Privacy Policy

POS Generate Transfers · Last updated: July 10, 2026

POS Generate Transfers ("the app", "we", "us") is a Shopify point-of-sale app published by Branch Build that lets retail staff create, request, fulfill, and receive inventory transfers between store locations directly from Shopify POS. This policy explains what data the app accesses, what it stores, and how merchants can exercise their rights.

Information the app accesses

With the access scopes a merchant grants at installation, the app reads and writes the following data through the Shopify Admin API, solely to display and create inventory transfers:

• Products, product variants, titles, images, and barcodes
• Inventory items and available inventory quantities
• Store locations
• Inventory transfers and shipments (created on the merchant's behalf)

This data is fetched on demand to render the app and is not used for any other purpose, sold, or shared with third parties for advertising.

Information the app stores

To authenticate with the merchant's store, the app stores:

• The store's myshopify.com domain
• An offline access token (and its refresh token) used to call the Shopify Admin API

To provide the stock-request and activity-history features, the app also stores records of the transfer requests created within it. These records contain store operational data only:

• Requesting and source store location names and IDs
• Product and variant titles, product image URLs, and requested quantities
• Request status, grouping identifiers, the created transfer ID, and timestamps

The app does not store or process customer personal information, order data, or payment information. It does not request customer-data access scopes.

Sub-processors and hosting

The app's server and database are hosted on Railway (Railway Corp.). Data in transit is encrypted via HTTPS/TLS. No other sub-processors receive merchant data.

Data retention and deletion

Stored data is retained while the app is installed. When a merchant uninstalls the app, the app deletes the store's access tokens. When Shopify sends a shop/redact request (approximately 48 hours after uninstall), the app erases all remaining data for that store, including the transfer-request records described above. Because no customer data is stored, customers/data_request requests return no data and customers/redact requests require no action.

GDPR / CCPA compliance

The app subscribes to Shopify's mandatory compliance webhooks (customers/data_request, customers/redact, shop/redact) and responds to them as described above.

Contact

For privacy questions or data requests, contact us at branch.build.to@gmail.com.

Changes to this policy

We may update this policy from time to time. Material changes will be reflected by the "Last updated" date above.