InventoryPath 3PL Audit privacy notice

Effective: October 15, 2026. Last updated: October 23, 2026.

AvanSaber Inc. operates InventoryPath 3PL Audit for Shopify merchants. Read this app-specific notice alongside the AvanSaber company privacy policy. The InventoryPath website privacy supplement covers public website cookies, analytics and newsletter subscriptions.

Contact [email protected] for privacy or support requests.

Purpose and merchant responsibilities

The merchant chooses the provider documents and customer information processed and is responsible for an appropriate lawful basis and the customer response process. We process files and records to provide invoice reconciliation, support and security.

App data is not sold or used for advertising, profiling or model training.

Shopify references and uploaded information

The app reads recent Shopify order names and identifiers, dates, fulfillment identifiers, tracking references and quantities to corroborate invoice references. It does not request customer Name, Email, Phone or Address fields from Shopify. It cannot write Shopify orders, products, fulfillments or payments.

Uploaded invoices and activity files can still contain personal or confidential commercial information, including extra columns or worksheets. Only the first worksheet is parsed, but the retained original file can contain additional sheets. Merchants should limit uploads to information needed for the audit.

We process original files, parsed tables, confirmed rate rules, findings, merchant explanations, final versions and credit records. We also retain minimal installation and session information, permissions, subscription and usage records, and operational or privacy-event information.

Access and protection

Files are encrypted in private storage. Sessions and selected structured fields use application encryption. HTTPS protects transport. The app server uses owner-confirmed encrypted EBS storage; this is not an independent security certification or audit.

Access is scoped to the connected store and checked through Shopify. Customer-data response controls are owner-only. Support has no public screen for browsing across stores.

Service providers and website analytics

The hosted workflow uses Shopify, Amazon Web Services for hosting and storage, RunCloud for hosting management and Cloudflare for routing and security. It uses no model or OCR provider, warehouse messaging provider or customer marketing service in this release.

Public website analytics follow InventoryPath’s separate consent controls. The embedded operational app has no marketing analytics. The company privacy policy describes the general service-provider and international-processing framework alongside this app-specific notice.

Retention and recovery

Audit and operational metadata follow bounded retention documented in the product. Encrypted server backups retain seven days. A separate current deletion journal is retained long enough to replay erasures before restored data can be served. Off-server backup storage is not configured.

Exports and reports are not a permanent archive. Merchants should retain their own required records before expiry.

Uninstall and privacy deletion

Uninstall revokes app access and removes private merchant data through the authenticated lifecycle process. Minimal billing-window usage can survive to prevent allowance resets. Shopify order, customer and product records are not deleted by this read-only app.

A customer-redaction request conservatively purges this store’s mixed uploaded audit data, reports, provider setup and credits because arbitrary files cannot reliably be separated by customer. Other stores and Shopify records remain unchanged. Reinstalling does not restore former private files or reports.

Customer requests and contact

For customer-data requests, the store owner reviews the request and retained source and findings exports, then completes the response through their own process. Parsed CSV copies are provided for review.

During the thirty-day original-file window, unmodified originals, including rejected uploads and additional workbook sheets, are available as private binary attachments rather than inline previews. The owner should handle them through the merchant’s approved review process.

The app does not automatically declare that no data is held or email the customer. Owners can record completed responses in Privacy requests. Customers should contact their merchant about their information; the company privacy policy describes general rights and the request process.

Contact [email protected] without sending customer invoices, session tokens, API keys or passwords in an initial email. Arrange an authorised, limited transfer when needed.

AvanSaber Inc. operates InventoryPath 3PL Audit.

App terms · Support · Merchant guide

Optional merchant setup tips

Optional setup tips are available. The full guide and core app work without email enrollment. Only the authenticated store owner can separately opt in and verify an eligible individual inbox. Buyers, suppliers and reps are not enrolled by receiving operational messages, and Shopify customer emails are not imported into marketing lists for this feature.

If the store owner requests optional setup tips, the optional service processes the deliberately supplied merchant help inbox, verification status, owner-authorised purpose/version/timestamp, preference and withdrawal evidence, confirmed store time zone, installation context and coarse app progress. Onboarding adds no Shopify customer Email access or new Shopify scope.

The optional service is hosted on existing AvanSaber-controlled infrastructure, separately from core app databases and services. It receives a minimal read-only view of readiness, qualifying outcomes and known blockers. It does not receive Shopify access tokens or underlying order/customer details, artwork, supplier files, PO rows, invoices, assignments, commission values or rep credentials.

Zoho Campaigns delivers optional educational setup tips. Zoho CPaaS/ZeptoMail delivers requested setup-tip verification codes under a separate transactional purpose. These services receive the supplied help inbox, generic app help content and the delivery or subscription identifiers needed for that purpose. They do not receive Shopify access tokens, invoices, warehouse activity files, rate rules, audit findings or shipping addresses from the optional setup-tip service. Brevo is retained only where needed for previous withdrawals, late-event handling and historical message/resource cleanup; it is not selected to send new tips for this app. Migration never reenrolls withdrawn or completed sequences.

The apps share a sending connection, but have separate setup-tip topics and app-specific preferences. Current installation, consent, completion and withdrawal checks still apply before educational dispatch. Stopping one app’s tips does not subscribe, unsubscribe or enroll the inbox in unrelated brand newsletters. The portfolio stop-all control and provider unsubscribe/suppression settings also apply.

Email providers process delivery and subscription events. Educational email may include provider-managed open or link tracking. Opens and clicks do not determine whether setup is complete. This feature adds no tracking to the embedded app or private invoice, activity or audit content. Requested verification uses a separate transactional purpose; the Zoho CPaaS verification route has open and click tracking disabled.

Keyed pseudonymous inbox indexes and minimal dispatch reservations enforce shared portfolio sending limits and stop-all preferences. These indexes are not anonymous. App credentials and domain databases remain separate; this shared boundary does not let one app browse another app’s domain records. Requested verification and security messages have a separate purpose and do not consume the educational-email allowance.

Incomplete verification preferences and challenges are cleaned within thirty days. Codes expire after ten minutes and are cleared after expiry or attempt limits. Detailed dispatch evidence is normally retained for up to ninety days after the program window; pending external cleanup identifiers remain until resolved. Consent/preference evidence may remain for up to twelve months after the window or withdrawal. Minimal pseudonymous suppression and closed-program records remain to prevent unintended re-enrollment after reinstall or recovery. Restored optional databases are quarantined and current withdrawals and installation state must be reconciled before sending resumes.

We remove app-owned mailing-list memberships and delivery resources when safe, preserve shared profiles and suppression records, and arrange additional provider erasure when required. Historical delivery records and provider backups are not erased instantly. Zoho CPaaS documents sixty-day email-log retention by default; stored message content depends on the account’s content-saving settings. Do not interpret expiration of a login code as immediate deletion of a provider delivery log. Brevo sent campaigns may be archived where deletion is unavailable; archival is not deletion of historical delivery records.

Uninstall or data erasure stops optional sending once detected, clears current inbox/challenge/guide data and queues provider cleanup. Before education dispatch, current authorisation and installation are checked again. Delayed lifecycle or provider queues can leave a message in flight; it cannot always be recalled immediately. Core app operations are independent of optional-service availability.

The owner may stop this app’s tips or all InventoryPath app setup tips for the verified inbox. Provider unsubscribe and account-wide suppression also apply. No contacts are imported automatically. Choosing not to enroll does not limit the app, and operational recipient verification does not enroll buyers, suppliers or reps. Optional setup-tip sender and Reply-To are Inventory App at [email protected]. Existing product support and privacy requests remain with [email protected]. Both brands belong to AvanSaber Inc.

Use an individual inbox without a + tag for optional tips. Zoho Campaigns rejects tagged addresses and some role addresses such as support@, info@ and admin@. The app explains this before requesting a verification code. Enter an eligible individual inbox yourself; operational email can still use supported role addresses.

The postal footer for optional tips is AvanSaber Inc., 1050 Lakes Drive, Suite #225, West Covina, CA 91790, United States.