Privacy policy

1. Who we are

WarehouseAudit is a trading name of Fixturefix Ltd, registered in England and Wales, company number 15448622, based in London, United Kingdom. For privacy questions or requests, email jason@warehouseaudit.co.uk.

Postal address: 54 Jessica House, 10 Red Lion Square, Wandsworth High Street, London, SW18 4RD, United Kingdom.

We act as controller for our website, business contacts, enquiries and service administration. When a merchant or 3PL supplies personal data for an audit on its instructions, we act as its processor. That business remains responsible for its customer privacy notices and instructions to us. Any applicable data-processing agreement sets out those responsibilities.

2. Information we collect

• Enquiries and business contacts: your name, work email, company, store or website address, role, service requirements, messages and contact preferences. This includes trial registrations, early-access requests and provider enquiries.
• Audit inputs: invoices, agreed rates, contracts, dispatch records and optional returns or receiving evidence you provide. These may contain order and tracking references, shipment details, charges and personal information included in your files.
• Shopify information: shop domain, installation and authorisation details, and the order and fulfilment records needed for reconciliation. These include order identifiers and dates, fulfilment status, tracking references, carrier, location, product descriptions/SKUs, quantities, weight, destination country and refund amounts. The current order importer does not request customer names, customer emails or full street addresses.
• Technical information: connection and request information, such as IP address, browser/device information and service logs, may be processed by our hosting providers to deliver and secure the service. Where website analytics is enabled, page visits and device/session information may also be collected.

We obtain information directly from you, from an authorised Shopify connection and from your use of the service. For relevant business outreach, we may also obtain professional contact details from public business websites, professional profiles, referrals and business-contact providers such as Apollo.

The Shopify app does not install tracking on merchant storefronts or collect browsing activity directly from their shoppers. Customer-related information reaches us through authorised Shopify records or files supplied by the merchant. Optional analytics on our own website helps us understand usage and improve WarehouseAudit.

Please remove unnecessary customer details before uploading. We do not need payment-card numbers, passwords, identity documents or sensitive personal information to perform an invoice review.

3. Why we use information

We use information to respond to enquiries, provide requested reviews, reconcile invoices, produce findings and exports, manage trial access, support installations, resolve technical issues and protect the service against misuse.

For data we control, our lawful bases are performing a contract or taking steps you request before a contract; legitimate interests in operating, securing and improving our business and communicating with relevant business contacts; compliance with legal obligations; and consent where required, including for relevant marketing or non-essential tracking. Where a customer is a company, business-contact administration generally relies on legitimate interests rather than a contract with the individual contact.

You can object to direct marketing at any time by replying to our message or contacting us. An enquiry or audit upload is not blanket consent to unrelated marketing.

Audit calculations use deterministic software rules. Findings are provided for human review; the service does not itself decide whether a customer must pay a charge or automatically make decisions with legal or similarly significant effects on individuals. The audit engine does not send uploaded audit files to a generative-AI model.

4. Who receives information

Access is limited to people and service providers who need information to operate the service or deliver your agreed review. Supporting providers include hosting infrastructure (such as Render and Netlify), Supabase for database services, Shopify for the authorised app connection, and email providers for correspondence. Amplitude is used where website analytics is enabled.

For assisted or branded reviews, we agree the recipients of reports with the commissioning business. Automated audits do not send your findings to a carrier or 3PL on your behalf. We may disclose information to professional advisers or authorities where necessary to meet legal obligations or establish, exercise or defend legal claims.

We do not sell audit uploads or Shopify customer data, or use them for advertising audiences.

5. Retention and deletion

• Automated audit uploads and generated reports: processed in temporary server directories, with deletion after processing completes, fails or times out. A cleanup process removes abandoned directories older than 23 hours while the service is running; after downtime, cleanup resumes at startup. This is not an unconditional guarantee of deletion from every infrastructure system within 24 hours.
• Results in your browser: available during the page session. Export results you need before leaving. Copies you download or send elsewhere remain under your control.
• Enquiry, trial and support records: kept for as long as needed to respond, administer access, maintain the business relationship, prevent repeated trial misuse and address legal or dispute requirements. Trial tokens expire after seven days; that does not automatically delete the associated contact or run metadata.
• Shopify installations: encrypted access credentials and installation records are retained while needed for the connection. The app removes its stored installation record when a valid uninstall or shop-erasure notification is received.
• Assisted reviews: file transfer, access, report recipients and retention are agreed before files are shared. Email attachments are not covered by the automated-upload cleanup process.

Infrastructure logs, backups and correspondence have separate retention arrangements from temporary audit files. Retention depends on service settings, security needs and applicable record-keeping requirements. Contact us for details applicable to your review or to request deletion.

6. Cookies, browser storage and analytics

The trial workflow uses browser session storage to retain its access token during your session. Shopify also operates its own authentication environment. Necessary storage supports requested functionality and is distinct from optional analytics.

With your consent, we use Amplitude page-view analytics to understand usage and improve WarehouseAudit. Analytics stays off until you select Accept analytics. You can reject it without losing access and withdraw consent using Analytics preferences on our website. We do not run this analytics integration inside the embedded Shopify app or on the private upload page.

We send page paths and device/session information, not uploaded audit files, form contents or URL query parameters. Automatic interaction capture and session replay are not enabled. Analytics identifiers use browser session storage; your consent preference is stored locally for up to 180 days. Rejecting analytics stops further tracking; contact us to request deletion of data already collected. Browser controls can clear storage, although clearing necessary trial storage may interrupt trial access.

7. International processing and security

We are based in the United Kingdom and use European provider regions for our service data. Our website analytics is configured to use Amplitude’s EU endpoint. Provider support, subprocessors and global delivery infrastructure may involve processing outside those regions; European hosting does not mean every supporting operation is confined to Europe. Where a restricted international transfer is required, the applicable arrangement must provide a lawful transfer mechanism, such as adequacy regulations or approved contractual safeguards. You can ask us about the locations and safeguards relevant to your service.

We use measures including server-side access controls, encrypted stored Shopify credentials and bounded temporary-file processing. No online service can guarantee absolute security. Please contact us promptly if you suspect unauthorised access or an unintended disclosure.

8. Your rights and complaints

Depending on the circumstances, you can request access to, correction or deletion of your personal data, restriction of processing, or a portable copy. You can object to processing based on legitimate interests and to direct marketing. Where processing relies on consent, you can withdraw it without affecting the lawfulness of earlier processing.

Email jason@warehouseaudit.co.uk. We may need proportionate information to verify your identity. We normally respond within one month; we will explain any permitted extension or restriction. If your information was supplied by a merchant or 3PL, contact that business first so it can instruct us where appropriate. Shopify privacy requests are handled through the applicable merchant and platform processes.

You can complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint, or your relevant local supervisory authority. You do not have to contact us before doing so.

9. Changes to this policy

We update this policy when our services or data practices change. The date above identifies the latest version. We will provide additional notice where a material change requires it.