Privacy policy

ISBNScan looks up a book by ISBN and, when you choose, adds that book to your Shopify catalog as a draft or a published product. This policy explains what information that involves, where it goes, and how long it is kept.

It applies to merchants and staff who install or open the app. It also explains how we handle privacy requests about a store’s customers. ISBNScan does not run on your storefront and does not have its own customer accounts.

ISBNScan - Books Importer (“ISBNScan”, “we”). Last updated: November 2, 2026.

01 What the app does

You enter an ISBN. We show the book details in the app. You can edit the title, description, price, and publisher, then save the book as a draft or publish it to your sales channels.

02 Information you provide

When you use the app, we process:

  • The ISBN you enter
  • The title, description, price, and publisher you submit
  • Your choice to save a draft or publish

We use this information to look up the book and, if you ask us to, create the product in your store. We do not write the ISBN, the book details, or the price to our database.

Author, publication date, page count, and language are shown in the app. They are saved on the product only when they are part of the description you submit.

03 Information from Shopify

Shopify grants the app permission to manage products and to publish them to your sales channels. The app uses that permission to:

  • Read your shop’s currency code, so the price field can show the right currency. We do not store the currency code.
  • Search your catalog for a product that already uses the same ISBN
  • Create a book product with the title, description, publisher, subject tags, price, ISBN barcode, ISBN as the SKU, and cover image
  • Publish that product to your sales channels when you choose Publish

The app does not request access to customers, orders, or checkout data, and it does not read those records.

04 What we store

Our database stores the Shopify session that keeps the app connected to your shop. A session includes:

  • Your shop domain
  • The access token and refresh token used to call the Shopify Admin API
  • The permissions granted to the app
  • Session status and expiry

If Shopify includes them on the session, the same record can also include the staff member’s name, email address, Shopify user ID, locale, and whether that person is the account owner or a collaborator.

Sessions are stored in a PostgreSQL database so the app can keep working after you install it.

05 What we do not collect

  • We do not store store customer, order, or checkout data.
  • We do not store ISBN lookups or book records in our database.
  • We do not sell personal information.
  • We do not use information for advertising or for any purpose other than running the app.
  • The app code does not set analytics or advertising cookies.

06 Logs

When Shopify sends a webhook, the app writes the shop domain and the webhook topic to the server log. If a page fails to render, the app writes the error to the server log. The app does not write ISBNs or book details to those logs. The app does not set how long logs are kept. That depends on the host that runs the app.

07 How long we keep information

  • Book lookups and the fields you type are handled for that request. They are not saved in our database.
  • Session records are kept while the app is installed.
  • A product you create is stored by Shopify in your store. It remains there after you uninstall ISBNScan. Uninstalling the app does not delete products.

08 Uninstall and privacy requests

When you uninstall the app, Shopify notifies us. If that notice still includes a session, we delete the session records for that shop.

About 48 hours after uninstall, Shopify sends a shop deletion request (shop/redact). We delete any session records still stored for that shop.

Shopify can also send two customer privacy requests:

  • customers/data_request — a customer asks to see data an app holds about them
  • customers/redact — a customer asks an app to delete data it holds about them

We accept each request and respond to Shopify. ISBNScan does not store store-customer data, so these requests do not produce a file to send and do not delete customer records. The customer details in the request are not saved in our database. Shopify asks apps to finish a privacy request within 30 days. Because we do not keep customer data, there is nothing further to send or erase.

09 Security

The app is served over HTTPS. Shopify signs webhook requests, and the app rejects a webhook that fails that check. Calls to the Shopify Admin API run only after Shopify has authenticated the merchant.

Access tokens are stored in our database so the app can stay connected. The app does not apply a separate encryption step to those tokens. Protection of the database depends on the database provider.

10 Your requests

To ask what session data we hold, or to ask us to delete it, contact the support address on the ISBNScan listing in the Shopify App Store. You can also uninstall the app. Uninstalling deletes the session as described above. It does not delete products already saved in your Shopify admin.

11 Children

ISBNScan is a tool for Shopify merchants. It is not directed at children, and we do not knowingly collect personal information from children.

12 Changes

If we change this policy, we will update this page and the date above.

13 Contact

Questions about this policy can be sent to the support address on the ISBNScan listing in the Shopify App Store.