Wharfly is a Shopify app for purchasing: supplier purchase orders, shipments, supplier bills, demand planning and stock reordering. It is operated by Hunain Khatri, an individual (“we”, “us”). You can reach us at support@wharfly.app.
Wharfly Supply Chain Solutions, or Wharfly, is a brand operated by Hunain Khatri, an individual trading as Wharfly, based in Malaysia. Wharfly is not yet a registered company. This policy covers the Wharfly app for Shopify and the website, wharfly.app. For the merchant data described below, the merchant decides what goes into Wharfly and we handle it on the merchant’s behalf to provide the service.
In short. We store the purchasing records you enter and the minimum we need from your Shopify store to run the app. We do not read or store your shoppers’ personal information. We do not sell data, show ads, or use analytics or tracking. Wharfly changes your Shopify inventory only when you confirm a receipt. You can delete everything yourself, at any time, inside the app.
Your store’s .myshopify.com address, and for each staff member who opens the app: name, email address, Shopify user ID, language setting, whether they are the account owner, and the role and approval limit that someone in your store assigns them in Wharfly. We also keep the access tokens Shopify gives the app. We use this to sign people in, call Shopify on your behalf, apply roles and approval rules, and show who approved or changed what.
Suppliers (the business contact details you choose to add, such as company name, email, phone and address), product links and quoted costs, purchase orders and their history, shipments with carrier and tracking numbers, supplier bills, payments, the accounting ledger entries those create, notes, and settings. This is your data. We use it only to provide the features you use.
Each shipment is stored with a unique shipment ID for your store (for example SHP-1001), its dates and items, and its receiving history: who received it, when, the units accepted and rejected, and the freight and duty you entered.
Each rejected or damaged receipt line is stored as a numbered rejection (for example RJ-1001) with the product, units, unit cost and reason, and the credit claim details you enter: status, claim reference from the supplier, amounts, dates and notes. These are tracking records only. They are not posted to the accounting ledger. They link to your suppliers and add no new kinds of personal data.
Raw materials you add (name, SKU, unit, low stock level and the cost you enter), the suppliers that sell them with the stock each purchase unit holds, and a history of every change to a material's stock: what happened, how much, when and who did it. They are your own business records and add no personal data.
A bill of materials for each product you set up: the product's Shopify variant ID and the amount of each material one unit uses. No personal data.
Daily snapshots of your total stock value, units on hand and the number of products at risk, out of stock and tracked, taken on each day the Home screen is opened, so the app can compare with earlier periods. They hold totals only, with no product names.
When you install Wharfly you approve four permissions: read locations, read orders, write inventory and write products. Wharfly uses each for one job. Read locations lets you choose where received stock goes. Read orders is used only to total units sold per product per day. Write inventory shows stock on hand and adds stock when you receive goods against a shipment. Write products lets you pick products for purchase orders, create a product from an order line for a new item, and create and remove the demo products that sample data makes. Shopify’s write permissions include read access.
Receiving stock changes your live Shopify inventory. Stock is only received against a shipment. When you confirm a receipt, Wharfly adds the accepted quantity to the location you choose. If an approver or admin reverses a receipt, Wharfly removes the same quantity from that location. This only happens when you confirm it. The accepted quantity is the units received minus the units rejected. These are real changes to your store’s data: they show in the Shopify admin and to your sales channels straight away. A retry cannot count the same receipt, or the same reversal, twice.
We also make these changes, and only on your action:
wharfly-demo), with starting stock at your first active location. Removing the sample data deletes those products again.We change nothing else in your store.
Wharfly sets no cookies. Shopify’s own libraries may set technical cookies needed to sign you in inside your Shopify admin. Our servers and hosting provider keep logs of request paths and status codes, which can include the store’s .myshopify.com address, for a limited time. Your browser remembers one preference locally, the receiving location you last chose, and nothing leaves your device for that. We use no analytics, advertising or tracking tools, and the app loads no third-party scripts other than Shopify’s own.
Payment card numbers or bank details. Your customers’ personal details, as explained above. Advertising identifiers, or data for profiling or advertising. Paid plans will be charged through your Shopify bill.
The search box at the top of the app looks only through your store’s own saved records in Wharfly: purchase orders, shipments, rejections, bills, payments, suppliers and the product names on your orders. It does not call Shopify. What you type is sent over HTTPS, used to find matches, and then discarded. Search terms are not stored or logged.
AI features are not live. Wharfly does not send your data to any AI provider today. Before any AI feature launches, we will update this policy to name the provider and explain what data is sent.
Wharfly does not store personal information about your customers. Shopify’s mandatory customer data requests (customers/data_request and customers/redact) are received, verified and acknowledged; there is nothing to return or erase.
We do not sell or rent data, and we do not share it for advertising.
Wharfly does not send email itself. When you email a purchase order to a supplier, Wharfly prepares the message and your own email app sends it.
We may disclose information if the law requires it. If the app were ever transferred to another operator, your data would move with it and this policy would continue to apply until you were told otherwise.
In a managed PostgreSQL database hosted by Railway in the United States (US West, California). If you are outside the United States, using Wharfly means your data is processed there. We operate from Malaysia, and Shopify and Cloudflare run servers in several countries, so data may also be handled in a country other than the one where you or we are based. Where the law requires safeguards for this, we rely on the safeguards our providers offer.
You can also export most lists as CSV from the Export buttons in the app before deleting.
Backups held by our hosting provider, if any, age out under the provider’s own schedule.
We keep emails about support and privacy requests for as long as we need them to deal with the request and to show we did.
Wharfly is served over encrypted connections (HTTPS). Every request is authenticated with Shopify’s signed session tokens, and every Shopify webhook has its signature verified before we act on it. Each store’s data is kept separate from every other store’s, and actions such as approving or cancelling purchase orders and deleting data are limited by role. No system is perfectly secure, and we cannot promise absolute security, but we work to protect your data. Merchant data is stored in an encrypted database volume at our hosting provider.
Depending on where you live, you may have the right to access, correct, export or delete personal information we hold about you, or to object to how it is used. Store admins can do most of this directly in the app (edit records, export lists, delete all data). For anything else, or if you are a staff member or a supplier contact and want your details corrected or removed, email support@wharfly.app and we will respond. We aim to reply within 24 hours on business days. Data about suppliers is entered by the store that uses Wharfly, which decides what to record; we process it on that store’s behalf.
Where the law asks for a legal basis, ours are providing the service the merchant asked for, our legitimate interest in running and securing it, and legal obligations. Depending on where you live, laws such as the GDPR or Malaysia’s Personal Data Protection Act 2010 may give you further rights, including to restrict or object to how we use your data, to receive a copy of it, and to complain to your data protection authority.
Wharfly is a business tool and is not directed at anyone under 16. We do not knowingly collect their information.
If we change this policy we will update the date at the top, and for material changes we will tell store admins in the app or by email.
Hunain Khatri · support@wharfly.app