GateForge Privacy Policy

Last updated: July 16, 2026

GateForge is a Shopify app that lets a store accept wholesale account applications and approve them into Shopify B2B accounts. This page describes exactly what data the app handles. The store you apply to (the merchant) is the data controller; GateForge processes data on the merchant’s behalf.

What we collect, and why

When you submit a wholesale application, we store what you type into the form: company name, your name, business email, business address, and optionally a phone number, website, tax ID, and message. This is used for exactly one purpose: so the merchant can review your application and, if approved, create your wholesale (B2B) account in Shopify with that name, email, phone, and address.

We collect nothing else. No analytics or advertising trackers run on the application form, we do not enrich your data from other sources, and we never sell or share it with third parties beyond the hosting listed below.

How long we keep it

• Pending applications are kept until the merchant decides on them.
• Decided applications (approved or rejected) are deleted automatically after 90 days. After approval, your account lives in Shopify itself, not in this app.
• If a store uninstalls GateForge, all of that store’s data in the app (applications, settings, and sessions) is erased within 48 hours.

Your rights

To see or delete the data a store holds about you, contact that store directly - data requests made to the merchant flow to us through Shopify’s privacy webhooks, which we implement: a deletion request removes your application records outright, and a data request surfaces everything we hold (which is only your application) to the merchant.

Where it lives and how it is protected

• Data is stored on Fly.io infrastructure (currently Toronto, Canada) on an encrypted volume; backups are encrypted block-level snapshots of that volume.
• All traffic is HTTPS. Shopify API calls are TLS.
• Application logs contain no personal data - events are logged as counts and identifiers only.
• Access is limited to the app’s operator; there is no staff access to speak of, and credentials are stored as platform secrets, not in code.

Sub-processors

Fly.io (hosting, Canada region) and Shopify (the platform the B2B account is created in). No others.

Contact

Questions about this policy or the app’s data practices: navkhan103@gmail.com. If we make material changes to this policy, the date above changes with it.