Privacy Policy

Last updated: November 2, 2026

This policy explains what Bordaro ("Bordaro", "we", "us") collects when you use the Bordaro financial dashboard at https://bordaro.app (the "Service"), why, who we share it with, how long we keep it, and the choices you have. Bordaro is a business tool: a company ("your organization") connects its own Shopify store, QuickBooks Online company and bank accounts so its team can see its finances in one place.

1. Our role

Your account and usage data (Sections 2.1 and 2.4): we decide how it is used and are responsible for it (the "controller").
Your organization's business data from connected services (Section 2.2): your organization controls it. We process it only to provide the Service to your organization (as its "processor" or "service provider").

2. What we collect

2.1 Account information

Email address and password. Your password is stored only as a secure hash by our authentication provider; we never see it. We do not ask for your name.
Your organization and role. The workspace you belong to and whether you are an admin or a viewer.
Opening Bordaro inside the Shopify admin. Shopify sends a short-lived signed token that names the store and the staff account using it. We check the token to confirm the store, and don't store the staff account. Everyone who opens Bordaro from that store's Shopify admin uses one shared "Shopify admin access" member of the store's workspace, with admin rights. It has no password, and its placeholder email address isn't used to send mail. Shopify's staff permissions control who can open Bordaro there.
Getting your own login from inside Shopify. When you open Settings inside the Shopify admin, we ask Shopify for the email address on your Shopify staff account, whether Shopify has verified it, and whether you are the store's owner. We use this only to show what the "Use Bordaro outside Shopify" options will do for you, and we don't store it unless you act on one. If you click "Create my bordaro.app login" and Shopify has verified your email, we create a Bordaro login with it and send you an email to set a password. The store owner's login is an admin; other staff get a viewer login, which an admin can change in Settings. Only the store owner, or an existing admin of the store's workspace, can move the store to another Bordaro workspace.
Feedback you send through the in-app feedback form: its category, your message and the page you were on.

2.2 Business data from services your organization connects

An admin of your organization chooses which services to connect. For each one we store the access credentials the service issues (never your password for that service) and the data below.

Shopify — your store's address, and for each order: Shopify's order ID, date, subtotal, sales channel, and line items (product title, SKU, quantity and price). For refunds: date, amount, the refunded line items and the refund's note. We also read, without storing, each order's number, status (to leave out cancelled and voided orders) and tags, and your products' tags (to attribute sales to creators). We do not request or store your shoppers' names, email addresses, phone numbers or addresses. Free-text fields such as refund notes are stored as written in Shopify, so they could contain whatever your staff typed there.
QuickBooks Online — your company ID, and for each expense (purchases and bills): date, amount, vendor name, memo, category, and the account and class of each line. Vendor names and memos may identify a person if your books record them that way.
Bank accounts, through Plaid — the bank's name, each account's name, type and last four digits, and a daily balance. We do not receive or store full account or routing numbers, and we never see your bank login. Plaid handles that connection under its own privacy policy.

From this data we compute your dashboards: revenue, expenses, cash, contribution profit per creator, alerts when a metric moves unusually, and a record of each sync.

2.3 AI summaries

When AI summaries are turned on and you open one, we send Anthropic's Claude API only the figures behind that card: the metric, its current and prior value, the percentage change, a short series of trend points, the time period and when data last synced. No orders, line items, vendor names, account names or personal information are sent. Anthropic does not use data sent through its commercial API to train its models. The summary is stored for up to 4 hours so the same question isn't sent twice. Summaries describe your data; they are not financial advice.

2.4 Usage and technical data

Product analytics (PostHog), only if you accept analytics cookies. Pages you view and features you use (for example which dashboard cards you open), browser and device type, and IP address. Once you sign in we also link this activity to your email address, role and organization. If you decline, or until you choose, no analytics are collected at all.
Error reports (Sentry). When something fails, we receive technical details such as the page, browser type, the error and, for some errors, your organization's ID or store address, so we can fix it. Performance timings are sampled. Session recording is off.
Server logs (Vercel). Our host keeps standard request logs, including IP addresses, for security and operations.

3. Why we use it, and our legal bases

To provide the Service: sign you in, sync and display your organization's data, send account emails (confirmation, password reset, team invitations) — necessary to perform our contract with you or your organization.
To keep the Service secure and working, fix errors, and detect failed syncs — our legitimate interest in running a reliable, secure service.
To understand how the product is used and improve it — your consent (analytics).
To respond to you, and to meet legal obligations.

We do not sell personal information, share it for cross-context behavioral advertising, or use it for advertising of any kind.

4. Who we share it with

Only the service providers that run Bordaro, each for its stated purpose, and the services your organization chooses to connect:

Supabase — database and sign-in; sends account emails (confirmation, password reset, invitations).
Vercel — hosting.
PostHog — product analytics, only with your consent.
Sentry — error monitoring.
Anthropic — AI summaries (Section 2.3).
Resend — delivers internal alerts to the Bordaro operator when a sync fails (the service name, error message and your organization's ID).
Shopify, Intuit (QuickBooks) and Plaid — the services your organization connects; we exchange data with them to sync it.

Within your organization, admins and viewers can see its dashboards; only admins can manage connections and invite people. We may also disclose information if the law requires it, to protect the rights or safety of Bordaro or others, or to a successor in a merger or sale of the business, which would remain bound by this policy.

5. Cookies and browser storage

Strictly necessary (no consent needed): your sign-in session (Supabase cookies); short-lived security cookies used while connecting Shopify or QuickBooks (expire within minutes); an encrypted cookie that holds a Shopify install for up to 30 minutes while you sign up or sign in; an encrypted cookie, valid for up to 20 minutes, that lets the QuickBooks window opened from the Shopify admin finish connecting; your cookie choice and your light/dark theme (stored in your browser only).
Analytics (off until you click "Accept"): PostHog cookies and local storage.

To change your choice, clear this site's data in your browser; the banner appears again.

6. How long we keep it

Shopify data: while the store is connected. If Bordaro is uninstalled from the store, its data and credentials are permanently deleted 48 hours later unless the store is reconnected first. An admin can delete it sooner with "Delete data now".
QuickBooks and bank data: while your organization uses Bordaro. An admin signed in at bordaro.app can disconnect either one in Settings, which ends our access and permanently deletes that data. You can also email us (Section 8); we delete it within 30 days.
Your account: while your organization uses Bordaro. To have it deleted, email us (Section 8); we delete it within 30 days.
AI summaries: replaced at least every 4 hours, and deleted with your Shopify data.
Analytics, error reports and logs: for the retention periods set by PostHog, Sentry and Vercel.

Deleted data may remain in our database provider's backups until those backups expire.

7. Security

All traffic is encrypted in transit (HTTPS).
Our database providers encrypt stored data at rest.
Every row of business data is tied to one organization, and database access rules stop any organization from reading another's data.
Connection credentials are never shown in the app and are readable only by our servers, not by anyone signed in to Bordaro, including your organization's admins.

No system is perfectly secure. If a breach affects your personal information, we will notify you and the relevant authorities as the law requires.

8. Your rights

Depending on where you live (for example the EU, UK or California), you may have the right to access, correct, delete or receive a copy of your personal information, to object to or restrict how we use it, and to withdraw consent at any time (for analytics, by clearing site data as in Section 5). Email support@bordaro.app. We will confirm your identity and answer within the time the law allows (generally 30 days for GDPR requests, 45 days for California requests). We will not treat you differently for using these rights. You may also complain to your local data protection authority.

Your organization controls its business data. If you are a team member, or a customer of a store that uses Bordaro, we may pass your request to that organization. Shopify forwards shoppers' data and deletion requests to us; because we store no shopper contact details, we have no shopper personal data to return or delete beyond what Section 2.2 describes.

9. Where data is processed

Bordaro is operated from the United States, and our database and hosting are in the United States. If you use the Service from elsewhere, your information is transferred to and processed in the U.S.

10. Children

Bordaro is for businesses and is not directed to anyone under 18. We do not knowingly collect personal information from children.

11. Changes

When we change this policy we will post the new version here and update the date above. For material changes we will tell account holders by email or in the app before they take effect.

12. Contact

Bordaro · support@bordaro.app