Privacy Policy

Last updated: 22 October 2026

App name: INVA

Operated by: Inva Labs, a company registered in Israel.

1. Introduction

INVA (“INVA”, “we”, “us”, or “our”) provides an inventory management application for merchants who use the Shopify platform (the “Service”). This Privacy Policy explains what information we collect, how we use it, and the rights you have regarding that information.

This policy is written for two audiences:

Merchants — the Shopify store owners who install and use INVA.
Store visitors / customers — the end-customers of those merchants. (See Section 4 — we do not collect personal information about your customers.)
Website visitors — people who visit our website, inva-app.com. (See Section 12 — analytics cookies only with your consent.)

By installing or using INVA, you agree to this Privacy Policy.

Under data protection laws such as the EU General Data Protection Regulation (GDPR):

The merchant is the Data Controller — you decide what data about your store and customers is collected and why.
INVA is a Data Processor — we process data on your behalf, only to provide the Service.

Our obligations as a processor are set out in our Data Processing Agreement (DPA), which forms part of our agreement with you.

3. Information we collect

We collect only what is needed to calculate inventory and reorder metrics:

3.1 Information you provide — Account and contact details when you install the app (e.g. store name, the email associated with your Shopify account); settings and preferences you configure.

3.2 Store data from Shopify — Through the official Shopify API: product and variant details (titles, SKUs, prices); aggregate sales and order data (quantities sold, order timestamps); inventory levels.

3.3 Traffic data from Google Analytics 4 (GA4) — Aggregate traffic signals (e.g. product page views, sessions). We do not receive individual visitor identities.

3.4 Information collected automatically — Basic technical and log data (e.g. IP address, browser type, timestamps) used to operate and secure the Service.

4. What we do NOT collect

❌ We do not store personal information about your end-customers (no customer names, emails, phone numbers, or addresses). INVA works with aggregate numbers (“47 units sold”), not customer identities.
❌ We do not store payment card data. All billing is handled by Shopify’s billing system.

5. How we use information

We use the information only to: calculate reorder points, safety stock, and other inventory metrics; surface sales opportunities and recommendations; generate plain-language summaries (Section 6); operate, secure, support, and improve the Service; process billing through Shopify.

INVA is advisory only — it recommends actions; you always decide whether to act. We do not take automated actions on your store.

6. AI-generated summaries

INVA uses a third-party AI service (Anthropic’s Claude) to translate your computed, aggregate numbers into plain-language sentences.

Only aggregate metrics are sent to the AI service — never personal information about your customers.
Data sent through Anthropic’s commercial API is not used to train AI models.

Sub-processor	Purpose	Location
Google (GA4)	Source of aggregate traffic data — we read from Google, we do not send data to Google	United States
Anthropic (Claude)	AI-generated plain-language summaries (aggregate data only)	United States
Amazon Web Services (AWS)	Application hosting and database	European Union — Sweden (Stockholm)
Google (Google Analytics 4, website and App Store page)	Visit statistics for inva-app.com, only if you accept analytics cookies; visit and install statistics for INVA’s page on the Shopify App Store, sent by Shopify (Section 12)	United States

We do not sell your data, and we do not share it for advertising purposes.

8. International data transfers

INVA is operated from Israel, and its application servers and database run in Amazon Web Services’ Europe (Stockholm) region, in Sweden — inside the EU/EEA. The European Commission has issued an adequacy decision for Israel, meaning transfers of personal data from the EU/EEA to Israel are permitted without additional safeguards. Where a sub-processor is located outside the EEA or Israel (e.g. Anthropic in the US), we rely on appropriate safeguards and on the fact that no personal data about your customers is transferred.

9. Data retention

We keep your store data only for as long as your account is active. When you uninstall INVA or close your account, we delete or anonymize your data within 30 days, except where required to retain records by law.

10. Data security

We use reasonable technical and organizational measures, including access controls and strict data isolation between merchants (every record is scoped to your store).

11. Your rights

You may have the right to: access, correct, delete, object to/restrict processing, and receive a portable copy of your personal data. Because most processing concerns your store’s aggregate data, these rights mainly apply to your own account details. Contact privacy@inva-app.com. Because INVA does not store customer personal data, customer GDPR requests generally require no action on our side.

12. Cookies

The admin interface uses only strictly necessary cookies. No advertising or third-party tracking cookies.

Our website, inva-app.com, uses Google Analytics 4 cookies only if you accept them in the cookie banner. They show us which pages are visited and how visitors find us (for example, from a search engine). Google signals and advertising features are off, and analytics data is kept for 14 months. If you decline, no analytics cookies are set and nothing is sent to Google. You can change your choice at any time with Cookie settings at the bottom of every page.

INVA’s page on the Shopify App Store is run by Shopify. Shopify loads our Google Analytics 4 tag on that page, so we can see how merchants find INVA and click to install it. When a store installs INVA, Shopify also sends us the store’s name, ID and Shopify URL.

13. Children’s privacy

A business tool not directed at children; we do not knowingly collect data from anyone under 16.

14. Changes to this policy

We may update this policy and will post a new “Last updated” date; material changes notified in-app.

15. Contact us

Inva Labs — privacy@inva-app.com

Merchants who need a signed data processing agreement can read ourData Processing Agreement.