Privacy Policy

Last Updated: June 1, 2026

1. Commitment to Privacy

NXREVO Labs Pte. Ltd. ("RevoStock", "we", "us") is committed to protecting the privacy of our Merchants and Users in compliance with the Singapore Personal Data Protection Act (PDPA) 2012 and the privacy requirements of the Shopify App Store.

2. Data Protection Officer (DPO)

In accordance with our Accountability Obligation, we have appointed a DPO to oversee data compliance.

3. Information We Collect

We collect only the minimum amount of information required to provide our inventory planning and demand forecasting services.

3.1 Merchant Information (Information You Provide)

  • Identity & Profile Data: Name, email address, job title, and company preferences.
  • Business & Billing Data: Company name, registered business address, country, and tax/VAT info. Payments are processed via Shopify; we do not store full card numbers.
  • Support & Communication: Messages from contact forms, support tickets, and survey responses.

3.2 Store Operational Data (Information from Integrations)

We sync data from your Shopify store, acting as a Data Processor (Data Intermediary) under the PDPA:

  • Catalog & Inventory: SKU identifiers, stock levels, and movement metadata.
  • Order History (including historical orders): SKU-level line items (product/variant identifiers, quantities, unit prices, discounts, taxes, and order timestamps) together with coarse geographic fields (city, province/state, and country) of each order. We read your full order history — not just the most recent orders — for the forecasting reasons explained in Section 3.2.1 below.
  • Supplier Data: Business names, business addresses, and countries of your third-party suppliers.

3.2.1 Why We Read Your Full Order History (read_all_orders)

RevoStock requests the Shopify read_all_orders scope so that we can read your complete historical order data, beyond the default 60-day window that Shopify otherwise exposes to apps. This is a core, functional requirement of the demand-forecasting service — not an optional or marketing use:

  • Multi-year seasonality: Reliable demand forecasting requires at least 12–24 months of sales history so our models can learn seasonal peaks, holiday cycles, and year-over-year trends. A 60-day window cannot capture these patterns.
  • Rolling demand & ABC classification: We compute 12-month rolling demand, reorder points, and ABC/velocity classification for each SKU, all of which depend on long-range historical order quantities.
  • SKU-level aggregation only: We use order history strictly to derive aggregated, SKU-level demand signals. We do not read, store, or retain end-consumer personal data from your orders (no names, emails, phone numbers, or street addresses) — see Section 3.3.

3.3 End-Consumer Data (Explicit Exclusion)

RevoStock does not collect, store, or process any personally identifiable information (PII) of your end-consumers. We do not pull names, phone numbers, email addresses, or physical addresses of your store's customers. This exclusion applies even though we read your full order history: from each order we extract only SKU-level line items and coarse geographic fields (city, province/state, and country) used for regional demand analysis, and we retain only the resulting aggregated demand signals.

3.4 Technical & Usage Data

We automatically collect device & usage data: IP address, browser type, operating system, pages viewed, timestamps, and session logs.

3.5 Controller vs. Processor Roles

  • RevoStock as Controller: We are the data controller for the personal data of our website visitors and direct account users (e.g., login credentials).
  • RevoStock as Processor (Data Intermediary): For the store operational data synced from Shopify, the Merchant is the data controller, and RevoStock acts as a Data Intermediary, processing data strictly according to your instructions.

4. Cookies & Similar Technologies

We use cookies and similar technologies (such as web beacons and pixels) to keep you signed in, remember your preferences, secure the Services, and measure platform usage.

  • Types of Cookies: We use essential cookies (required for login), functional cookies (to remember settings), and analytical cookies (to understand performance).
  • Management: You can manage or block cookies through your browser settings and, where offered, via our cookie banner. Please note that blocking essential cookies may affect the functionality of the Service.

5. Social Logins & Integrations

If you register or sign in to our platform using a third-party account (e.g., Google or Shopify), or connect a third-party integration, that provider may share certain information with us under their respective policies.

  • Data Use: We use such shared data only as necessary to authenticate your identity or provide the Services you have requested.
  • Third-Party Terms: Your use of third-party services is governed by their specific terms and privacy policies; RevoStock is not responsible for the privacy practices of these external providers.

6. Legal Basis for Processing

We collect and process data about you only where we have a legal basis for doing so under the PDPA or other applicable laws. The legal bases for processing include:

  • Contractual Necessity: To perform the contract you enter with us (e.g., when you request inventory forecasting).
  • Legitimate Interest: To improve our services, market and promote our products, and protect our legal rights.
  • Consent: When you give us specific permission (e.g., to email you product updates).
  • Legal Obligation: To comply with a legal requirement.

You can withdraw consent at any time; however, this will not affect any processing that has already occurred.

7. How We Use Your Data

We process personal data for the following lawful purposes:

  • Providing and Operating the Platform: User authentication, core inventory features, and support (Contractual Necessity).
  • Demand Forecasting: We analyze your historical order quantities (read via the read_all_orders scope) to compute multi-year seasonal trend analysis, 12-month rolling demand forecasts, reorder points, and ABC classification at the SKU level (Contractual Necessity).
  • Communication: Sending service, security, and administrative messages; product updates and feature announcements (Legitimate Interest).
  • Improving the Service: Platform troubleshooting, usage analytics, and product research (Legitimate Interest).
  • Protection & Compliance: Security monitoring, fraud prevention, and complying with legal obligations.

We do not use your data to run targeted advertising or remarketing.

8. Sharing of Personal Data

We share personal data only with the following categories of recipients:

  • Service Providers (Processors): We use Google Cloud Platform and Amazon Web Services for cloud hosting and databases; Cloudflare for network security and acceleration; Google Analytics for website usage metrics; and Postmark for email delivery. These providers are bound by strict confidentiality and security obligations.
  • Business Transfers: In connection with a merger, acquisition, or asset sale.
  • Legal & Safety: To comply with law, enforce our terms, or protect rights and safety.

We do not sell personal data to third parties.

9. Security and Protection

We implement robust security arrangements in accordance with the PDPA Protection Obligation, including:

  • Encryption: 256-bit SSL encryption in transit and encryption at rest.
  • Access Control: Data access is restricted to authorized personnel using the principle of least privilege.
  • Monitoring: Regular security assessments and vulnerability monitoring.

10. Data Retention and Deletion

Data is retained only as long as necessary for the purpose it was collected or to comply with legal requirements.

  • Account Termination: Personal data is deleted or anonymized within 24 months of account inactivity.
  • Trial Expiration: Store operational data is deleted 30 days after a trial ends if the User does not convert to a paid plan.
  • Shopify Compliance Webhooks: We comply with all three Shopify-mandated compliance webhooks — customers/data_request (acknowledged within 30 days; we hold no end-consumer PII to disclose), customers/redact (acknowledged within 30 days; no end-consumer PII held), and shop/redact (shop operational data purged within 48 hours of receipt).

11. International Data Transfers

While we intend to process and store your personal data primarily within Singapore, our partners, affiliates, and third-party service providers (including Google Cloud, Amazon Web Services, and Cloudflare) maintain facilities and infrastructure in various jurisdictions globally.

By providing your information to us, you acknowledge and expressly consent to the transfer of your personal data to these overseas facilities for the purposes of processing and storage. We take all reasonable steps to ensure that any international transfer of personal data complies with the PDPA Transfer Limitation Obligation. This includes implementing Standard Contractual Clauses (SCCs) or other legally recognized safeguards that require the overseas recipient to provide a standard of protection comparable to that under Singapore's Personal Data Protection Act.

12. Your Rights

In accordance with the Singapore PDPA, you have specific rights regarding the personal data we hold about you.

12.1 Rights under PDPA

  • Access: You may request a copy of the personal data we hold about you and information on how it has been used or disclosed in the 12 months preceding your request.
  • Correction: You have the right to rectify any inaccurate or incomplete personal data we maintain.
  • Withdrawal of Consent: You may withdraw consent for the collection, use, or disclosure of your data at any time. We will inform you of the likely consequences of such withdrawal, which may include our inability to provide the Service.
  • Erasure (Deletion): You may request that we delete your personal data when it is no longer necessary for the purposes for which it was collected or when there is no other legal or business justification for its retention.
  • Data Portability: You have the right to request the transfer of your personal data to another organization in a commonly used machine-readable format (subject to final PDPC regulations).

12.2 Procedure for Exercising Rights

To exercise any of these rights, please contact our Data Protection Officer at [email protected]. To protect your privacy and security, we will take reasonable steps to verify your identity (e.g., requiring authentication through your Shopify Admin or email verification) before fulfilling the request.

We aim to respond to all valid requests within 30 days. If we require more time, we will notify you in writing of the extension and the reasons for it. We reserve the right to charge a reasonable administrative fee for processing access requests.

13. Data Breach Notification

In the event of a notifiable data breach (likely to result in significant harm or involving 500+ individuals), we will notify the PDPC within 3 calendar days and inform affected individuals as soon as practicable.