Patina Privacy Policy
This policy explains what personal information the Patina app collects, why, how long we keep it, and the choices and rights you have. It covers:
- merchants who install Patina on their Shopify store, and their staff;
- sellers and consignors, the people who bring used items to a merchant's store to sell, trade in or consign.
1. Who we are
Patina is a Shopify app made by Occam Studio. If you need our company details, contact us at support@occamstudio.io.
- Website: https://occamstudio.io
- Privacy and support contact: support@occamstudio.io
2. Our role: merchant as controller, Occam Studio as processor
Patina helps a Shopify merchant run buyback, trade-in and consignment. The merchant decides whose data goes into Patina and why.
- Data about sellers, consignors and the merchant's other customers. The merchant is the controller (under the CCPA, the "business"). Occam Studio is a processor (under the CCPA, a "service provider"). We handle this data only to run Patina for that merchant, following the merchant's instructions and Shopify's API terms. If you sold, traded in or consigned items at a store, please send privacy requests to that store first. We will help the store answer them.
- Data about merchants and their staff that we need to run our business (account, billing and support records, and security logs): Occam Studio is the controller.
Our commitments to merchants as their processor (instructions only, confidentiality, security, subprocessors, help with requests, breach notice, deletion and audits) are in the Data Processing Addendum, section 9 of our Terms of Service.
3. What we collect
Patina gets data through Shopify's APIs, from what merchant staff enter in the Shopify admin and Shopify POS, and from consignors who use the Consignments page in their customer account. Patina asks Shopify only for the permissions (access scopes) its features need. They are listed in section 4.
3.1 Shop data
- Shop domain, shop name, country, currency, the shop owner's name and email (from Shopify), install and uninstall dates, and the Patina plan and trial status.
- Patina settings: rates, consign share, hold period, payout methods and fees, aging rules, contract terms, store details printed on contracts, the store location used for intake, and similar settings.
- Shopify access tokens, which let Patina call Shopify's APIs for the shop.
3.2 Staff data
- Shopify staff user ID, name, and email (only when Shopify marks it verified). We also record whether a user is the shop owner, and their Patina role (Owner, Manager or Staff).
- A hashed POS payout PIN (we never store the PIN itself), plus failed-attempt and lockout counts.
- Audit log entries: who did what, when, and the before and after values. This covers payouts, voids, adjustments, write-offs, payout runs, intake accepts, settings and role changes, and PIN changes.
3.3 Seller and consignor data (Shopify customers)
Every seller is a customer in the merchant's Shopify store. Patina stores or reads:
- the Shopify customer ID, name, email address, phone number and postal address (for contracts, statements, receipts and payouts by cheque or bank transfer);
- the consignor code (for example
C-0042). Patina puts this code in product data, tags and reports instead of the person's name; - intakes and intake items: item title, condition, product type, notes, resale price, offer and flow (buyback, trade-in or consign), and small previews of the item photos staff take (the photos themselves are stored as files in the merchant's Shopify store and become the product's images);
- money records: ledger entries (consignment sales, refunds, payouts, fees, adjustments, write-offs), payments (method, amount, any store-credit bonus, fee, reference such as a cheque number, status, and staff and location), payout requests and payout runs;
- gift card trade-ins: Patina keeps only the Shopify gift card's ID and its last few characters. The full gift card code is held encrypted for a short time so staff can print it, and then expires. Patina does not store it otherwise;
- store credit transactions that Patina makes in Shopify for trade-ins and payouts.
Merchants should not type full bank account numbers or other sensitive data into free-text fields such as notes or payment references.
3.4 Order and sale data
When a consigned item sells or is refunded, Shopify sends Patina an order or refund webhook. Patina uses only the order and line IDs, the sold price and refund amounts for the merchant's Patina items. A webhook payload can include details about the buyer (for example name, email or address) because Shopify sends them. Patina keeps raw payloads only while it processes them, then deletes them 30 days after processing (see section 8).
3.5 POS cash drawer data
If the merchant uses cash reconciliation, Patina reads POS cash drawer sessions (cash added and removed, by location) and compares them with Patina's cash payouts.
3.6 Technical data
- Error reports sent to Sentry (see section 6). These carry the shop, a staff or customer ID and technical details. Names, emails, phone numbers and addresses are removed before a report leaves our servers.
- Standard server logs from our hosting provider (such as IP address, request path and time), used for security and fixing problems.
3.7 What we do not collect
- No payment card data. Buyers pay through Shopify checkout, and Patina never sees card numbers. Cash, cheque and bank transfer payouts are records of money the merchant pays. Patina does not move that money.
- No advertising or tracking cookies, and no selling or sharing of personal information for advertising.
- No government ID numbers or tax forms. The year-end earnings export is a summary for the merchant's accountant.
4. Shopify permissions Patina requests and why
| Permission | Why Patina needs it |
|---|---|
| Products, publications | Create and update listings for intake items (product data, metafields, tags) and publish them to the merchant's sales channels |
| Inventory, locations | Stock items at the intake location, record their cost and track them |
| Orders (read only) | Find out when consigned items sell or are refunded, so consignors are owed the right amount |
| Customers (admin and customer account) | Find or create the seller as a Shopify customer, and show a consignor their own Consignments page |
| Gift cards | Issue a trade-in as a gift card, and replace a card that never reached the seller |
| Store credit accounts and transactions | Give trade-in credit and store-credit payouts (with bonus) |
| Cash tracking | Compare cash payouts with POS cash drawer removals |
| Files | Store the item photos staff take as files in the merchant's Shopify store, so they are kept until the item is listed |
5. Why we use data, and our legal bases
| Purpose | Data | Legal basis (EU/UK GDPR) |
|---|---|---|
| Run Patina for the merchant: intakes, listings, ledger, payouts, statements, contracts, labels, aging markdowns, reports, exports, Shopify Flow triggers, consignor portal | Shop, staff, seller and consignor, order and sale data | For seller and consignor data, we act on the merchant's instructions, and the merchant chooses the legal basis (usually its contract with the seller and its legal record-keeping duties). For merchant and staff data, performance of our contract with the merchant. |
| Roles, PINs and audit log | Staff data | Contract, and our legitimate interest (and the merchant's) in protecting money and preventing fraud |
| Billing (charged by Shopify) and plan limits | Shop data, plan status, payout volume totals | Contract |
| Support, and keeping the service secure and working (error monitoring, uptime checks, backups) | Technical data, plus the minimum shop data needed | Legitimate interests in running a secure, reliable service |
| Meeting legal duties, including privacy requests passed on by Shopify | Any of the above | Legal obligation |
We do not use seller or consignor data for our own purposes. We do not sell it. We do not use it to train AI models, and we do not combine it across merchants.
6. Where data is stored, and subprocessors
Patina runs in the United States.
| Subprocessor | What it does | Location |
|---|---|---|
| Shopify | The platform Patina runs on. It also handles app billing (Patina charges only through Shopify's managed pricing). | Canada, US and others (Shopify's own policy applies) |
| Vercel Inc. | Hosts the app and runs scheduled jobs | United States |
| Neon (Postgres database) | Stores Patina's database and backups, encrypted at rest | United States |
| Functional Software, Inc. (Sentry) | Error and uptime monitoring. Personal details are removed before reports are sent. | United States |
| Google Workspace | Support email at support@occamstudio.io | United States |
We will update this list before adding a subprocessor that handles personal data. Merchants can ask us at support@occamstudio.io to be notified of changes.
International transfers. When personal data from the EEA, UK or Switzerland is handled in the United States, we use appropriate safeguards with our subprocessors. For details, contact us at support@occamstudio.io.
7. Security
- Encryption in transit (HTTPS/TLS) everywhere, and encryption at rest for the database and its backups.
- Shopify session tokens authenticate every admin, POS and customer account request. Staff permissions are checked again for every money action.
- Each shop's data is kept separate in every database query, and automated tests check this.
- Restricted access: one person at Occam Studio (the operator) can access production data. That access is read-only by default. Any change made on a merchant's behalf needs an explicit step and is recorded in an operator audit log. In-app actions are recorded in the merchant's audit log.
- Payout PINs are stored only as salted, peppered hashes, and lock after repeated wrong attempts.
- Signed links to contracts and statements stop working after 90 days. A manager can cancel all of a seller's links at any time.
- Staging and test systems never use production data.
- Point-in-time database backups, with regular restore tests.
8. How long we keep data
| Data | How long we keep it |
|---|---|
| Shop, staff, seller, item and money records | While Patina is installed |
| After uninstall | Shopify sends a shop redaction request 48 hours after uninstall. We then delete all of the shop's data, unless the merchant has reinstalled Patina by then. |
| Raw webhook payloads (orders, refunds and similar) | 30 days after processing, then deleted |
| Seller after a customer redaction request | See section 9 |
| Database backups | Deleted data leaves point-in-time backups when the backup window ends (up to 7 days) |
| Error reports (Sentry) | For Sentry's retention period, and they contain no names or contact details |
| Our own billing and support records about merchants | As long as tax and accounting law requires |
9. Your privacy rights and how we handle requests
Depending on where you live (for example under the GDPR, UK GDPR, or California's CCPA/CPRA), you may have the right to access, correct, delete or port your personal information, to object to or restrict some processing, and not to be discriminated against for using these rights. We do not sell or "share" personal information as the CCPA defines those terms.
Sellers and consignors: contact the store you dealt with. The store is the controller and can send your request to us through Shopify. You can also email support@occamstudio.io, and we will pass your request to the store.
How Patina handles Shopify's privacy webhooks:
- Customer data request (
customers/data_request): Patina gathers everything it holds about that customer (seller profile, intakes and items, ledger, payments and payout requests) into an export for the merchant to give to the customer. - Customer redaction (
customers/redact):- If the seller has any money history (ledger entries or payments) or items the shop has taken in from them, Patina removes their contact details (email, phone and notes) and any stored payloads and data request exports that mention them. Patina keeps their name, address, consignor code, record IDs, amounts and dates, because the merchant needs these for its financial and tax records. Laws on bookkeeping and tax generally allow this.
- Otherwise Patina deletes the seller entirely, with their unfinished intakes.
- Each redaction is recorded in the merchant's audit log.
- Shop redaction (
shop/redact, 48 hours after uninstall): Patina deletes all of the shop's data, unless the shop has reinstalled. Requests that don't match the shop are rejected.
Merchants and staff: email support@occamstudio.io. We will answer within the time the law sets (for example one month under the GDPR, or 45 days under the CCPA). We may need to verify who you are first. You also have the right to complain to your local data protection authority.
10. Data breaches
If we learn of a security incident affecting personal data, we will:
- contain it and investigate;
- tell the affected merchants (and Shopify, where Shopify's terms require it) without undue delay, so that merchants can meet their own deadlines (for example 72 hours to notify a regulator under the GDPR). We will say what happened, what data is affected, and what we are doing about it;
- help merchants notify regulators and individuals where needed, and notify them directly where the law requires us to.
11. Children
Patina is a business tool for merchants. It is not directed at children, and we do not knowingly collect data from children under 16. Merchants are responsible for following local law when they buy from or consign for minors. If you think a child's data is in Patina, contact the store or support@occamstudio.io.
12. Changes to this policy
We may update this policy as Patina changes. We will post the updated version on this page. For significant changes, we will tell merchants in the app or by email before the change takes effect.
13. Contact
Occam Studio Email: support@occamstudio.io Web: https://occamstudio.io