Sharing

We do not sell data. We share data only with:

Shopify, the platform the app runs on.
Stripe, only when the merchant connects Stripe and sends a payout: amount, currency, the vendor's connected account ID, a description and the batch number.
Our hosting provider, which runs the app's servers for Elektraset.

Retention

Ledger, orders lines and payouts: kept while the app is installed, because they are the merchant's payout records. The merchant can export them as CSV at any time.
All data of a store: deleted when Shopify sends the shop/redact request, 48 hours after the app is uninstalled. Only an anonymous record without the store's name stays for the aggregated usage figures.
Sessions: deleted on uninstall.

Your rights

Merchants, vendors and shoppers can ask for access, correction or deletion by email. We answer Shopify's customers/data_request, customers/redact and shop/redact webhooks. Because the app stores no customer personal data, a customer data request or redaction finds no personal data to export or delete; the app records that the request arrived. Under the GDPR you can also complain to a supervisory authority. In the Czech Republic, this is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů).

Security

All traffic uses HTTPS.
Stripe keys are encrypted at rest; vendor portal links are stored only as hashes and can be revoked.
Requests from Shopify are verified with HMAC signatures; the vendor portal works only through Shopify's signed app proxy.

Changes

We will post changes on this page and update the date at the top.

Contact: help@elektraset.com · https://vendor-tally.apps.elektraset.com/privacy