Privacy Policy

Effective date: May 9, 2026 · Last updated: May 9, 2026

1. Overview

SquareFloww is a Shopify app developed by RippleStep that enables bidirectional data synchronization between Shopify and Square — letting merchants push products and customers from Shopify to Square, and fetch Square products and customers back into Shopify, on demand and in selectable batches.

RippleStep collects only what is necessary to provide the SquareFloww service, never sells your data, and deletes it promptly when you uninstall the app.

2. Who We Are

Organisation: RippleStep
Product: SquareFloww (a Shopify app by RippleStep)
Data Controller: RippleStep, as the company responsible for how SquareFloww collects and processes data.

Questions about this policy? Contact us at support@ripplestep.com.

3. Data We Collect

We collect the minimum data required to operate the sync between Shopify and Square.

3.1 From Shopify Merchants

Data	Why we collect it	Stored?
Shop domain	Identify your store and associate all data with it	Yes
Shopify session token	Authenticate API requests to Shopify on your behalf	Yes (encrypted)
Square OAuth tokens (access & refresh)	Make authenticated calls to your Square account	Yes (encrypted)
Square Merchant ID	Identify your Square account for sync operations	Yes
Sync direction and entity type (products/customers)	Know which direction and entity type to sync	Yes
Shopify Product ID ↔ Square Item ID	Avoid duplicate products on re-sync; update existing items in Square	Yes
Shopify Variant ID ↔ Square Item Variation ID	Keep individual product variants in sync with their Square counterparts	Yes
Shopify Customer ID ↔ Square Customer ID	Avoid duplicate customers on re-sync; update existing customers in Square	Yes
Sync logs (per-record: type, action, Shopify ID, Square ID, status, error)	Show sync history and diagnose issues	Yes
Merchant account name & email (from Shopify session)	Stored as part of the Shopify OAuth session	Yes

3.2 From Your Shopify Customers & Products

SquareFloww does not permanently store the personal data of your customers or the content of your products. Product and customer data is read from Shopify, passed directly to Square (or vice versa during a fetch), and is not written to our database — only cross-platform ID mappings are stored.

The only persistent records we store for your customers and products are:

Shopify Product ID ↔ Square Item ID / Variation ID (for product sync continuity)
Shopify Customer ID ↔ Square Customer ID (for customer sync continuity)

3.3 What We Do Not Collect

No payment card data No passwords No browsing behaviour No marketing cookies No analytics tracking No order data

4. How We Use Data

RippleStep uses data collected through SquareFloww exclusively to:

Authenticate with Shopify and Square on your behalf
Push selected Shopify products and customers to Square
Fetch selected Square products and customers into Shopify
Maintain cross-platform ID mappings to prevent duplicate records on re-sync
Display sync history and status within the app
Diagnose errors and improve reliability

We do not use your data for advertising, profiling, or any purpose unrelated to SquareFloww.

5. Data Sharing & Third Parties

RippleStep shares data only with services required to operate SquareFloww:

Service	Purpose	Data shared
Shopify	Source platform for store data, auth, and product/customer APIs	Read/write via Shopify Admin API (products, customers)
Square	Destination/source platform for POS and catalog data	Read/write via Square API (catalog, customers, orders)
Fly.io	Cloud hosting & database	Hosts our application server and encrypted database

RippleStep does not sell, rent, or share your data with any other third parties, advertising networks, or data brokers.

6. Data Storage & Security

All data is stored on Fly.io infrastructure (EU/US regions).
Square OAuth tokens are encrypted at rest using AES-256-GCM before being written to the database.
All data in transit is protected by TLS 1.2+.
Database access is restricted to the application server only.
No sensitive credentials are stored in source code or logs.
Currency mismatch detection: SquareFloww verifies that Shopify's store currency matches the Square catalog currency before pushing products, ensuring prices are not incorrectly applied.

7. Data Retention

We retain your data for as long as SquareFloww is installed on your store.

On uninstall: When SquareFloww is uninstalled, we immediately delete your Shopify session, Square OAuth tokens, all product and customer sync links (SyncProductLink and SyncCustomerLink), and sync logs on receipt of the app/uninstalled webhook.
Shop erasure: Shopify sends a shop/redact webhook approximately 48 hours after uninstall. We permanently delete any remaining shop data at that point as a safeguard.
Customer erasure requests: On customers/redact, we immediately delete that customer's ID mapping and related sync log entries.

8. Cookies

SquareFloww uses only strictly necessary cookies. We do not use advertising, analytics, or tracking cookies.

Cookie	Purpose	Type
Shopify session cookie	Maintains your authenticated session inside Shopify Admin. Set by the Shopify App Bridge framework.	Strictly necessary
OAuth state cookie	Short-lived CSRF token used during the Square OAuth flow. Expires immediately after connection.	Strictly necessary

No cookie consent banner is required. Disabling session cookies will prevent the app from functioning.

9. International Data Transfers

SquareFloww is hosted on Fly.io, which operates infrastructure in the United States and European Union. If you are in the EEA, UK, or Switzerland, your data may be transferred to the United States.

Transfers are protected by:

Fly.io — Data Processing Agreement incorporating EU Standard Contractual Clauses (SCCs).
Square — certified under applicable data transfer frameworks with its own DPA.
Shopify — data processed under Shopify's API data handling commitments.

10. CCPA – California Residents

Under the CCPA and CPRA, California residents have the right to:

Know — request disclosure of categories and pieces of personal information collected.
Delete — request deletion of personal information, subject to exceptions.
Correct — request correction of inaccurate personal information.
Opt-Out of Sale — we do not sell or share personal information. No opt-out needed.
Non-Discrimination — we will not discriminate for exercising CCPA rights.

RippleStep does not sell personal information collected through SquareFloww and does not share it for advertising purposes.

Categories collected

Category (CCPA)	Examples	Collected?
Identifiers	Shop domain, Shopify/Square IDs	Yes
Commercial information	Product ID ↔ Item ID links, Customer ID ↔ Square ID links	Yes (IDs only)
Internet / network activity	Browsing history, interaction data	No
Geolocation data	Precise location	No
Sensitive personal information	Financial data, health data, SSN	No

To submit a CCPA request, email support@ripplestep.com with subject "CCPA Request". We respond within 45 days.

11. GDPR & Your Rights

If you are in the EEA, UK, or Switzerland, you have the following rights under GDPR:

Right of access — request a copy of data we hold about you
Right to rectification — request correction of inaccurate data
Right to erasure — request deletion of your data
Right to restrict processing — limit how we use your data
Right to data portability — receive your data in a portable format
Right to object — object to processing based on legitimate interests

Legal basis for processing

Merchant data is processed on the basis of contract. Cross-platform ID mappings (product links, customer links) are processed on the basis of legitimate interest in preventing duplicate records and enabling reliable bidirectional updates.

12. Shopify Merchants

As a merchant using SquareFloww, you are responsible for ensuring your use of the app complies with applicable privacy laws and your own privacy policy, particularly regarding how your customers' data is shared with Square.

SquareFloww is built in accordance with Shopify's API Terms of Service and the Partner Program Agreement.

13. Children's Privacy

SquareFloww is a business-to-business service intended for Shopify merchants. We do not knowingly collect any data from or about children under the age of 13.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we update the "Last updated" date at the top of this page. For significant changes, we notify merchants via the SquareFloww app interface. Continued use constitutes acceptance of the updated policy.

15. Contact Us

For questions, concerns, or requests regarding this Privacy Policy:

Email: support@ripplestep.com
Website: ripplestep.com

We aim to respond within 5 business days.