Merchant and staff data includes the canonical Shopify shop domain, Shopify session identifiers, granted scopes, access and refresh tokens, session expiry, billing plan and trial state, and Shopify’s associated-user session details when supplied. Those staff details can include an identifier, name, email, locale, and account-owner, collaborator, or email-verification status.

B2B business and customer data can include company names and external identifiers; company status, tier, tax-exemption flag, assigned representative, discount, payment terms, and order limits; Shopify customer identifiers, B2B tags, contact roles, and buyer email addresses; company-location names, postal addresses, and phone numbers; price-list names, descriptions, schedules, product, variant, and collection identifiers, prices, quantities, and currency; and wholesale-application company names, business emails, phone numbers, notes, and review status.

Corporate-account and ordering records can include buyer limits and approval settings, requested cart items, order notes, amounts and currency, approval decisions, staff and buyer identifiers, sales-representative email and stated purpose, and resulting draft order identifiers. When an order is prepared, the app reads Shopify product, variant, collection, inventory, shop-currency, and payment-terms information needed to validate pricing and create the draft order. The signed storefront proxy receives the shop and logged-in customer identifiers plus requested catalog items.

The app stores its operational records — such as sessions, companies, contacts, locations, price lists, applications, subscriptions, approvals, and checkout configuration — in its managed cloud database. It uses a managed message queue to coordinate customer sync and to deliver privacy-export requests, and a durable coordination store to track in-progress customer-sync work.

Shopify stores the merchant’s commerce records and the B2B metafields, metaobjects, automatic-discount configuration, validation configuration, draft orders, and invoices created or updated by the app. A completed customer data request is also delivered as a JSON value in an app-owned metafield on the affected Shopify Customer record.

read_products supports SKU lookup and authoritative product, variant, collection, price, inventory, and catalog-rule metafield reads for pricing, quotes, quick orders, and draft orders. write_products supports defining, writing, and clearing app-owned catalog-rule metafields on products, variants, and collections. read_customers supports the customer tax-exemption and ownership-metafield snapshot used during reconciliation. write_customers supports customer metafield definitions and projections, privacy-export metafields, and native tax-exemption updates.

write_companies supports defining, writing, and clearing Company-owned B2B metafields when the shop and plan permit that projection. read_metaobjects and write_metaobjects support reading, creating, updating, and deleting price-list and catalog-rule metaobjects. write_metaobject_definitions supports creating the two metaobject schemas those projections use.

read_draft_orders supports the invoice list and PDF detail reads and the quote-conversion retry lookup. write_draft_orders supports creating draft orders and sending draft-order invoices. read_orders supports the dashboard count of orders tagged B2B.

read_discounts and write_discounts support checking, creating, and updating the automatic app discount that runs B2B checkout pricing. read_validations and write_validations support checking and creating the Shopify Function validation that enforces order limits.

read_payment_terms supports selecting Shopify payment-term templates, and write_payment_terms supports applying the selected template to a draft order. write_app_proxy supports the configured signed storefront pricing, quote, and wholesale-registration proxy under /apps/b2b-toolkit.

The app runs on Cloudflare’s cloud platform. Application and Shopify session records are stored in its managed cloud database, customer-sync coordination state in a durable coordination store, and customer-sync and privacy-export retry messages in a managed message queue. Queue messages are retried up to 3 times by the configured consumer before an exhausted delivery can be moved aside. Tenant access is scoped by a verified Shopify admin session, webhook, signed app-proxy request, OAuth session, or signed internal context. Shopify remains the source of truth for customer, catalog, order, draft-order, and billing records.

The app does not define a general time-based retention schedule. Records remain until they are changed by the merchant or removed by the implemented uninstall or privacy flows. On app/uninstalled, the handler deletes the shop’s sessions, current subscription, companies, contacts, locations, price lists, applications, approvals, checkout state, development override, cleanup tasks, sync events, and privacy export jobs, while preserving paid-trial history and the webhook replay ledger until a later shop/redact request.

The current uninstall and privacy handlers do not directly clear the durable coordination store or purge already-enqueued queue messages. The customer-redaction handler deletes the customer’s app records and the customer-data-export metafield but does not directly clear the other B2B metafields previously projected to that Shopify Customer. The shop-redaction handler also does not issue Shopify mutations to delete the app’s other metafield or metaobject projections. These are current implementation limits, not claims that those copies have been erased by the handlers. Any app-owned projections that remain on Shopify stay managed through the normal Shopify privacy flow so that merchants and their customers retain a single, consistent channel for deletion.

Shopify provides merchant and staff authentication, the commerce platform, Admin APIs, webhooks, app proxy, metafields, metaobjects, Shopify Functions, draft orders, invoice delivery, and subscription billing.

Cloudflare provides Workers hosting, D1 database storage, Durable Objects, and Queues. Sentry processes error diagnostics, PostHog processes product-analytics events, and Datadog processes configured browser and performance-monitoring data. Operational events can include shop, app, release, request, browser, and error context. Browser observability is initialized when the page URL supplies a non-empty shop parameter.

The app verifies and handles Shopify’s three mandatory privacy webhook topics. For customers/data_request, it collects that customer’s contact, wholesale-application, corporate-approval, corporate-buyer, and sales-representative-session records, together with related synchronization, privacy outbox, and customer-metafield-cleanup metadata, and writes a JSON export to an app-owned metafield on the Shopify Customer. If synchronous delivery fails, it stores a request-keyed outbox job and retries through the Cloudflare Queue and a scheduled recovery drain. The handler does not email the export.

For customers/redact, the app deletes matching contacts, applications, corporate buyers, approvals requested by that customer, sales-representative sessions for that buyer, sync events, privacy-export jobs, and any customer-specific cleanup task already finished or permanently failed. Retained quote requests have their buyer customer ID replaced with a non-customer redaction marker and their buyer-authored note cleared. A still-pending cleanup task is retained until it completes, since it is self-contained Shopify-side sync work that does not reference the deleted customer row, but it is marked at redaction time so its own customer-identifying record is purged the moment that outstanding work finishes or gives up, rather than being kept indefinitely. Approval decisions this customer’s account made as embedded staff on another buyer’s request are staff-attributed, not customer-identifying, and are left unchanged. Enterprise service requests record contact email, company name, requirements text, and submitting staff attribution; these intake records are retained for the lifetime of the installation without per-customer redaction, and are deleted in full by shop/redact. The handler then deletes the app-owned Shopify customer-data-export metafield when an Admin API session is available; local deletion still proceeds when that session no longer exists.

For shop/redact, the app deletes every shop-owned record: sessions; companies with their contacts and locations; price lists, rules, and assignments; pending applications; subscription, paid-trial, onboarding, developer-override, and checkout state; corporate buyers, approvals, and sales-representative sessions; synchronization events, native-tax proof, cleanup tasks and locks, and privacy-export jobs; import/export jobs and market-login settings; quote requests and VAT rules; merchant API keys, outbound-webhook configuration and deliveries, ERP connectors, and enterprise service requests. The webhook-delivery row for the active request is retained only until its processing lease is marked complete, after which the shop’s replay ledger is deleted.

Shopify can deliver shop/redact up to 48 hours after an uninstall, so a merchant who reinstalls inside that window is not erased: the app first confirms no live session remains before deleting anything, and where the evidence is inconclusive it lets Shopify retry the request rather than guessing in either direction. A shop that is genuinely uninstalled is still erased, including after its stored session has already been revoked by Shopify.

A customer seeking access, correction, or deletion should contact the Shopify merchant to whom they submitted an application or from whom they placed an order so the merchant can initiate the appropriate Shopify privacy process. Merchants can contact Pcnaid Inc. for help with a request.