Demand Radar privacy policy

The short version

• Demand Radar records what shoppers tried to buy, not who they are. It keeps no shopper names, and no readable shopper emails or phone numbers.
• Nothing is collected from a shopper before they give analytics consent, where the law requires it.
• We don't sell data or use it for advertising.
• When you uninstall, we stop at once, and delete your store's data when Shopify asks us to, 48 hours later.

Data about your store

• Store details: your shop domain and name, contact email, timezone, currency and Demand Radar plan.
• A Shopify access token, so the nightly job can read your catalog and orders while you're not in the app.
• Your catalog and sales: products and variants with their prices and stock, and units sold per variant per day. From orders we read only the order id, date and each line's product, variant, quantity and price. Shopify's order webhook also contains the customer's details; we discard them.
• Your reports: each week's lines, their estimates and statuses, past Monday reports and the address each was sent to, and the “estimate vs actual” record after a restock.
• Connections you set up: your Amp API token (encrypted with AES-256), your forwarding address, and counts from CSV uploads. The uploaded file itself isn't kept.

Data about shoppers

Demand Radar's web pixel runs in Shopify's sandbox and only with analytics consent. It sends us about one small request per page:

• Searches: what was searched and how many results it returned. Email addresses and phone numbers typed into search are removed before anything is stored.
• Product activity: views of a product, views of a sold-out variant, adds to cart and adds that couldn't go through, with the price.
• How the visit arrived: on the first page only, the campaign tags (utm_*), ad click ids (such as gclid) and the landing path.
• A visit id: random, made in the shopper's browser tab and kept in its sessionStorage until the tab closes. It isn't linked to a customer, an account or other visits.

We don't store IP addresses or browser details from the storefront, and Demand Radar sets no cookies. The optional “want this back” button asks for no email and stores a flag in the shopper's localStorage so the same browser isn't counted twice.

Back-in-stock requests from Amp or a CSV upload carry the shopper's email (or phone number). We keep only a one-way hash of it, salted per store, to count each shopper once, never the address itself.

Support messages, if you forward your support mail to Demand Radar:

• Mail is received by Resend. Messages that look like a product question (by keyword) are sent to Anthropic's Claude to classify: the subject and up to the first 3,000 characters of the message, without the sender's address. Anthropic doesn't train its models on API data.
• We keep the product asked about, the size or colour, a snippet of up to 160 characters with names, emails, phone numbers, links and order numbers taken out, a salted hash of the sender, and the date. Never the message or the sender's address.
• Disconnecting the forwarding address deletes every snippet it brought in.

The free estimator

The public page at demand-radar.oakandlever.com/estimate reads the public catalog of the store you type in (the same product list any visitor can see) and caches the result. To limit abuse we keep a keyed hash of your IP address for about a day. If you join the waitlist we keep your email and the store you checked, only to tell you when Demand Radar opens; ask and we'll delete it. The page loads its fonts from Google Fonts.

Why we use it

Only to run Demand Radar: to work out and send your report, to show the evidence behind each line, and to answer your support requests. Nothing is used for advertising, sold, or combined across stores.

Who processes it

How long we keep it, and deletion

• Storefront signals are deleted after about 13 weeks. Order ids are deleted after 100 days.
• Support snippets and back-in-stock data from a connection are deleted when you disconnect it.
• When you uninstall, we stop at once. 48 hours later Shopify sends us a shop/redact request and we delete everything we hold for your store.
• Shopper requests: when a shopper asks your store to delete their data, Shopify sends us customers/redact and we delete the back-in-stock requests and support asks that match their email address. Storefront signals hold nothing that identifies a shopper.
• Sooner: email support@oakandlever.com from your store's contact email and we'll delete your data earlier.

Security

Data is encrypted in transit (TLS) and at rest (our providers' disk encryption), and connection tokens are encrypted again by the app. Access is limited to the developer.

Changes to this policy

If we change how Demand Radar handles data, we'll update this page and the date at the top. For significant changes, we'll also email the contact address of stores that have Demand Radar installed.

Contact

Oak and Lever. Email support@oakandlever.com. We reply within one business day.