Privacy Policy

B2B Extended · Effective July 22, 2026

B2B Extended (the “App”) is a Shopify application operated by Sutherland Ventures LLC (“we”, “us”, “our”), a Virginia, USA limited liability company. The App lets Shopify merchants (“Merchants”) collect and approve dealer/wholesale applications and offer a gated bulk order form to approved buyers (“Dealers”). This policy explains what information the App collects, how it is used, and the choices available to Merchants and Dealers. It applies to the App and to the pages the App serves (including storefront pages served through the Shopify app proxy and this website).

Information we collect

From Merchants (via Shopify and the App’s admin):

• Store identifiers and credentials needed to operate the App: the store’s myshopify.com domain and an API access token issued by Shopify.
• App configuration entered by the Merchant: form questions, notification email address, appearance and order form settings.
• Billing status for the App subscription, retrieved from Shopify (store identifier and subscription state).

From Dealers, on the Merchant’s behalf (via the application form):

• Name, email address, company name, shipping address, optional billing address and phone number, and answers to the questions the Merchant has added to their application form.

From logged-in customers using the bulk order form:

• The Shopify customer ID provided by Shopify’s app proxy, used only to check approval status. Order lines (SKUs and quantities) are processed to validate the order and build a Shopify cart; they are not stored by the App after the page is served.

The App does not collect payment or card information (checkout is handled entirely by Shopify), does not use advertising or cross-site tracking technologies, and does not sell personal information.

How we use information

• To operate the App for the Merchant: display and manage dealer applications, and—when the Merchant approves an application—create or update the corresponding customer, company, tags, notes, and metafields in the Merchant’s Shopify store.
• To gate the bulk order form to approved Dealers and validate and price order lines.
• To send the Merchant a notification email when a new application is submitted (the App’s only outbound email; nothing is emailed to Dealers).
• To verify the Merchant’s App subscription and to provide support.

We do not use collected information for advertising, profiling, or any purpose unrelated to operating the App.

Our role

For Dealer application data, the Merchant is the data controller (or “business” under US state privacy laws) and we act as a processor/service provider operating on the Merchant’s instructions. Dealers should direct requests about their data to the Merchant they applied to; we support Merchants in fulfilling those requests as described below.

Sharing and service providers

We share information only with the service providers required to run the App:

• Shopify — the commerce platform the App runs on (Shopify’s privacy policy).
• Railway — application hosting and database infrastructure (United States).
• Resend — delivery of the Merchant notification email.

We may also disclose information if required by law or to protect our rights, safety, or property. We do not sell or share personal information for advertising.

Data retention and deletion

• Application data and settings are retained while the App is installed on the Merchant’s store.
• When a Merchant uninstalls the App, we honor Shopify’s shop/redact request and delete the store’s data, including all dealer applications, settings, and stored questions.
• When a customer requests erasure through Shopify, we honor the customers/redact request and delete that person’s applications. We likewise respond to Shopify’s customers/data_request by providing the Merchant a summary of the data held.
• Merchants and Dealers may also contact us directly (below) to request access, correction, or deletion.

Security

Data is encrypted in transit (TLS) and stored on managed infrastructure with access limited to what is needed to operate and support the App. Webhooks from Shopify are verified with HMAC signatures. No method of transmission or storage is completely secure, but we work to protect the information we process.

International data transfers

We are a United States business and process and store data in the United States. If you use the App from outside the US (including the EEA or UK), your information will be transferred to and processed in the US. Where GDPR or UK GDPR applies, we process personal data on the Merchant’s documented instructions and support the rights described below.

Your privacy rights

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal data, and to object to or restrict certain processing. This includes rights under the EU/UK GDPR and under US state privacy laws such as the Virginia Consumer Data Protection Act and the California Consumer Privacy Act. We do not discriminate against anyone for exercising privacy rights.

Dealers: because your data is held on behalf of the Merchant you applied to, the fastest path is to contact that Merchant; we will assist them in fulfilling your request. You can also contact us directly and we will refer the request to the relevant Merchant or act on it where we are able.

If you are a Virginia resident and we decline to act on a request, you may appeal by replying to our decision or emailing us with “Privacy appeal” in the subject line; we will respond within the period required by law.

Children

The App is a business-to-business tool and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us personal information, contact us and we will delete it.

Changes to this policy

We may update this policy from time to time. The effective date above reflects the latest revision; material changes will be reflected on this page.