BragWorthy

Privacy Policy

Last updated: June 12, 2026

1. Introduction

BragWorthy ("we," "us," or "our") operates a party management platform that helps makers and creative businesses coordinate events, manage guest lists, and process payments. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our platform or when a store you interact with uses our Shopify integration.

2. Information We Collect

Store Owners

  • Account information: name, email address, phone number
  • Business information: store name, address, branding preferences
  • Payment provider credentials (encrypted at rest using AES-256-GCM)
  • Shopify store URL and OAuth access tokens (when using our Shopify integration)

Party Hosts

  • Name, email address, phone number
  • Party details: date, time, location

Guests

  • Name, email address, phone number (if provided)
  • RSVP responses and dietary restrictions
  • Product selections and customization choices
  • Payment status (we do not store full payment card details)

3. Shopify Integration

When a store connects their Shopify account, we access the following through Shopify's API with the store owner's explicit authorization:

  • Products (read/write): We sync your product catalog to display items to party guests.
  • Orders (read/write): We create draft orders for guest checkout and track order/fulfillment status.
  • Inventory (read): We read inventory levels to show product availability.

Protected customer data: from Shopify orders we access only the customer's name and email — the minimum needed to match a Shopify order to the corresponding party booking and send the guest their confirmation. We do not request or store the customer's phone number or address from Shopify, and we use this data solely for the app's booking functionality and for the merchant to manage their parties and orders.

Shopify data is stored in our database (hosted on Supabase) and is only accessible to the store owner who authorized the connection. We do not share store data between tenants. When a store disconnects or uninstalls our app, we clear all Shopify credentials and deactivate synced products. Shopify's mandatory data-deletion webhooks (customers/redact, shop/redact) are honored automatically.

4. How We Use Your Information

  • Provide and operate the party management platform
  • Process payments through Stripe, Square, or Shopify (depending on store configuration)
  • Send event-related communications (invitations, confirmations, reminders)
  • Sync product catalogs between Shopify and our platform
  • Maintain safety and block lists to protect stores and guests
  • Generate audit logs for store administrators

5. Data Sharing

We share personal information only with the following categories of service providers, solely to operate the platform:

  • Supabase: Database hosting and authentication
  • Stripe / Square / Shopify: Payment processing (as configured by the store)
  • Resend: Transactional email delivery
  • Twilio: SMS notifications (if enabled by the store)
  • Vercel: Application hosting

We do not sell personal information. We do not use personal information for advertising.

6. Data Security

  • Payment provider API keys are encrypted at rest using AES-256-GCM
  • All data is transmitted over HTTPS with HSTS enforcement
  • Webhook signatures are verified using HMAC-SHA256 with timing-safe comparison
  • OAuth flows use CSRF protection with cryptographic nonces
  • Role-based access control limits data visibility per user role
  • Row-level security policies enforce tenant isolation in the database
  • Database backups are encrypted and access-controlled (managed by Supabase)
  • Development and production data are kept in separate environments
  • Security incidents are handled under our documented incident response policy, including prompt notification to affected merchants and, where applicable, Shopify and the relevant data-protection authorities

7. Data Retention

We retain personal data for as long as the associated store account is active. When a Shopify app is uninstalled, we clear Shopify credentials immediately and respond to GDPR data deletion requests within 30 days. Guest data associated with completed parties is retained for the store owner's records unless a deletion request is made.

8. Your Rights (GDPR / CCPA)

You have the right to:

  • Access: Request a copy of the personal data we hold about you
  • Rectification: Request correction of inaccurate data
  • Erasure: Request deletion of your personal data
  • Portability: Request your data in a machine-readable format
  • Object: Object to processing of your data for certain purposes

For Shopify-related data requests, these are handled automatically through Shopify's mandatory GDPR webhooks. For direct requests, contact us at the address below.

9. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us at:

Email: privacy@bragworthy.events

See also: Terms of Service