Privacy Policy
CK4Life Wholesale is a Shopify app that applies per-account wholesale pricing to approved customers of the store that installs it. This policy explains what the app stores, what it does not, and the rights available to you.
Last updated 16 August 2026
Who we are
The app is operated by Modern Labyrinth (23011 Moulton Pkwy Suite C-12, Laguna Hills, CA 92653), which is responsible for the data described here. Contact us at Contact@modernlabyrinth.com.
The app is built for, and branded on behalf of, the merchant whose store it is installed on. For data held inside that merchant’s Shopify store, the merchant is the data controller and we act as their processor under our agreement with them. For the install record described below, which we hold to operate the app, we act as controller.
What the app stores
When a merchant installs the app, we store one record per store, containing only what is needed to make authenticated calls to that store’s Shopify Admin API:
- Store domain, for example my-store.myshopify.com.
- An offline access token and its refresh token, issued by Shopify at install.
- The permissions granted at install: managing discounts, managing product metafield definitions, and reading and updating customer tags and wholesale rates.
We rely on this record to perform our contract with the merchant. It is the minimum required for the app to function; without it the app cannot authenticate and does nothing.
Customer information the app reads
So that store staff can find a wholesale account and confirm they are setting rates on the right one, the app displays, for customers tagged as wholesale accounts or applicants only:
- The customer’s name.
- The customer’s email address.
- Their wholesale tags and their wholesale rates metafield.
This information is read from Shopify each time a staff member opens the page and is never copied out of Shopify or stored by us. Customers who are not wholesale accounts or applicants are never retrieved at all. Search happens in the browser, so a name or email typed into the search box is never sent to our servers and never appears in our logs.
We process this information as the merchant’s processor, on their instructions and under our agreement with them; the merchant determines the legal basis for it. Our own personnel can see this information when operating and supporting the app.
What the app writes to the merchant’s store
Two storefront forms send data through the app to the merchant’s own Shopify customer records: a wholesale application, and an in-person lead capture form. From these the app writes the applicant’s name, email address and phone number to the customer record, tags the customer as a wholesale applicant, and stores a marketing-consent record — the exact disclosure text and version the person agreed to, when, and whether they or a staff member completed the form.
All of this is written into the merchant’s Shopify store, which the merchant controls. None of it is copied into our own database or sent anywhere else. When Shopify notifies us that a customer has requested erasure, the app deletes the records it wrote.
What the app does not read or store
The app does not request or retain payment details or order history, and it stores no personal information about a store’s shoppers or staff in its own database. It is not used for advertising, analytics, or profiling, and no personal data is sold or shared with any third party.
What the pricing logic reads
Wholesale pricing is applied by Shopify Functions, which run inside Shopify’s own infrastructure when a cart is priced. For a signed-in customer they read only:
- Whether the customer carries the wholesale tag.
- The customer’s wholesale rates metafield, which the merchant sets.
- A product’s wholesale category metafield, which the merchant sets.
These values are read at the moment of pricing and are never copied out of Shopify or stored by us. If a customer has no rates set, the app applies no discount and normal retail pricing stands.
Where data is held
The app runs on Vercel and stores its install records in a Neon PostgreSQL database hosted in the United States. Vercel and Neon are our only sub-processors; both process this data solely to operate the app. The customer information described above stays within Shopify’s own systems and is only rendered to the staff member viewing it. We do not sell data, and we share none of it for advertising or analytics.
Our hosting provider keeps short-lived operational logs that may record a store’s domain and error diagnostics. These are used only to operate and debug the app, are retained for approximately 30 days, and contain no access tokens.
We also keep an access log recording each time a staff member views wholesale account information: the time, the store, the staff member’s Shopify user ID, and the Shopify ID numbers of the accounts shown. This exists so that access to customer information can be audited, as Shopify requires. It records identifiers only — no names and no email addresses are written to it — and it is retained for the same period as the operational logs above.
The app is intended for merchants operating in the United States, and all of its infrastructure is located there. If you are considering installing it from outside the United States, contact us first so we can confirm an appropriate basis for transferring the install record described above.
Security
All traffic to the app is encrypted in transit using TLS, and the database encrypts data at rest. Access tokens are stored only in the install record and are never written to logs. Access to production systems is limited to personnel who need it to operate the app.
Retention and deletion
We keep the install record only while the app remains installed. When Shopify notifies us that a merchant has uninstalled the app, we delete that store’s install record, including its access and refresh tokens. Shopify also sends a shop redaction request 48 hours after uninstall, which we handle the same way, so the record is removed even if the first notification does not arrive. Merchant settings such as wholesale rates live on the merchant’s own Shopify store, belong to them, and are unaffected by uninstalling.
The app also implements Shopify’s mandatory data request, customer redaction, and shop redaction webhooks. Because no customer personal data is stored in our own database, a data request has nothing for us to return and we acknowledge it to Shopify on receipt. A customer redaction deletes the application and consent records the app wrote to the merchant’s customer record. A shop redaction deletes the store’s install record.
Your rights
Depending on where you live, you may have the right to access a copy of your personal data, to have it corrected or erased, to restrict or object to how we use it, and to receive it in a portable format. To exercise any of these, email Contact@modernlabyrinth.com and we will respond within the period required by applicable law.
If you are a shopper on a store using this app, we retain no personal data about you. Wholesale account holders’ names and email addresses are read from Shopify only while a staff member has the page open, and are not written to our database. Requests are therefore best directed to the merchant, who controls the data in their Shopify store, and we will assist them in responding.
If you are in the European Economic Area or the United Kingdom, you also have the right to lodge a complaint with your local data protection supervisory authority. If you are a California resident, you have the right to know what personal information is collected, to request its deletion, and not to be discriminated against for exercising those rights. We do not sell or share personal information as those terms are defined under California law.
Data breaches
If a breach affects data we process on a merchant’s behalf, we will notify that merchant without undue delay after becoming aware of it; as the controller, they are responsible for notifying their supervisory authority and affected individuals where required. If a breach affects the install record described above, for which we are the controller, we will notify the relevant supervisory authority ourselves within the period required by law.
Changes to this policy
If we change how the app handles data, we will update this page and the date at the top. Where a change materially affects merchants, we will notify them by email at the address associated with their store.
Contact
For questions about this policy, or to make a data request, email Contact@modernlabyrinth.com. Merchants may also raise requests through Shopify, which we will action through the webhooks described above.