Privacy Policy

Last updated: 1 November 2026

1. Who we are

TupleCraft AS (org. no. 937 851 588), Oslo, Norway ("TupleCraft", "we", "us") builds and runs apps for Shopify merchants, including Lagra (together, the "Apps"). This policy explains what data the Apps handle, why, where it is kept and for how long.

Questions: support@tuplecraft.com.

2. Our role

• Your store's data. For data the Apps read from your Shopify store, and data you enter in the Apps, you (the merchant) decide why it is processed and we process it for you to provide the App. Under the GDPR you are the controller and we are your processor. Our Terms of Service include the data processing terms.
• Data about you as our customer. For your shop's details, your plan and messages you send us, we are the controller.

3. What Lagra reads and stores

From your store, through Shopify's API and the permissions you approve when installing:

• Products and variants: product ID, title, vendor, created date, variant title, SKU, barcode, and whether inventory is tracked.
• Inventory: available and incoming quantities per location, and location names.
• Orders: each order's date, status and line items (which variant, how many). Lagra turns these into units sold per variant per day and keeps only those daily totals. It does not read or store customer names, email addresses, phone numbers or addresses, and it does not keep individual orders.

Changes to your store: when you confirm a delivery, Lagra increases the available quantity of the items received in Shopify, by the quantities you confirm. It changes inventory at no other time.

What you enter in Lagra: suppliers (name, optional email address, lead time, notes), product settings (supplier, lead time, minimum order quantity, case pack, manually entered incoming stock), purchase orders, deliveries received, and settings. A supplier's email address can identify a person; only enter one you are allowed to use.

About your shop: shop domain, Shopify's shop and app IDs, install and uninstall dates, your current plan and trial end date (read from Shopify), and a log of installs, uninstalls and plan changes.

Access token: Shopify gives the App an access token for your store. We store it so the App can work when you are not using it, for example to refresh sales overnight.

Your staff: we do not store the names or email addresses of your staff. Shopify confirms who is signed in on each request, and we do not keep that.

4. Technical logs and error reports

• Hosting logs. Our hosting provider keeps logs of requests to the App (time, page path and technical messages) for up to 7 days, for security and debugging.
• Error reports. When the App fails, a report of the error, where in the code it happened and the page path goes to our error-tracking provider. Reports may include your shop's domain. We have turned off sending request headers, cookies, query strings, request bodies and user details, so reports do not carry your customers' data or your session. Reports are kept for up to 90 days.

5. Why we use it

• To provide the App you installed (performance of our contract with you; for your store's data, on your instructions as your processor).
• To check your plan, which Shopify bills (performance of our contract with you).
• To keep the App secure and fix errors (our legitimate interest in a working, secure service).
• To keep accounting records (legal obligation).

We do not use the data for advertising, we do not sell it, and we share it only with the providers in section 6. We make no automated decisions about people: Lagra's forecasts are about products.

6. Who processes data for us

Shopify runs the platform the Apps are part of and bills you for plans. We never see your payment details.

We will list a new provider here at least 30 days before it starts processing your data.

7. Transfers outside the EEA

Lagra's database is stored in the EU. Where data is handled outside the EEA, for example by Cloudflare's network, the transfer relies on an adequacy decision such as the EU-US Data Privacy Framework, or on the EU Standard Contractual Clauses.

8. How long we keep it

• While the App is installed: for as long as the App needs it.
• When you uninstall: the access token is deleted at once. Shopify asks us to erase your store's data 48 hours later, and we then delete all of it, unless you have reinstalled the App by then.
• Backups: deleted data stays in the database's point-in-time history for up to 30 days, then it is gone.
• Logs and error reports: up to 7 days and up to 90 days.
• Emails to support: as long as needed to help you. Accounting records are kept as long as Norwegian law requires.

9. Security

• Data is encrypted in transit (TLS) and at rest (AES-256).
• Each store's data is kept apart: every database query is limited to one store.
• Only TupleCraft staff who need access have it, and their accounts use two-factor authentication.

10. Your rights

Merchants can ask us to access, correct, delete, export or restrict their data, or object to how we use it. Email support@tuplecraft.com. Uninstalling the App deletes your store's data as described in section 8.

Your customers. Lagra holds no personal data about your customers. Shopify forwards your customers' data requests to us; we answer them, and there is nothing to send or delete. Customers with questions about their data should contact the store they bought from.

You can complain to Datatilsynet, the Norwegian Data Protection Authority (datatilsynet.no), or to the authority where you live.

11. Your responsibilities

You are responsible for having a lawful basis for the data you share with the Apps, and for a privacy policy on your store that tells your customers you use third-party apps.

12. Changes

We will post changes here and update the date above. We will tell you about significant changes in the App at least 30 days before they apply.

13. Contact

TupleCraft AS (org. no. 937 851 588)
Oslo, Norway
support@tuplecraft.com