What the app processes
When a shopper reaches the cart or checkout, the store sends this app a signed request asking whether a wholesale discount applies. That request identifies the shopper only as a member identifier, a visitor identifier or the store itself, and carries the cart size, the currency and the purchase flow it belongs to. The app reads the member identifier, asks which labels the matching contact carries, and answers yes or no.What the app stores
For each store: the app instance identifier, the site identifier, an authentication refresh token, the confirmed plan state, the chosen label, the discount percentage and target, the identifier of the discount rule the app created, and whether you have been asked for a review and your answer.For each priced cart: an audit row with the member identifier, whether the discount applied, the response time and the outcome. For recently seen members: a five minute cache of the member identifier, the matching contact identifier and whether that contact carried the label.For each store event: a record of each installation, uninstallation and plan change, holding the installation identifier, the site identifier, what kind of event it was, the plan and the time. This is our billing and support record, so it is kept after the rest of the store's data has been deleted.What the app never stores
No customer names, email addresses, phone numbers, postal addresses, payment details, order contents or product names are stored. Contact names and email addresses are read for the merchant screen — in a search result, and in the list of the contacts carrying the wholesale label — and are not written to the app database.How the data is used and shared
The data is used only to decide whether a cart gets trade pricing and to show the merchant what happened. It is never sold, never used for advertising and never used to build shopper profiles. Nothing is sent to a third party for the pricing decision itself: the only outbound calls are back to the store platform that sent the request.The service is hosted on Fly.io and its database is provided through Supabase. Both process data solely to host and operate this app.Retention and deletion
The member cache expires after five minutes and is cleared whenever the label changes. When the app is removed from a store, it attempts to delete the discount rule, erases the authentication token and marks the store as removed immediately; the remaining audit rows are deleted thirty days later. If the store has already revoked access, the rule stays listed and inert in Automatic discounts. Remove it there, or use Remove discount rule before uninstalling. To request access, correction or deletion sooner, email shin@sognoragroup.com. We verify that the requester is authorised for the store before acting.Security and international processing
Inbound pricing requests are verified with an RS256 signature and merchant screen sessions with an HMAC-SHA256 signature. Data is encrypted in transit and isolated to this app's own database schema, which no other app can read. Sognora operates from South Korea; hosting providers may process data in other countries, including the United States.Changes and contact
Material changes appear on this page with a new effective date. Privacy, security and deletion questions go to shin@sognoragroup.com.