LVNDRby Toolfora

LVNDR privacy policy

Last updated November 14, 2026

What LVNDR is

LVNDR is a Shopify app that keeps a history of changes to a store's catalogue and content so that merchants can see what changed, who changed it, and put it back. It is operated by HereNow Labs, Inc.

What we store

  • Snapshots of products, variants, collections, pages, blogs, blog posts, navigation menus, metafield definitions and theme settings files, as read from the Shopify Admin API, and the differences between successive snapshots.
  • Shopify's admin event log entries for those records, which may contain the display name of the staff member who performed an action, exactly as Shopify records it.
  • The Shopify staff user id of whoever runs an undo in the app, so that undo actions are attributed correctly in the history.
  • Agent runs and API activity: the agent name, task and Shopify API client id an agent sends, the reason it gives for an undo or restore point, which changes belong to a run, and stored answers to retried write requests (kept 24 hours).
  • API keys and OAuth connections, kept only as SHA-256 hashes with their label, scopes, expiry and last use, and the name and redirect addresses of each connected agent client.
  • An audit log of what the app itself did on the merchant's behalf.
  • Optional settings the merchant enters: an alert email address, an alert webhook URL and its signing secret, a restore proof store, and off-site backup bucket details (the secret key stored encrypted).
  • The store's myshopify domain and the API access token Shopify issues to the app.

We do not read or store orders, customers, customer addresses, payment details, or any other protected customer data. The app does not request access to them.

How we use it

Only to provide the service: showing the change history, attributing changes, undoing them on request, letting the merchant's own agents and scripts do the same through keys the merchant creates, and sending anomaly alerts and backups the merchant has set up. We do not sell or share store data with third parties for their own purposes.

Where it lives and who processes it

  • Railway (application hosting and the Postgres database, United States).
  • Resend (email delivery for alert emails, only when a merchant sets an alert address).
  • Anthropic (one-sentence change summaries, only when the server has an Anthropic API key; only the diff of each change is sent).
  • The alert webhook address and the backup bucket the merchant sets, if any.
  • Shopify (the platform the app runs on; Shopify's own privacy policy applies).

Retention and deletion

  • Change history is kept for the plan's history window (90 or 365 days), then pruned. The newest snapshot of every record is always kept. Raw Shopify deliveries are kept 30 days.
  • The merchant can delete all history from Settings at any time; API keys, store links and the audit log stay until uninstall.
  • When the app is uninstalled, every API key and OAuth connection is revoked at once. Shopify sends a redaction request 48 hours later and we delete every record we hold for that store.
  • A merchant can ask for earlier deletion at any time via the contact below.

Security

Data moves over TLS. Webhooks are verified with Shopify's HMAC signature. Access tokens are stored encrypted at rest by the hosting provider and are never shown in the app. Every write the app makes to a store is preceded by a snapshot, so changes made by LVNDR itself are also recorded and reversible.

Contact

Questions or deletion requests: use the support contact on the app's Shopify App Store listing.