Z Reports — Privacy Policy

Last updated: 15 August 2026

This policy explains how the Z Reports app ("the App", "we", "us"), provided by Stock Atlas (based in the United Kingdom), handles information when you install and use it on your Shopify store. Stock Atlas is the data controller for the merchant data described below; you remain the controller of your own store and customer data.

1. Who this applies to

This policy is for the Shopify merchants (store owners and staff) who install and use Z Reports. Z Reports is a point-of-sale tool that runs inside the Shopify POS app; it does not interact with the shoppers who visit your online storefront.

2. What the App does

Z Reports produces an end-of-day "Z report" — a cash-up summary of your sales, payments, refunds and transaction and customer counts for a chosen period. To build that summary it reads your Shopify orders; it does not write to, or change, your store in any way.

3. What data we access and store

Order & sales data — to build your report, the App reads your Shopify orders and transactions for the period you select (totals, payment methods, refunds and line items). This is read on demand to generate the report; we do not keep our own copy of your order history in a database.
Customer count — the App counts how many distinct customers were associated with the day's orders so the report can show a customer total. It uses only the minimum customer information needed for this count and does not build profiles of, or store contact details for, individual shoppers.
Location data — if you choose a per-location breakdown, the App reads the name of each of your Shopify POS locations so the report can label its sections. This is why the App requests location access (see below).
Your store & account details — so the App can run, we keep a small account record for your store on our server (hosted on Railway — see section 6). It includes your store name, domain and Shopify store ID, the store owner's name, your contact email, your country, currency, timezone and locale, and your Z Reports plan and billing status. This is merchant/business information, not shopper personal data.
Your settings — your report preferences (such as how the report is broken down, which sections it shows, and the email addresses you send it to) are stored on our server alongside your account record. The email addresses you choose as report recipients are business contacts you enter yourself; we use them only to deliver the reports you ask for, and we delete them when you uninstall (see section 7).
Delivery problems — if a report email is permanently rejected by a recipient's mail server (for example, the address has a typo), we record that address and the reason so the App stops sending to it and can tell you it needs fixing. This protects your reports from silently failing, and protects our ability to deliver email at all.
Generated reports — every generated report is saved on our server, on both plans. Your history is what lets each new report pick up exactly where the last one finished, which is what stops sales being counted twice or missed between reports. In the App, Free shows you your 5 most recent reports and Z Reports Plus shows your full history, with the trend chart and the option to export or delete any individual report. A saved report can include the names of your POS locations and products as they appear on the report. Saved reports are kept until you delete them or uninstall the App (see section 7).
Support messages — if you contact us through the in-app form, we store your message and the reply email address you give so we can respond.

The App requests only the Shopify permissions it needs: read access to your orders (read_orders), to customers (read_customers, solely to count customers on the report), and to locations (read_locations, so a report can be broken down by POS location). It requests no write access and makes no changes to your products, theme or store.

4. Protected customer data

Because the report includes a customer count, the App uses Shopify's Protected Customer Data Access under the minimum level required for that feature. The App reads only what it needs to count customers for the report; it does not display, export or store shopper names, email addresses, phone numbers or addresses.

5. How we use the data

To generate your end-of-day and end-of-period Z reports on request.
To print a report via AirPrint / your device's standard print dialog (not the POS receipt printer) and email a report to the address you enter.
To remember your report settings between sessions.
To maintain, secure, troubleshoot and improve the App.

We do not sell your data, and we do not use it for advertising.

6. Sharing & sub-processors

We share data only with the infrastructure providers needed to run the App, each under their own security and privacy commitments:

Railway — cloud hosting for our server, which generates your reports and stores your account record, your report settings and recipients, and your saved report history.
Resend — delivery of the report emails you choose to send, sent from zreports@stockatlas.app.
Sentry — error monitoring, configured so that personal data is not sent to it.
Shopify — the platform the App runs on, including POS, orders and app embedding.

We do not sell your data. We may disclose information if required by law.

7. Data retention & deletion

The App does not keep its own copy of your order history — it reads orders from Shopify each time it generates a report. Generated reports are saved on our server on both plans and kept until you delete them or uninstall; what differs is how much of that history the App shows you (your 5 most recent on Free, all of it on Z Reports Plus). You can delete saved reports at any time on Plus. Your settings and report recipients are also stored on our server.

When you uninstall the App, your access token is revoked and the App can no longer read your orders. Shopify then sends us an erasure request for your store — this normally arrives about 48 hours after uninstalling — and on receiving it we delete your saved report history, your report recipients and your support messages, and clear your store and contact details from your account record (see section 8). Your orders, products and store are not altered by uninstalling.

8. Shopify mandatory data webhooks (GDPR)

As required by Shopify, the App implements the mandatory compliance webhooks customers/data_request, customers/redact and shop/redact. Because the App does not store shopper personal data, the two customer webhooks confirm we hold no such data; the shop/redact webhook redacts your account record (clearing your store and contact details) and deletes the saved report history, the report recipients and the support messages the App stored for your store.

9. Security

Access tokens are held securely, data is transmitted over HTTPS, and access to our systems is restricted. No system is perfectly secure, but we take reasonable measures to protect the data we handle.

10. Your rights

Depending on where you are based (for example under UK/EU GDPR), you may have rights to access, correct or delete data we hold about you, or to object to certain processing. To exercise these rights, contact us using the details below. Stock Atlas is the data controller for the merchant data described above.

11. Changes to this policy

We may update this policy as the App evolves. We'll change the "last updated" date above and, for material changes, make reasonable efforts to notify merchants.

12. Contact

Stock Atlas, United Kingdom
Email: hello@stockatlas.app

← All privacy policies