Backbeam by VendkitTerms of Service
Privacy Policy
Updated 9 October 2026
This Privacy Policy explains how Vendkit (“we”, “us”) handles data when a Shopify merchant uses Backbeam (the “App”), an app that shows a “notify me when available” button on out-of-stock products, collects shoppers who want to be told when an item returns, and messages them the moment it is back in stock.
1. Who we are and our role
The App is operated by Vendkit. When a merchant installs Backbeam, the merchant is the data controller for the shopper contact details collected through the App, and Vendkit acts as a data processor: we process that data only to provide the App's back-in-stock features to that merchant, on their instructions. Our processing terms are set out in the Data Processing Addendum in our Terms of Service (section 11).
2. Consent, unsubscribe and anti-spam laws
Our legal basis for processing shopper contact data is consent: shoppers opt in explicitly with a consent box on the storefront, we store the time they consented, and they can withdraw at any time.
- EU and UK (GDPR, UK GDPR, PECR): alerts are sent only after the shopper's explicit opt-in. We honour access, correction and erasure requests.
- USA (CAN-SPAM, CCPA/CPRA): every email carries a working unsubscribe link and the merchant's postal address (taken from the store's Shopify address). California shoppers may request access to or deletion of their data, and their data is never sold.
- Canada (CASL): messages are sent only with the shopper's express consent and identify the sender and how to unsubscribe.
Every email includes a one-click unsubscribe link. An unsubscribe is honoured immediately: the contact is added to an unsubscribe list that blocks all future messages from that store.
3. Data we access in your store
Backbeam asks Shopify only for the permissions it needs:
| Shopify data | Permission | Why we need it |
|---|---|---|
| Products | read_products | Show product titles, photos and prices in the alert, and know which products and variants a shopper asked about. |
| Inventory | read_inventory | Know when a variant is out of stock and when it is restocked, which triggers the alerts. |
| New orders (through the order-created notification) | read_orders | Only to credit “recovered revenue”: when a new order contains a product we alerted a shopper about in the last 30 days, we match the order's email to that sign-up and record the order ID and the value of the matching items. We do not store the order's addresses, payment details or other items, and we do not read past orders. |
4. Data we store
| What | Details | Kept for |
|---|---|---|
| Shopper sign-ups | The shopper's email address (and a phone number only if SMS alerts are switched on and the shopper provides one), the product and variant they asked about, the time they consented, their language and the alert's status (waiting, sent, unsubscribed). | While the shopper waits for the product, and until you uninstall. Once the alert is sent, or the shopper unsubscribes or the address bounces, we keep the sign-up for 12 months and then delete it automatically. We also delete it on a shopper's or merchant's request. |
| Unsubscribe list | The contact, the reason (unsubscribe, bounce or complaint) and the date, so we never message them again. | Until you uninstall, so the opt-out keeps being honoured. |
| Alert records | Which sign-up was alerted, when, the status and any delivery error. No message text and no contact details. | Deleted with the related sign-up. |
| Restock events | The variant, the stock level and the time a restock was detected. No personal data. | Until you uninstall. |
| Click and revenue records | Whether and when a shopper first clicked the alert, and for matching orders the order ID and item value. | Revenue records are deleted automatically 12 months after the order. Click records are deleted with the related sign-up. |
| Store settings | Button text and colours, consent wording, sending name, channels, plan and setup progress. | Until you uninstall. |
| Session details | Your staff name and email, and the access token Shopify gives the App to act on your store. | Until you uninstall. |
We do not record anything else about a shopper's browsing.
5. Why we process it (legal basis)
| Purpose | Legal basis |
|---|---|
| Sending the back-in-stock alert a shopper asked for | Consent (explicit opt-in) |
| Keeping an unsubscribe list | Legal obligation and legitimate interest in honouring opt-outs |
| Showing the merchant clicks and recovered revenue | Performance of our contract with the merchant |
| Keeping the App secure and fixing errors | Our legitimate interest in running a reliable service |
| Billing your plan through Shopify | Performance of contract |
6. Who we share data with
We never sell or rent data, and we never share it for anyone's advertising. We use these providers (sub-processors) to run the App:
| Provider | What they do | Location |
|---|---|---|
| Shopify | The platform the App runs on; source of product, inventory and order data; billing. If you use Shopify Flow, each alert sent is also reported to your own Flow workflows (product, variant and the shopper's email); this stays inside your Shopify account. | Canada / global |
| Railway | Hosts the App's servers. | United States (East) |
| Supabase | Database, encrypted at rest. | Canada (Montréal) |
| Resend | Delivers the back-in-stock emails. | United States |
| Twilio | Delivers SMS alerts. Used only if the merchant switches SMS on (Pro plan). | United States |
| Sentry | Error monitoring. Personal data is removed from error reports before they are sent. | United States |
7. International data transfers
Data may be processed in Canada and the United States. Where data from the European Economic Area, the United Kingdom or Switzerland is transferred, we rely on the safeguards offered by our providers, such as the European Commission's Standard Contractual Clauses and Canada's adequacy decision.
8. Retention and deletion
- Sign-ups that have been alerted, unsubscribed or bounced are deleted automatically 12 months later, together with their alert and click records. Sign-ups still waiting for stock are kept until the alert is sent. The unsubscribe list is kept so an opt-out keeps being honoured.
- Recovered-revenue records are deleted automatically 12 months after the order.
- When you uninstall, we remove your session details straight away. Shopify then asks us, about 48 hours later, to delete your store's data, and we permanently delete everything we hold for your store, including every shopper sign-up and the unsubscribe list.
- We respond to all of Shopify's mandatory privacy requests (customer data request, customer redact and shop redact). On a customer redact request we delete that customer's sign-ups, alert and click records and unsubscribe-list entry for the store concerned.
- A shopper or merchant can also ask us to delete a sign-up at any time at [email protected].
9. Cookies
Backbeam sets no advertising or tracking cookies. The storefront button loads in the background and only sends data when a shopper submits the sign-up form.
10. Your rights
Depending on where you live, laws such as the GDPR, UK GDPR and CCPA/CPRA give you rights to access, correct, delete, restrict or port your personal data, and to object to processing. A shopper can unsubscribe from any email, or send a request to the store they signed up with (the merchant, who is the controller); the merchant can forward it to us, or the shopper can contact us directly. Merchants can exercise their rights by contacting us or by uninstalling the App. You may also complain to your local data-protection authority.
11. Security
All data is sent over HTTPS and stored in encrypted databases. Every request from Shopify, and every sign-up from your storefront, is verified with its signature before we act on it; sign-ups are rate-limited and screened for bots, and records are only read or changed for the store that owns them. Access to production systems is limited to the App's operator, and we keep daily database backups.
12. Children
The App is a business tool and is not directed at children. We do not knowingly process children's data.
13. Changes to this policy
We may update this policy as the App changes. The “Updated” date at the top shows when it last changed; for significant changes we will notify merchants in the App.
14. Contact us
Vendkit — [email protected]. We reply within one business day.
Questions about this policy: [email protected].