Summary
- QuoteLock stores quote requests that shoppers send to a store (name, email, optional phone, company and message, and the products requested), plus the store's settings and Shopify sessions.
- We use this data only to run QuoteLock for the merchant. We don't sell it, use it for advertising, or track shoppers.
- Closed quote requests are deleted automatically after 24 months, and no quote request is kept longer than 36 months.
- Data is hosted in the United States by Vercel and Neon. Quote emails are sent by Shopify, not by a separate email service.
Who we are
QuoteLock is built and operated by 920Four ("we", "us").
For shopper data, the merchant whose store received the quote request decides how it is used (the controller), and we process it on the merchant's behalf (the processor). For merchant account data, we are the controller.
What we store
| Data | Whose | Details |
|---|---|---|
| Quote requests | Shoppers | Name and email (required); phone, company and a message (optional); the products, variants, quantities, list prices and product images requested; the page the request was sent from. |
| Quote handling | Merchants | Quoted prices and quantities, an internal note, status (new, sent, converted, declined, expired), quote number and currency, the Shopify draft order and its checkout link, a random token that lets only that customer's checkout through, and expiry date. |
| Store settings | Merchants | The store's myshopify domain, lock tags, checkout message, storefront appearance, exempt customer tags, a secret key for signing approval codes, quantity-break rules and setup progress. |
| Price backups | Merchants | Only with Price privacy on: the real price and compare-at price of each locked variant, so they can be restored. |
| Shopify sessions | Merchants | The store domain, the access and refresh tokens Shopify issues to the app, the granted permissions and their expiry. QuoteLock uses store-level sessions, so it doesn't store staff names or emails. |
To work, QuoteLock also reads products, collections, theme styles and, during checkout, customer tags through Shopify's APIs. It uses this information when needed and doesn't copy customer records into its own database.
What we don't collect
- No cookies, analytics or tracking on the storefront. The quote a shopper is building is kept in their own browser (local storage) until they send it; a few small helper values (such as whether an approval code was applied) live in session storage.
- No payment details. Customers pay through Shopify's checkout, which QuoteLock never sees.
- No data is sold, rented or shared for advertising.
How we use it
Only to provide QuoteLock's features to the merchant:
- showing quote requests in the merchant's Shopify admin;
- creating draft orders and private checkout links for approved quotes, at the merchant's prices;
- enforcing the merchant's checkout rules, approvals and quantity breaks;
- preventing abuse (for example, limiting how many requests one email address can send per hour);
- supporting the merchant when they contact us.
Quote emails
When a merchant approves a quote and chooses to email it, QuoteLock asks Shopify to send the draft order invoice to the customer's email address. The email is sent by Shopify from the merchant's store. QuoteLock doesn't use a third-party email provider and doesn't send marketing email.
Service providers
| Provider | Purpose | Location |
|---|---|---|
| Shopify | Platform the app runs in: authentication, checkout, draft orders and invoice emails, app proxy and webhooks. | Global |
| Vercel | Hosting and running the app, including short-lived request logs. | United States |
| Neon | PostgreSQL database where the data above is stored, with backups. | United States (AWS us-east-1) |
Personal data is processed in the United States. Where the law requires it, transfers rely on the providers' standard data protection terms.
How long we keep it
An automatic job runs every day and deletes quote requests:
- 24 months after a quote closes: ordered, declined or expired, or sent and past its expiry date;
- 36 months after it was created, whatever its status.
Store settings, price backups and sessions are kept while QuoteLock is installed. Draft orders that QuoteLock creates live in the merchant's Shopify store and follow Shopify's and the merchant's own retention.
Uninstalling and deletion
QuoteLock handles Shopify's mandatory privacy webhooks:
- App uninstalled: the store's Shopify sessions (access tokens) are deleted right away.
shop/redact(sent by Shopify 48 hours after uninstalling): all of the store's quote requests, settings, price backups, quantity-break rules and sessions are deleted.customers/redact(when a customer asks the merchant to erase their data): every quote request with that customer's email address in that store is deleted.customers/data_request(when a customer asks the merchant for their data): QuoteLock keeps nothing about a customer beyond their quote requests, which the merchant can see on the Quotes page in the app. If the merchant needs a copy, we'll provide it on request.
Using Price privacy? Turn it off before uninstalling so QuoteLock can restore your products' real prices in Shopify. After uninstalling, QuoteLock can no longer change your products.
Security
- Data is encrypted in transit (TLS) and at rest, including database backups.
- Requests from Shopify (webhooks, the storefront app proxy and admin sessions) are verified with Shopify's signatures before QuoteLock acts on them.
- Production and development use separate databases, and access to production is limited to the people who run QuoteLock.
- Checkout rules run in Shopify's own infrastructure, so locked products can't be bought by tampering with the storefront.
If we become aware of a breach affecting personal data, we'll notify affected merchants without undue delay so they can meet their own obligations.
Your rights
Shoppers and customers: to access, correct or delete the data in a quote request, contact the store you sent it to. When the merchant asks Shopify to erase your data, QuoteLock deletes your quote requests automatically. You can also email us and we'll pass your request to the right merchant.
Merchants: email us to access, correct, export or delete your store's data, or uninstall QuoteLock to have it deleted automatically.
Depending on where you live (for example, under the GDPR or US state privacy laws), you may also have the right to object to or restrict processing and to complain to a data protection authority. QuoteLock doesn't make automated decisions with legal effects and isn't intended for children.
Changes
We'll update this page when QuoteLock's data handling changes and change the effective date above. We'll let merchants know about material changes before they take effect.
Contact
Privacy questions and requests: team@920four.com
920Four