Privacy Policy

1. Introduction

Blended Customs LLC ("we," "us," or "our") operates the SBA Toolbox desktop application and the website at sbatoolkit.com (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

2. Information We Collect

2.1 Information You Provide

• Account registration details (name, email address, company name)
• License keys and activation data
• Support requests and communications
• Payment information (processed securely by PayPal; we do not store payment card details)

2.2 Information Collected Automatically

• Machine identifier (a hashed hardware ID used solely for license activation)
• Application version and usage analytics (feature usage, error reports)
• IP address and basic device information when accessing our website

2.3 Shopify Store Data

When you connect a Shopify store through our application, we access the following data via the Shopify API with your explicit authorization:

• Product listings (titles, descriptions, variants, images, SKUs, prices)
• Order information (order numbers, line items, fulfillment status)
• Customer information (names, email addresses, shipping addresses) — accessed only as needed to process orders
• Inventory levels and shipping information

Shopify store access tokens are stored securely on our servers and are never exposed to end-user devices. Access tokens are encrypted at rest and transmitted only over HTTPS.

3. How We Use Your Information

• To provide, maintain, and improve the Service
• To verify and manage software licenses
• To process transactions and send related information
• To facilitate Shopify store integrations (product management, order processing)
• To respond to your inquiries and provide customer support
• To send administrative communications (updates, security alerts)
• To detect and prevent fraud or unauthorized access

4. Data Sharing and Disclosure

We do not sell, trade, or rent your personal information to third parties. We may share information in the following limited circumstances:

• Service providers: We use Supabase (database hosting), Netlify (website hosting), and PayPal (payment processing) to operate the Service. These providers access only the data necessary to perform their functions.
• Shopify: We interact with Shopify's API on your behalf using access tokens you authorize. We do not share your Shopify data with any other third party.
• Legal requirements: We may disclose information if required by law, regulation, or legal process.
• Business transfers: In the event of a merger, acquisition, or sale of assets, user data may be transferred as part of the transaction.

5. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service. When you disconnect a Shopify store, we deactivate the stored access token. You may request deletion of your account and associated data at any time by contacting us at sales@sbatoolkit.com.

6. Data Security

We implement industry-standard security measures to protect your data, including:

• Encryption in transit (TLS/HTTPS) and at rest
• Row-level security (RLS) policies on our database
• Server-side token storage — API credentials never reach client devices
• Session-based authentication with automatic expiration
• Machine-level license binding to prevent unauthorized sharing

7. Your Rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Object to or restrict processing of your data
• Request data portability
• Withdraw consent at any time (for consent-based processing)

To exercise any of these rights, contact us at sales@sbatoolkit.com.

8. Cookies

Our website uses minimal cookies for session management and authentication. We do not use third-party advertising cookies or tracking pixels.

9. Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a revised "Last updated" date. Your continued use of the Service after changes constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at: