B2B Company Controls – Privacy Policy

Effective Date: January 1, 2026

BlueBolt, Inc. (“BlueBolt,” “we,” “our,” or “us”) provides the B2B Company Controls Shopify application (the “App”). This Privacy Policy explains how information is accessed and handled when merchants install and use the App within Shopify.

This policy applies only to the B2B Company Controls app.

1. Information the App Accesses

When installed, the App may access data made available by Shopify through approved API permissions, including:

• Customer data (such as name, email address, phone number, physical address, and related order information)
• Company and company location data
• User accounts, roles, and permissions
• Orders and draft orders
• Products, collections, and inventory
• Store and account information for the store owner

Access to this data is required for the App to enable company-level self-service management, access controls, and workflows within Shopify’s B2B framework  .

2. How Information Is Used

Data accessed via Shopify is used solely to:

• Allow company administrators to manage users, roles, and locations
• Apply role-based and location-based access controls
• Support merchant-approved onboarding and governance workflows
• Perform actions explicitly initiated by merchants or their customers

BlueBolt does not use this data for advertising, profiling, analytics unrelated to app functionality, or resale.

3. Data Storage and Retention

BlueBolt does not store or persist merchant or customer personal data outside of Shopify.

• Shopify remains the system of record
• Any temporary caching performed by the App is ephemeral and exists only to support real-time operations
• No long-term databases of customer or merchant personal data are maintained by BlueBolt

When the App is uninstalled, access to Shopify data is immediately revoked.

4. Data Sharing

BlueBolt does not sell, rent, or share merchant or customer data with third parties.

Data is accessed exclusively via Shopify APIs and used only as required to provide the App’s functionality.

5. Third-Party Services

The App is hosted on Netlify. Netlify is used for infrastructure and operational logging only.

• Logs are used to maintain application reliability and performance
• BlueBolt does not intentionally log or store personal customer or merchant information

6. Security

BlueBolt follows industry best practices to protect data access, including:

• Shopify OAuth authentication
• Scoped API permissions approved by the merchant
• Encrypted data transmission (HTTPS)
• Least-privilege access controls

7. Merchant and Customer Rights

Merchants retain full control of their data within Shopify.

• Access, correction, and deletion of customer or store data are managed directly through Shopify
• BlueBolt does not independently retain personal data or manage data subject requests

8. Changes to This Policy

This Privacy Policy may be updated periodically. Updates will be posted at this location with a revised effective date.

9. Contact Information

BlueBolt, Inc., Chicago, IL

Email: privacy@blueboltsolutions.com

Website: https://www.blueboltsolutions.com