Canopy privacy policy

Last updated: 6th November 2026

Who we are

Canopy Inventory ("Canopy") is a Shopify app that helps merchants see how many weeks of stock they have and what to reorder. It is provided by Belvia London Ltd, a company registered in England and Wales (company number 16467413), registered office 167-169 Great Portland Street, 5th Floor, London, W1W 5PF ("we", "us").

For store data that Canopy processes in order to provide its inventory-planning features, the Shopify merchant is the controller and Belvia London Ltd acts as processor. For information that you provide directly to us for support, account administration, security or business communications, Belvia London Ltd acts as controller.

What data Canopy reads

Canopy asks Shopify for read-only access. It never changes anything in your store.

• Products and variants (read_products): product and variant titles, SKUs, vendor, status, price, whether stock is tracked, and bundle components.
• Inventory (read_inventory): available and on-hand stock per location, and each item's unit cost (Cost per item).
• Locations (read_locations): location names, whether each is active and whether it fulfils online orders.
• Orders (read_orders, and read_all_orders for orders older than 60 days): for each order, its ID, the date it was placed and whether it was cancelled; for each line item, the product variant and the quantity after refunds and removals. On install Canopy reads the last 90 days of orders (60 days if Shopify has not granted read_all_orders), then new and changed orders only.

What Canopy stores

• Product, variant, inventory, location and unit cost data, as above.
• Per-variant daily sales totals: units sold for each product variant on each day (for example "variant 123 sold 4 units on 2 March"). Order IDs and individual orders are not stored.
• What you enter in Canopy: incoming purchase orders (supplier name, PO reference, expected date, quantities, unit costs) and reorder settings.
• Your store's plan (Free, Growth or Pro) and trial status, as reported by Shopify.
• Encrypted Shopify access tokens, so Canopy can read your store data.
• Technical records of the Shopify notifications we received (notification ID, topic and time), used to avoid processing one twice.

What Canopy does not store

Canopy does not store customer names, email addresses, postal addresses, phone numbers, or any other personal information about your customers. It does not request access to customer records, and its order requests do not include any customer field. Order data is reduced to per-variant daily totals as it is read.

Why we use the data

Only to provide Canopy's features to you: weeks of cover, stockout and reorder-by dates, reorder quantities, incoming stock, cash needed to reorder, and the Top 3 actions. We do not sell data, use it for advertising, or share it with other merchants. Each store's data is kept separate from every other store's data.

How long we keep it

• Daily sales totals: up to 730 days; older days are deleted automatically.
• Notification records: 30 days.
• When you uninstall Canopy: we delete the access tokens immediately and your store's data stops being accessible to the app. Shopify then sends us a store redaction request 48 hours after uninstall, and we delete all of your store's data when we receive it (Shopify requires this within 30 days; Canopy does it on receipt).
• Our database provider keeps restore history for a limited period of no more than 30 days. Restore copies expire automatically under that provider's retention schedule.

Security

• All data is encrypted in transit (HTTPS / TLS with certificate verification, including to the database).
• Canopy's database provider, Neon, encrypts stored data using AES-256. Shopify access and refresh tokens are additionally encrypted by Canopy using AES-256-GCM, with the encryption key stored separately from the database.
• Every store's data is separated in the database by store, enforced by the database itself (row-level security).
• Canopy's Shopify API access only works from our hosting provider's network in the United Kingdom (Shopify IP allowlist).
• Access to Canopy's production hosting and database administration is restricted to Andrew Simpson, founder of Belvia London Ltd, together with authorised personnel of our infrastructure providers where necessary to operate and support their services.

Service providers and subprocessors

Where data is transferred internationally, we use the contractual transfer safeguards provided by our service providers where required, including applicable Standard Contractual Clauses and the UK International Data Transfer Addendum.

A Data Processing Agreement covering Canopy's processing of store data is available to merchants on request by contacting support@canopyinventory.com.

Your rights

Depending on applicable data-protection law, individuals may have rights to access, correct, erase, restrict or object to the processing of their personal data, and in some circumstances to receive a portable copy. To exercise a right relating to information Belvia London Ltd controls directly, contact support@canopyinventory.com. For personal data contained in a Shopify merchant's store, requests should normally be directed to that merchant as controller. UK individuals may also complain to the Information Commissioner's Office (ico.org.uk).

You can ask us for a copy of the data Canopy holds about your store, or ask us to delete it, at any time by contacting support@canopyinventory.com.

Requests from your customers: because Canopy stores no customer personal data, Shopify's customer data and customer redaction requests are acknowledged and there is nothing further to return or delete.

Changes

We will update this page if what Canopy does with data changes, and change the date above.

Contact

support@canopyinventory.com, Belvia London Ltd.