SlickJoy Privacy Policy

Effective date: October 23, 2026

1. Who we are

1.1 SlickJoy connects your online stores to your ERP system. Today it connects Shopify, WooCommerce and TikTok Shop stores to Odoo or NetSuite.

1.2 SlickJoy is run by Brapps LLC, 2791 Buckskin Drive, Plain City, UT 84404 US.

1.3 You can contact us at privacy@slickjoy.com.

1.4 For order and customer data from your store, you are the controller. We are your processor. We act on your instructions.

1.5 For your SlickJoy account data, we are the controller.

2. What data we collect

2.1 Account data. We collect your name and email address. We also get your shop name and shop domain from Shopify.

2.2 Store access. Shopify gives us an access token for your store. We store it encrypted.

2.3 Order and customer data. We read orders from your store through the Shopify API. This includes the buyer's name, email, phone number, and billing and shipping address.

2.4 Order details. We also read the order items, fulfillment status, and order changes such as edits, cancellations, and refunds. We keep a copy of the order data we receive.

2.5 Product and stock data. We read your products, variants, and stock levels. If you turn it on, we write product and stock updates back to Shopify.

2.6 Fulfillment data. We pass tracking numbers and fulfillment status between your ERP and Shopify.

2.7 ERP connection data. You give us the address of your ERP and its credentials, such as an API key. We store them encrypted.

2.8 ERP data. Our Reporting feature reads your Odoo data with read-only queries. This can include contact names and emails. We cache the results.

2.9 Sync logs. We log sync events for your orders. We log webhook deliveries with a hash only, not the full content. We keep audit records of data requests and connection changes.

2.10 Billing data. Shopify bills Shopify merchants for SlickJoy. Shopify gives us your plan and billing status. Stores that do not pay through Shopify pay us through Stripe. Stripe collects your card details on its own pages. We never see or store your full card number. We keep the card brand and the last four digits.

2.11 Technical data. We collect basic technical data to run and secure the service, such as sign-in sessions and product usage analytics. We also send you account and service emails.

2.12 We do not collect data from your shoppers on their devices. We do not add code or cookies to your storefront.

2.13 TikTok Shop data. If you connect a TikTok Shop, TikTok gives us an access token for your shop. We store it encrypted. Through the TikTok Shop API we process your orders, the buyer's name and shipping address, products, inventory, fulfillment and tracking, and returns. We process this data only to provide the sync between your TikTok Shop and your ERP. We keep and delete it under the same rules as other order data in section 4.

2.14 Other storefronts. If you connect a WooCommerce store, we process the same kinds of order, product, stock and fulfillment data described above through the WooCommerce API, using API keys you give us. We store the keys encrypted.

3. Why we use your data

3.1 We use order and customer data only to create the order and customer contact in your ERP. We also use it to send tracking back to your store. This applies to every storefront you connect, including TikTok Shop.

3.2 We use account, ERP connection, billing and technical data to run, secure, support and bill the service.

3.3 We use ERP data in Reporting only to answer your reporting questions.

3.4 We do not sell personal data, share it for advertising, or build advertising profiles.

3.5 We do not contact your shoppers. We do not make automated decisions that have legal or similarly significant effects on people.

4. How long we keep data

4.1 We delete orders that are finished (completed, fulfilled, cancelled or already in your ERP) once they are more than 90 days old.

4.2 We keep Reporting cache data until the connection or your organization is deleted.

4.3 We keep audit records for up to 24 months.

4.4 We keep account data while your account is open, and for 30 days after you close it.

4.5 If you uninstall SlickJoy, we delete your sessions and stored secrets and archive your connection. About 48 hours later, Shopify tells us to erase your shop data. We then delete your orders and secrets, archive your connections, and delete pending installs.

4.6 We may keep data longer if the law requires it.

4.7 Data that is already in your own ERP belongs to you. We do not delete it.

5. Who we share data with

5.1 We share data only with the providers below, your own ERP and the AI provider you connect in Reporting, and only to run SlickJoy.

5.2 Supabase hosts our database. Vercel hosts our application.

5.3 Stripe for card payments from stores that do not pay through Shopify. PostHog for product analytics. Resend for email delivery.

5.4 Your ERP. We send order data to your ERP because you asked us to.

5.5 Your storefronts. We exchange data with Shopify, WooCommerce and TikTok Shop through their APIs, only for the stores you connect.

5.6 We may share data when the law requires it.

5.7 AI provider in Reporting. If you connect your own AI provider in Reporting (Anthropic, OpenAI or Google), we send your questions, summaries of your ERP data, and query results to that provider with your own key. You choose the provider and you can disconnect it. Without a connected provider, nothing is sent.

6. How we protect data

6.1 We use TLS (HTTPS) for all data in transit.

6.2 Our database platform encrypts stored data and the backups it makes. It uses AES-256.

6.3 We add a second layer of encryption (AES-256-GCM) to store access tokens and ERP credentials. Your browser cannot read them.

6.4 We use row-level security, so merchants can read only their own organization's data.

6.5 We check the Shopify signature on every compliance webhook. We reject requests with an invalid signature.

6.6 We keep test data and production data in separate systems.

6.7 If a data breach affects you, we will tell you without undue delay and within 72 hours after we become aware of it.

7. Your privacy rights

7.1 Shopify requires us to give the same privacy rights to everyone, wherever they live.

7.2 You can ask to access, correct, delete or restrict your personal data.

7.3 If you are a shopper, ask the store where you bought. The store owner sends the request to us through Shopify.

7.4 We handle three Shopify requests: customers/data_request, customers/redact and shop/redact.

7.5 customers/redact. We replace the matching order data with a redaction stamp. We delete the matching order events. We clear the matching email on pending installs.

7.6 shop/redact. We delete the shop's orders and secrets, archive its connections, and delete its pending installs.

7.7 We confirm each request to Shopify at once. We carry out customers/redact and shop/redact requests within 30 days of receiving them, unless the law requires us to keep the data.

7.8 Shopify sends customers/redact 10 days after the request if the customer has no order in the last six months. Otherwise Shopify holds it until six months have passed.

7.9 California residents. We do not sell personal data. We do not share it for advertising.

7.10 To ask for deletion of your account data, email privacy@slickjoy.com. Merchants can also uninstall the app.

8. International transfers

8.1 We process data in the United States. Our database runs in AWS US East (N. Virginia). Our application servers run in the United States. If data moves out of the EEA, the UK or Switzerland, we use safeguards such as the European Commission's Standard Contractual Clauses.

9. Children

9.1 SlickJoy is for businesses. It is not for children. We do not knowingly collect data from children.

10. Changes to this policy

10.1 We may update this policy. We will post the new version here and change the effective date. For big changes, we will email merchants.

11. Contact

11.1 Questions about this policy: privacy@slickjoy.com. Postal address: Brapps LLC, 2791 Buckskin Drive, Plain City, UT 84404 US.