Privacy Policy
Last updated 27 July 2026
Uniligo consolidates order and fulfilment data from a merchant’s sales channels (currently Shopify and Brightpearl) into one operational dashboard. This policy describes what the service holds, what it deliberately refuses to hold, and what you can ask us to do about it.
It is written against what the software actually does. Where a limit is enforced in code rather than by policy, we say so, because that is a materially stronger promise.
1. Who we are
Uniligo (“we”, “us”) provides the Uniligo order operations dashboard. For personal data belonging to a merchant’s own customers, the merchant is the data controller and Uniligo is a data processor acting on their instructions. For a merchant’s own account details, we are the controller.
Contact: privacy@uniligo.com.
2. What we collect
2.1 Your account
- Name and email address.
- A password, stored only as a scrypt hash. We never store, log or transmit your password in readable form, and we cannot recover it — a reset issues a new one.
- Session records, and which workspace you belong to.
2.2 Order data from your connected channels
When you connect a store, we import the operational fields the dashboard reads:
- Order identifiers and references, and the sales channel.
- Timestamps for when an order was received and fulfilled.
- Line items: SKU, quantity and price; order value and item counts.
- Fulfilment stage and state, warehouse, carrier and priority.
We hold no customer personal data at all.
Not the shopper’s name, email address, telephone number or postal address. Uniligo does not ask Shopify for the customer record on an order, and the equivalent fields are stripped from every provider response before it is written to our database — including the raw payload kept for diagnostics.
This is enforced in code rather than promised in a policy, which is a materially different
thing: the data is not held, so it cannot be exported, breached or disclosed. It is also why
Uniligo does not request Shopify’s read_customers permission and holds no
approval to read protected customer fields — capabilities we deliberately do not have.
The rule the code follows is narrow and easy to keep true: if no part of the product reads a field, it is not stored. An order operations dashboard needs order shapes, statuses and timings — not who bought the item.
2.3 Credentials
Access tokens for your connected channels are encrypted at rest with AES-256-GCM. If you supply your own key for the optional AI features, it is stored the same way and is never displayed back to you in full.
2.4 What we do not do
- We do not sell personal data, and we do not share it for advertising.
- We do not use your order data, or your customers’ data, to train machine-learning models.
- We do not place personal data in URLs or query strings.
- We run no third-party advertising or cross-site tracking in the application.
3. Sub-processors
We use a deliberately short list of providers, each for one job:
| Provider | Purpose | What reaches them |
|---|---|---|
| Railway | Application hosting and the PostgreSQL database | All stored data, encrypted in transit and at rest |
| Resend | Transactional email — address verification, team invitations, password resets | The recipient’s email address and the message itself. No order data. |
| Google (Gemini) | Optional AI briefing and insights, only when you supply your own API key | See below — aggregate operational facts only |
The AI features send no customer data.
When the end-of-day briefing runs, what leaves our systems is a set of operational facts per open order: the sales channel, the fulfilment stage and state, the timestamp it arrived, the unit count and the number of distinct SKU lines — plus two daily totals. No customer name, no order reference, no line-level product detail.
These features are off unless you enter your own Gemini API key, so nothing is sent at all until you choose to enable them.
4. Where data is held
Data is stored in the United States on Railway’s infrastructure. Where personal data is transferred out of the UK/EEA, we rely on the UK International Data Transfer Addendum and the EU Standard Contractual Clauses, which are incorporated into our Data Processing Agreement.
5. Keeping data separate
Every workspace’s data is isolated at the database level using PostgreSQL row-level security, enforced by the database itself rather than by application code remembering to filter. The application connects as a role that cannot bypass those policies. A query that arrives without a workspace context returns nothing rather than everything.
6. How long we keep it
- Order history is retained for the window your plan provides — one year on Core, three years on Growth, and for the duration of the agreement on Scale.
- Account records are kept while your workspace is open.
- When a Shopify store is uninstalled, we immediately stop syncing and delete the stored credentials. Shopify then notifies us 48 hours later if the uninstall was not undone, and at that point all imported data for that store is deleted.
7. Your rights, and your customers’ rights
If you are a shopper who bought from a merchant using Uniligo, please contact that merchant. They are the controller of their customer data; we act on their instructions. Shopify provides a formal route for this and we implement it: requests for access, for erasure of a specific customer, and for erasure of an entire shop are all handled automatically.
In practice an erasure request has very little to reach: we hold no name, email, telephone number or address for any shopper. We still honour it — the retained provider payload for the affected orders is deleted — and the order records themselves survive with nothing identifying a person in them, because deleting them outright would silently restate the merchant’s own revenue and fulfilment history, which is not what erasure asks for.
If you hold a Uniligo account, you may request access to your data, correction, erasure, restriction, or a portable copy, and you may object to processing. Write to privacy@uniligo.com. We respond within 30 days. You also have the right to complain to your data protection authority — in the UK, the Information Commissioner’s Office.
8. Security
- All traffic is served over TLS.
- Provider credentials are encrypted at rest with AES-256-GCM.
- Passwords are stored only as scrypt hashes.
- Authentication endpoints are rate limited to slow credential guessing.
- Tenant isolation is enforced by the database, as described in section 5.
No system is perfectly secure. If you believe you have found a vulnerability, please write to security@uniligo.com and we will respond.
9. Cookies
We set the cookies the product needs to work: a session cookie once you sign in, and a short-lived cookie during Shopify installation that connects the store you just authorised to the account you are about to create. Both are HttpOnly. We use no advertising or analytics cookies.
10. Children
Uniligo is a business tool and is not directed at anyone under 16.
11. Changes
If we change this policy in a way that materially affects how personal data is handled, we will notify workspace owners by email before it takes effect. The date at the top always reflects the current version.