Privacy Policy
CK4Life Wholesale is a Shopify app that applies per-account wholesale pricing to approved customers of the store that installs it. This policy explains what the app stores, what it does not, and the rights available to you.
Last updated 13 August 2026
Who we are
The app is operated by Modern Labyrinth (23011 Moulton Pkwy Suite C-12, Laguna Hills, CA 92653), which is responsible for the data described here. Contact us at Contact@modernlabyrinth.com.
The app is built for, and branded on behalf of, the merchant whose store it is installed on. For data held inside that merchant’s Shopify store, the merchant is the data controller and we act as their processor under our agreement with them. For the install record described below, which we hold to operate the app, we act as controller.
What the app stores
When a merchant installs the app, we store one record per store, containing only what is needed to make authenticated calls to that store’s Shopify Admin API:
- Store domain, for example my-store.myshopify.com.
- An offline access token and its refresh token, issued by Shopify at install.
- The permissions granted at install. The app requests one: permission to manage discounts.
We rely on this record to perform our contract with the merchant. It is the minimum required for the app to function; without it the app cannot authenticate and does nothing.
What the app does not store
The app does not collect or retain customer names, email addresses, postal addresses, phone numbers, payment details, or order history, and stores no personal information about a store’s shoppers or staff. It requests no customer access scopes — its only permission is to manage discounts — and requests none of these protected customer fields. Its pricing logic reads a customer’s wholesale tag and wholesale rates inside Shopify, as described below.
What the pricing logic reads
Wholesale pricing is applied by Shopify Functions, which run inside Shopify’s own infrastructure when a cart is priced. For a signed-in customer they read only:
- Whether the customer carries the wholesale tag.
- The customer’s wholesale rates metafield, which the merchant sets.
- A product’s wholesale category metafield, which the merchant sets.
These values are read at the moment of pricing and are never copied out of Shopify or stored by us. If a customer has no rates set, the app applies no discount and normal retail pricing stands.
Where data is held
The app runs on Vercel and stores its install records in a Neon PostgreSQL database hosted in the United States. Both act as service providers to us and process this data only to operate the app. We do not sell data, and we share none of it for advertising or analytics.
Our hosting provider also keeps short-lived operational logs that may record a store’s domain and error diagnostics. These are used only to operate and debug the app, are retained for approximately 30 days, and contain no access tokens or customer information.
The app is intended for merchants operating in the United States, and all of its infrastructure is located there. If you are considering installing it from outside the United States, contact us first so we can confirm an appropriate basis for transferring the install record described above.
Security
All traffic to the app is encrypted in transit using TLS, and the database encrypts data at rest. Access tokens are stored only in the install record and are never written to logs. Access to production systems is limited to personnel who need it to operate the app.
Retention and deletion
We keep the install record only while the app remains installed. When Shopify notifies us that a merchant has uninstalled the app, we delete that store’s install record, including its access and refresh tokens. Shopify also sends a shop redaction request 48 hours after uninstall, which we handle the same way, so the record is removed even if the first notification does not arrive. Merchant settings such as wholesale rates live on the merchant’s own Shopify store, belong to them, and are unaffected by uninstalling.
The app also implements Shopify’s mandatory data request, customer redaction, and shop redaction webhooks. Because no customer personal data is stored, a customer redaction or data request has nothing to return or erase, and we acknowledge it to Shopify on receipt. A shop redaction deletes the store’s install record.
Your rights
Depending on where you live, you may have the right to access a copy of your personal data, to have it corrected or erased, to restrict or object to how we use it, and to receive it in a portable format. To exercise any of these, email Contact@modernlabyrinth.com and we will respond within the period required by applicable law.
If you are a shopper on a store using this app, we hold no personal data about you, so requests are best directed to the merchant, who controls the data in their Shopify store. We will assist them in responding.
If you are in the European Economic Area or the United Kingdom, you also have the right to lodge a complaint with your local data protection supervisory authority. If you are a California resident, you have the right to know what personal information is collected, to request its deletion, and not to be discriminated against for exercising those rights. We do not sell or share personal information as those terms are defined under California law.
Data breaches
If a breach affects the data described in this policy, we will notify affected merchants and, where required, the relevant supervisory authority, without undue delay after becoming aware of it.
Changes to this policy
If we change how the app handles data, we will update this page and the date at the top. Where a change materially affects merchants, we will notify them by email at the address associated with their store.
Contact
For questions about this policy, or to make a data request, email Contact@modernlabyrinth.com. Merchants may also raise requests through Shopify, which we will action through the webhooks described above.