1. SCOPE

This Privacy Policy describes how OnAccount ("the App"), developed
and operated by Molsoft Inc. ("Molsoft," "we," "us," "our"), a
company headquartered in Montreal, Quebec, Canada, handles data when
a merchant installs the App from the Shopify App Store and uses it
in connection with their Shopify store.

This policy covers OnAccount. OnAccount shares backend
infrastructure with Molsoft's B2B POS app, including a common
session/authentication table, and OnAccount data may be read by
B2B POS via merchant-owned metafields. Where the two apps diverge in
what personal data they collect and how they use it, each app's own
privacy policy governs that app's use.

2. ROLES: WHO CONTROLS WHAT

Molsoft acts as a data processor on behalf of the merchant (the data
controller) for buyer, order, and approval data described in Section
3(b)-(f). For the merchant account owner's own contact information
(Section 3(i)), Molsoft acts as a data controller in its own right,
since that data is used to manage Molsoft's business relationship
with the merchant.

3. INFORMATION WE COLLECT AND STORE

OnAccount stores more data than a typical utility app because its
core function — B2B credit, approvals, and account-based purchasing
— requires persisting buyer identities, approval workflows, and
order-level financial data. The categories below reflect what is
actually written to our database; everything else about a buyer or
order is resolved live against Shopify's API rather than duplicated.

a) Merchant account authentication
   - OAuth access token, refresh token, storefront access token
   - Shop domain, app owner, subscription plan and billing tier
     metadata

b) Company buyer contact data
   - Buyer email address — encrypted (see Section 6) and never
     indexed in plaintext
   - Shopify customer, contact, and company identifiers
     (pseudonymous references, resolved live against Shopify for
     display name and other profile detail)
   - Role flags — whether the contact is a company administrator or
     a finance-permissioned user
   - Onboarding status and the timestamp an onboarding email was
     sent

c) Purchase and approval workflow data
   - Identifiers for the person who initiated a purchase request
     and the person(s) authorized to approve it
   - Approval records (who approved, when), pending/waiting status,
     and which spend rule triggered the request
   - A reference to the associated draft order and a snapshot of
     what was being purchased at the time of the request
   - Where applicable, a free-text reason entered by an approver
     when rejecting or flagging a request

d) Audit log
   - The identifier and display name of the person who took an
     action, and the type of actor (e.g., buyer, company admin,
     merchant staff)
   - The action taken, its target, and which company/location/order
     it relates to
   - Free-text comment content — this field is user-authored and
     may contain any information the person who wrote it chose to
     include

e) B2B order and financial data
   - Identifiers for the purchasing company, location, and contact
     associated with each order
   - Order references, outstanding/total/pending balances (in shop
     and presentment currency), payment status, fulfillment status,
     payment terms, and due dates
   - Lump-sum payment allocations across orders, by company and
     location, with amounts in both currencies

f) Approval rules and routing
   - Identifiers for approvers and fallback approvers used to route
     purchase requests
   - Rule configuration (spend thresholds, quantity/period limits,
     currency) — this configuration itself is not personal data

g) Statement recipient data
   - Up to 20 email addresses per company, entered by a company
     administrator, to receive monthly account statements —
     encrypted (see Section 6), along with last-send status
   - The statement emails themselves contain order numbers, PO
     numbers, invoice totals, and payment due dates

h) Shop-level configuration
   Merchant business and branding settings — default module
   configuration, email sender name and reply-to address, logo, and
   accent color. This is merchant business data, not personal data.

i) Merchant account owner & business relationship data
   - On app install and uninstall, the merchant account owner's
     name and email address, along with the shop name and domain,
     are sent to our CRM (HubSpot) and recorded as a contact,
     company, and deal. Uninstall marks the associated deal as Lost.
   - The App's dashboard loads a chat support widget (Crisp) using
     the merchant's email, shop name and domain, plan name,
     development-store flag, and subscription state. This creates a
     corresponding profile in Crisp and sets cookies in the Shopify
     admin. Install and uninstall events are also sent to Crisp and
     may trigger automated emails to the merchant.

j) Operational and transient data
   Short-lived data with native expiry, including OAuth session
   state, currency exchange rate caching, and sync job telemetry
   (which may hold an initiator identifier). This data is
   automatically purged on expiry.

OnAccount does not collect, process, or store raw payment card or
bank account numbers. Financial data described in Section 3(e)-(g)
consists of balances, terms, and status derived from Shopify order
and payment data — actual payment collection is handled by
Shopify's own payment infrastructure.

4. HOW WE USE THIS INFORMATION

- Authenticate the App's connection to the merchant's store;
- Operate B2B credit limit enforcement, approval routing, and
  purchase request workflows;
- Send transactional onboarding, workflow, and statement emails to
  buyers, approvers, and statement recipients;
- Reconcile outstanding balances and lump-sum payments against
  Shopify orders;
- Maintain an audit trail of approval and account activity for the
  merchant's own compliance and dispute-resolution purposes;
- Manage our own business relationship with the merchant, including
  sales, account management, and support, using the merchant account
  owner's contact information in our CRM (HubSpot) and support
  platform (Crisp);
- Provide support and troubleshoot issues at a merchant's request.

We do not sell buyer or company data, and we do not use buyer or
company data for advertising or profiling. The merchant account
owner's own contact information is used in our CRM for our sales and
account management purposes, as described above.

5. LEGAL BASIS FOR PROCESSING (GDPR / UK GDPR)

- Performance of a contract (Art. 6(1)(b)) — processing buyer and
  approval data is necessary to provide the credit and approval
  functionality the merchant installed the App for;
- Legitimate interests (Art. 6(1)(f)) — maintaining an audit trail
  and fraud prevention during the period the App is installed;
  managing our business relationship with the merchant account
  owner via our CRM and support tooling.

A Data Processing Addendum is available to merchants on request via
the contact details in Section 14.

6. DATA STORAGE AND SECURITY

- Storage location: Data is hosted on cloud infrastructure located
  in North America.
- Encryption: Buyer email addresses and statement recipient emails
  are encrypted at the application layer, with the encryption key
  held in a managed secrets store. The underlying databases are
  separately encrypted at rest by the cloud provider.
- Access control: Access to production data stores is restricted to
  authorized Molsoft personnel on a need-to-know basis.

7. DATA RETENTION

Uninstalling the App deletes only the App's authentication session
for that store. All other data described in Section 3 — buyer
contacts, purchase requests, audit logs, financial data, rules, and
statement configuration — is deliberately left in place after
uninstall, so that reinstalling the App restores the merchant's full
account state.

Approximately 48 hours after uninstall, Shopify sends a shop/redact
webhook. On receipt, Molsoft permanently deletes all remaining data
for that shop: the order mirror, purchase requests, audit log, rules
and assignments, company contact enrichment, lump-sum allocations,
statement configuration, onboarding state, and cached exchange
rates. No financial, audit, or buyer data is retained after this
point. A subsequent reinstall starts with an empty account.

8. SUBPROCESSORS AND THIRD-PARTY SHARING

We do not sell or rent data. We share the data described in Section
3 only with the following subprocessors:

  Subprocessor              | Data shared                    | Purpose
  ---------------------------|---------------------------------|------------------------------
  Cloud infrastructure       | All data described in Section 3 | Hosting and database storage
  provider (North America)   |                                  |
  Shopify Inc.                | Order, company, customer, and   | Platform on which the App
                               | billing data                     | operates
  HubSpot (United States)     | Merchant account owner name,    | CRM — sales and account
                               | email, shop name and domain      | management
  Crisp (European Union)      | Merchant email, shop name and   | Support chat widget;
                               | domain, plan name, dev-store     | automated onboarding/
                               | flag, subscription state         | lifecycle emails

Crisp is hosted in the European Union; merchant account owner data
described above is transferred there as part of using this
subprocessor. See Section 11.

9. YOUR RIGHTS

Merchants, buyers, and company contacts may have the right to
request access to, correction of, or deletion of personal data we
hold; to object to or restrict certain processing; to data
portability where applicable; and to lodge a complaint with a
supervisory authority.

For buyers and company contacts, a deletion request results in the
company contact enrichment record being permanently deleted, and, in
the audit log, that person's display name and any free-text comments
they authored being removed. Actions that person is recorded as
having taken remain in the audit log in de-identified form, and
approvals or other records that person is referenced in on other
people's requests (for example, an approval they gave on someone
else's purchase request) are not altered, as they form part of the
transactional record of that other request. Comments authored by
other people are not affected by your deletion request.

Requests can be made to hello@molsoft.io.

10. SHOPIFY COMPLIANCE WEBHOOKS

In accordance with Shopify App Store requirements, Molsoft honors
the mandatory compliance webhooks: customers/data_request,
customers/redact, and shop/redact.

customers/redact: Molsoft permanently deletes the requested buyer's
company contact enrichment record. In the audit log, entries where
that person is the actor have their display name replaced and any
free-text comment body removed. As described in Section 9, records
of that person's involvement in other people's requests (such as
approvals they gave) are not altered, and this is a known scope
limitation of the current implementation.

shop/redact: fires approximately 48 hours after a merchant uninstalls
the App. On receipt, Molsoft purges all remaining data for that shop
as described in Section 7 — no financial, audit, or buyer data is
retained afterward.

11. INTERNATIONAL DATA TRANSFERS

Merchant account owner data shared with Crisp (Section 8) is
transferred to and processed in the European Union. Where data is
transferred outside a merchant's, buyer's, or end user's
jurisdiction, Molsoft relies on Standard Contractual Clauses or
other lawful transfer mechanisms as applicable to ensure an adequate
level of protection.

12. CHILDREN'S PRIVACY

The App is intended for use by business merchants, their authorized
staff, and their business buyers only. It is not directed at, and we
do not knowingly collect data from, individuals under the age of 16.

13. CHANGES TO THIS POLICY

We may update this policy from time to time. Material changes will
be reflected by an updated "Last Updated" date at the top of this
page.

14. CONTACT US

Molsoft Inc.
Montreal, Quebec, Canada
Email: hello@molsoft.io