Shopflo Operator — Privacy Policy

Chrome extension ID hbdehcchpfbbpkbjhilpkoicemgfcnlj · Firefox add-on [email protected] · Safari: the Shopflo Operator app for Mac · Last updated 13 October 2026

Shopflo Operator is a browser extension for Chrome, Firefox and Safari, published by Shopflo (part of the Pine Labs group, “we”, “us”). This policy describes every category of data the extension collects, how we use it, where it is stored, how long we keep it, and every party it is shared with. It covers the extension only. Shopflo’s general policy for its other products is at shopflo.com/privacy-policy; where the two differ for the extension, this policy governs.

On Safari, the extension is delivered inside the Shopflo Operator app for Mac, from the Mac App Store. The app only contains the extension and shows how to turn it on: it collects no data of its own, makes no network requests, and contains no analytics, advertising or tracking code. Everything below applies to the extension in all three browsers.

1. What the extension does

Single purpose: it automates the creation and installation of a Shopify custom app that connects your Shopify store to Shopflo. It fills in the app-creation forms on Shopify’s own pages for you, reads the resulting app credentials, hands them to Shopflo so the connection can be completed, and clicks through the install confirmation.

It runs only on the pages listed in its manifest: admin.shopify.com, dev.shopify.com, partners.shopify.com, *.myshopify.com and dashboard.shopflo.com. It is inactive on every other site.

2. Data we collect

2.1 Account information you give us

Data	Why	Where it goes
Email address and password	To sign you in to your Shopflo account from the extension	Sent over HTTPS to Shopflo’s API (`api.shopflo.co`). The password is transmitted for verification only and is never stored by the extension.
One-time code we email you	Second factor for sign-in	Sent to Shopflo’s API for verification
Session tokens (access and refresh) issued by Shopflo	To keep you signed in while a run completes	Stored on your device in the browser’s local storage for the extension (`storage.local`); attached only to requests to Shopflo’s own API
Name and organisation on your Shopflo account; collaborator request code, where you enter one	To identify the account and store the app is being created for	Shopflo’s API
If you create a Shopflo account from the extension: your first and last name, mobile number, role, email address and password, and your store’s name and domains	To create your Shopflo account and link it to your store	Sent over HTTPS to Shopflo’s API and stored on Shopflo’s servers as your account. The password is never stored by the extension.

2.2 Shopify store information the extension reads

The extension acts inside Shopify sessions you have already signed in to in your own browser. It does not ask for, read, or store your Shopify password, and it does not log in as you.

Your store’s admin handle, `.myshopify.com` domain(s), shop ID and store name	To create the app against the right store and to connect it	Read from Shopify’s own API in your browser; sent to Shopflo’s API
The Client ID and Client Secret of the custom app the extension creates for you	Shopflo’s servers need them to generate your install link and to call the Shopify API on your store’s behalf once you approve the install	Sent over HTTPS to Shopflo’s API and stored on Shopflo’s servers
Your Shopify dashboard/partner organisation ID and the app’s page URL	To resume an interrupted run on the right app	Held on your device; included in diagnostic logs

2.3 Run state held on your device

Progress of the current run, pending-step flags, app and dashboard IDs, and a record of a store whose app is not yet connected — all in the browser’s local storage for the extension (storage.local), so a run survives the page navigations it has to make. This never leaves your device except as described in 2.4.

2.4 Diagnostic and usage data we collect automatically

When a step succeeds or fails, the extension sends an event to Shopflo’s logging service (api.shopflo.co) containing: your Shopflo merchant ID, user ID, account email address and name; your store URL; the identifier and step of the run; the action name and any error message; a timestamp; your browser’s user-agent string; the URL of the extension or Shopify page the step ran on; and your screen resolution and window size.

We use this only to diagnose failed app-creation runs and improve the extension’s reliability.

2.5 What the extension does not collect

Your browsing history, or any data from sites other than those listed in section 1.
Keystrokes or form contents on any site other than the Shopflo sign-in form inside the extension’s own pages.
Payment card numbers, bank details or other financial instrument data.
Location, contacts, files, clipboard, camera, microphone, or health data.
Your Shopify account password.

The extension contains no third-party analytics, advertising, tracking or session-replay SDKs, and sets no advertising cookies.

3. How we use the data

To authenticate you to your Shopflo account.
To create, configure, release and install the Shopify custom app on the store you choose.
To connect that app to your Shopflo account so Shopflo’s checkout services can operate on your store.
To resume a run that a page navigation or an error interrupted.
To diagnose failures, fix bugs, and measure whether runs complete.
To provide support when you contact us, and to meet legal and regulatory obligations.

We do not use it for any other purpose, and specifically not for advertising or profiling.

4. Where the data is stored, and for how long

Data	Location	Retention
Session tokens, run state, store handles	Your device, in the browser’s local storage for the extension	Session tokens until you sign out; run state until the run completes; all of it until you remove the extension.
Account details and app credentials	Shopflo’s servers, hosted in managed cloud infrastructure	For as long as your Shopflo account and store connection are active, and thereafter only as long as applicable law requires. Credentials are revoked when the app is uninstalled from your store or your account is closed.
Diagnostic and usage events	Shopflo’s logging service	Up to 12 months, then deleted.

Data is transmitted over TLS, and access to it inside Shopflo is restricted to staff who need it to operate or support the service.

5. Who we share data with

These are all of them.

Shopflo and the Pine Labs group — the operator of this extension and the service it connects you to; data is processed as described above.
Shopify Inc. — the extension makes requests to admin.shopify.com, dev.shopify.com, partners.shopify.com and your *.myshopify.com store at your instruction, using your own Shopify session. Shopify’s handling of that activity is governed by Shopify’s privacy policy.
Cloud infrastructure and email providers under contract to Shopflo — hosting, database, logging and transactional email, acting only on our instructions and bound by contract to protect the data to the same standard as this policy.
Regulators, law enforcement or courts — only where we are legally required to disclose, or to establish or defend legal claims.
An acquirer — if Shopflo or the relevant business is merged with or acquired by another entity, under the protections described in this policy.

We do not sell your data, do not transfer it to data brokers, do not use or transfer it for advertising, do not use it to determine creditworthiness or for lending purposes, do not use it to train generative AI models, and do not transfer it for any purpose unrelated to the single purpose described in section 1.

6. Your choices and rights

Stop collection: sign out from the extension, which deletes your session from your device, or remove the extension: in Chrome from chrome://extensions, in Firefox from about:addons, and in Safari by turning it off in Safari > Settings > Extensions and deleting the Shopflo Operator app from your Applications folder.
Delete your account: email [email protected] from your account’s email address. We delete your Shopflo account and the personal data linked to it, keeping only what the law requires us to, and confirm by email when it is done, within 90 days.
Access, correction, deletion, or a copy of your data: email [email protected]. We respond within the period applicable law requires, and in any case within 90 days.
Disconnect the app: uninstall the Shopflo custom app from your Shopify admin at any time; this revokes the access the created app holds on your store.
Withdraw consent: you may withdraw consent for processing at any time via the address above; this does not affect processing already carried out.

7. Children

The extension is a business tool for Shopify merchants and is not directed at, nor intended for use by, anyone under 18. We do not knowingly collect data from children.

8. International transfers

Shopflo operates from India and its infrastructure providers may process data in other countries. Where data is transferred across borders, we rely on contractual safeguards with those providers requiring protection equivalent to that described here.

9. Changes to this policy

If we change what we collect, how we use it, or who we share it with, we will update this page and change the “Last updated” date above before the change takes effect.

10. Contact

Privacy questions and requests: [email protected]
General support: [email protected]

Shopflo Operator is published by Shopflo, part of the Pine Labs group.