Partfit by VendkitTerms of Service
Privacy Policy
Updated 27 September 2026
This Privacy Policy explains how Vendkit (“we”, “us”) handles data when a Shopify merchant uses Partfit (the “App”), a Year / Make / Model parts finder that shows shoppers the parts that fit their vehicle.
1. Who we are and our role
The App is operated by Vendkit. When a merchant installs Partfit, the merchant is the data controller and Vendkit acts as a data processor: we process data only to provide the App's features to that merchant, on their instructions. Our processing terms are set out in the Data Processing Addendum in our Terms of Service.
2. Data we access in your store
Partfit asks Shopify only for the permission it needs:
| Shopify data | Permission | Why we need it |
|---|---|---|
| Products | read_products | Show your products so you can add the vehicles they fit, and match the SKUs or handles in a fitment spreadsheet to your products. |
Partfit does not ask for access to orders or customers.
3. Data we store
| What | Details | Kept for |
|---|---|---|
| Fitment | For each product you add: its id, handle, title, image link and SKU, and the makes, models, years and trims it fits. | Until you remove it or uninstall. |
| Search counts | Per day: which vehicle was searched (year, make, model), how many times, and how many searches found no parts. No shopper, device or IP address is recorded. | 24 months, then deleted. |
| Store settings | Picker options, plan and setup-guide progress. | Until you uninstall. |
| Session details | The access token Shopify gives the App to act on your store. | Until you uninstall. |
4. Shoppers' vehicles
When a shopper picks a vehicle, it is saved in their own browser's local storage so the picker and product pages remember it (and, if the store turns on “My garage”, up to four recent vehicles). This never leaves their device except as part of the search they ask for. Shoppers can clear it at any time by clearing their browser's site data.
5. Why we process it (legal basis)
| Purpose | Legal basis |
|---|---|
| Showing shoppers the parts that fit their vehicle | Performance of our contract with the merchant |
| Search counts and insights shown to the merchant | Performance of contract; the data is anonymous |
| Keeping the App secure and fixing errors | Our legitimate interest in running a reliable service |
| Billing your plan through Shopify | Performance of contract |
6. Who we share data with
We never sell or rent data. We use these providers (sub-processors) to run the App:
| Provider | What they do | Location |
|---|---|---|
| Shopify | The platform the App runs on; source of product data; billing. | Canada / global |
| Railway | Hosts the App's servers. | United States (East) |
| Supabase | Database, encrypted at rest. | Canada (Montréal) |
| Sentry | Error monitoring. Personal data is removed from error reports before they are sent. | United States |
Make and model suggestions come from the US National Highway Traffic Safety Administration's public vehicle list (vPIC). We send it only a make and a year — never any store or shopper data.
7. International data transfers
Data may be processed in Canada and the United States. Where data from the European Economic Area, the United Kingdom or Switzerland is transferred, we rely on the safeguards offered by our providers, such as the European Commission's Standard Contractual Clauses and Canada's adequacy decision.
8. Retention and deletion
- Search counts are deleted after 24 months.
- When you uninstall, Shopify asks us about 48 hours later to delete your store's data. We then permanently delete everything we hold for your store.
- We respond to all of Shopify's mandatory privacy requests (customer data request, customer redact, shop redact). Because Partfit holds no customer data, customer requests have nothing to return or delete.
9. Cookies
Partfit sets no cookies and uses no tracking or analytics on your storefront. It uses the shopper's browser storage only to remember their vehicle, as described above.
10. Your rights
Depending on where you live, laws such as the GDPR and CCPA give you rights to access, correct, delete, restrict or port your personal data, and to object to processing. Merchants can exercise these rights by contacting us or by uninstalling the App. You may also complain to your local data-protection authority.
11. Security
All data is sent over HTTPS and stored in encrypted databases. Every request from Shopify is verified with its signature before we act on it, storefront requests are rate-limited, and access to production systems is limited to the App's operator. We keep daily database backups.
12. Children
The App is a business tool for Shopify merchants and is not directed at children. We do not knowingly process children's data.
13. Changes to this policy
We may update this policy as the App changes. The “Updated” date at the top shows when it last changed; for significant changes we will notify merchants in the App.
14. Contact us
Vendkit — [email protected]. We reply within one business day.
Questions about this policy: [email protected].