Privacy

Version 2026-09-29. Service operator: ESKI UNION LLC (United States). Contact: [email protected].

What we process and why

Makeuno processes account and team information, workspace records, files and support messages to authenticate users, provide inventory and operational tools, control access, support users and administer subscriptions. Workspace owners determine the business records they enter and who may access them. We process merchant customer records on the merchant’s documented instructions as described in our Data processing agreement.

Shopify connection

With merchant authorization, we read products, variants, SKUs, barcodes, product images, location identifiers and stock quantities. If the merchant enables order import, we also read order references, creation dates, status, currency, product variants and quantities to support stock operations and merchant-approved local sales drafts. We do not request customer name, email, phone or address fields through the connector. Order references and order details may still be personal data. We do not change Shopify products, prices, orders or stock.

We do not sell merchant customer data, use it for targeted advertising or make automated decisions about individuals with legal or similarly significant effects. Merchants may disconnect the store, disable optional order import, or send access, correction, restriction and deletion instructions to [email protected]. We assist merchants with consent withdrawal or other rights requests when applicable to their processing. Disconnecting the integration is separate from closing the Makeuno workspace.

Service providers and security

Authentication, workspace records and access controls use Supabase. The application is hosted on Railway. Files use private Cloudflare R2 storage when cloud file storage is enabled. Product photographs may be downloaded from an authorized store; optimized photo copies have EXIF/GPS metadata removed. Stripe processes subscription payments. Email delivery providers support account messages. These providers process information needed to deliver their respective services. Hosted production data is encrypted in transit and at rest, with application access limited by workspace membership and roles.

Service providers may process data outside the merchant’s country. Applicable provider agreements and transfer safeguards must be maintained for the deployment. You can request details of subprocessors and applicable safeguards from [email protected].

Website and feedback

This website does not include advertising pixels or third-party analytics. Interactive examples use sample data in your browser. A motion preference may be saved in session storage; hosting providers process request metadata needed to serve and protect the site. When you send product feedback, we receive the message, category, page, account email and identifier, workspace name and identifier, and submission time. Authorized staff use this to investigate and improve the service; the form does not automatically collect screenshots or workspace contents.

Retention and deletion

• Shopify source order records are retained for up to 90 days from order creation. If a creation date is unavailable, the period starts at first import. Repeated reads do not restart this period. Switching off order import removes the stored source order records.
• Current catalog and location-stock observations are used while a connection is active. Disconnected Shopify connection observations and credentials are removed within 30 days. A Shopify deletion request is acted on sooner through our deletion workflow.
• Completed privacy-request payloads and report copies are cleared after 30 days. Minimal delivery fingerprints prevent duplicate processing. Unresolved requests remain tracked until resolved; expired source orders are also removed from report copies.
• Temporary Shopify installation credentials expire within one hour. Customer-deletion suppression fingerprints are retained for up to 90 days to prevent re-import; they are not used for analytics or marketing.
• Independent Makeuno product records and confirmed inventory movements are retained while necessary to provide the workspace service. Copying data into a local record does not exempt it from privacy requests. Linked records, notes, contacts, documents and attachments are reviewed where a request covers them. We do not describe removal of a provider ID alone as anonymization.
• Account or workspace closure and deletion requests can be sent to [email protected]. After verifying the requester and the affected workspace, we complete deletion within 30 days of the request. If a specific legal retention duty applies, we restrict the retained information and document its purpose, scope and end date rather than retaining the whole workspace indefinitely.

Backups and recovery

Production database backups are managed by Supabase. Deleted information can remain in restricted recovery backups until the configured backup retention period expires. We do not use recovery copies for normal service, marketing or analytics. Before a restored copy is returned to service, applicable deletion requests and expired retention periods must be reapplied. Contact [email protected] for the current recovery window. Makeuno does not operate an additional independent production database backup archive. Exports downloaded by a merchant are under that merchant’s control.

Your requests

Contact [email protected] for access, correction, export, deletion, objections or questions. We verify authority before disclosing or deleting records, including whether the requester can act for a shared workspace. Shopify customer access requests are made available to the workspace owner for secure response; downloading a report does not mark it answered. Shopify deletion notifications are handled by the server and any remaining independently entered personal records require review. Requests are tracked to completion within applicable deadlines.

Local installations

When Makeuno runs locally, records and local backups remain on the computer controlled by the operator. The local operator is responsible for device encryption, local backups, access and deletion; our hosted infrastructure controls do not automatically secure that device.