Cushion Privacy Policy
1. Who We Are
Cushion is a cashflow forecasting and inventory planning tool for Shopify merchants, available at app.cushioncashflow.com.
The data controller for your personal data is:
Shirt in a Box Ltd, trading as Cushion
One Elmwood, 1 Elmwood Avenue, Belfast, BT9 6AZ
Email: support@cushioncashflow.com
Shirt in a Box Ltd is registered in England and Wales. As a UK-registered company, we are subject to the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. If you are based in the EU, the EU GDPR also applies to our processing of your data.
2. What Data We Collect
We collect only the data we need to provide the Cushion service. We do not sell your data, and we never will.
2.1 Account Data
When you sign up for Cushion, we collect:
- Your name and email address
- Your business or store name
- Your Shopify store URL
2.2 Shopify Store Data (Read-Only)
Cushion connects to your Shopify store via Shopify's OAuth API. All access to your Shopify store is strictly read-only. We never write to, modify, or delete any data in your Shopify store. We read:
- Orders: order IDs, dates, line items, quantities, order values, payment statuses, fulfilment statuses, and associated financial transaction data (revenue figures, taxes, discounts, refunds)
- Products: product names, SKUs, variants, and pricing
- Inventory: stock levels, locations, and inventory history
This data — including commercial and financial transaction data derived from your orders — is used solely to generate cashflow forecasts and inventory planning insights for your business. It is not used for any other purpose.
We do not access your Shopify customers' personal data (such as customer names, addresses, or payment details). Our Shopify API scopes are limited to the data categories listed above.
2.3 Billing Data
Cushion uses Stripe to process subscription payments. Cushion never receives or stores your card number, CVV, or full card details. We receive from Stripe only:
- A Stripe customer ID and subscription reference
- Your billing email address
- Subscription plan, billing cycle, and payment status
2.4 Usage and Log Data
We collect standard technical data when you use the Cushion app, including:
- IP address and approximate location
- Browser type and version, operating system
- Pages and features accessed, time and duration
- Error logs and performance data
This data is collected via Cloudflare's built-in analytics and standard server logs. We do not use any third-party advertising or tracking pixels inside the Cushion app.
2.5 Communications Data
If you contact us for support, or if we send you transactional emails, we retain those communications for support and service continuity purposes.
3. Why We Process It and Our Legal Basis
Under UK GDPR Article 6, we must have a lawful basis for processing your personal data.
| Data category | Purpose | Legal basis |
|---|---|---|
| Account data (name, email, business name) | Creating and managing your account; providing the service | Art. 6(1)(b) — performance of a contract |
| Shopify store data (orders, products, inventory, commercial & financial transaction data) | Generating cashflow forecasts and inventory planning insights — the core service | Art. 6(1)(b) — performance of a contract |
| Billing data (Stripe subscription reference, billing email) | Managing your subscription; processing payments; billing disputes | Art. 6(1)(b) — contract; Art. 6(1)(c) — legal obligation (tax/accounting) |
| Usage and log data | Diagnosing errors; improving service performance and security | Art. 6(1)(f) — legitimate interests |
| Transactional emails (account setup, activation nudges) | Delivering the service and helping you get started | Art. 6(1)(b) — performance of a contract |
| Marketing emails (product updates, new features) | Informing existing customers of relevant product developments | Art. 6(1)(f) — legitimate interests (B2B soft opt-in) |
4. Third-Party Processors
We share your data only with third parties essential to delivering the Cushion service. Each acts as a data processor on our behalf.
| Processor | Role | Data shared | Location |
|---|---|---|---|
| Stripe, Inc. | Payment processing and subscription management | Billing email, subscription data. Stripe directly collects card details — Cushion never receives them. | United States |
| Cloudflare, Inc. | App backend (Cloudflare Workers), data storage (KV), basic analytics | Account data, Shopify store data, usage/log data | United States (global edge) |
| Resend Inc. | Transactional email delivery | Email address and email content | United States |
| Shopify Inc. | Source of store data via Shopify's API | Read-only access to orders, products, inventory per your authorisation | Canada / United States |
We do not sell personal data to third parties. We do not share your data with advertising networks or data brokers beyond those listed above.
5. International Data Transfers
Cushion's infrastructure relies on US-based processors (Cloudflare, Stripe, Resend). Transfers of personal data from the UK to these processors are governed as follows:
UK–US Data Bridge
The UK–US Data Bridge (in effect from October 2023) provides an adequacy-equivalent mechanism for transfers from the UK to US organisations certified under the Data Privacy Framework. Stripe and Cloudflare participate in the EU-US Data Privacy Framework.
Standard Contractual Clauses
Where the UK–US Data Bridge does not apply, we rely on the International Data Transfer Agreement (IDTA) or UK Addendum to the EU SCCs, as approved by the ICO.
EU Customers
If you are based in the EU, transfers of your data to US processors rely on the EU Standard Contractual Clauses (EU SCCs, 2021) as incorporated in each processor's DPA.
6. How Long We Keep Your Data
Active accounts
We keep your data for as long as your account is active.
After cancellation
When you cancel your subscription, we retain your account and associated data for 90 days. After 90 days, we permanently delete your account data, Shopify store data, and associated records.
Billing records
We retain billing records for 7 years from the date of the transaction, as required by UK tax and accounting law.
Log data
Server logs and usage analytics are retained for up to 90 days, after which they are automatically purged or anonymised.
7. Your Rights Under UK GDPR
You have the following rights over your personal data. To exercise any of them, email support@cushioncashflow.com. We will respond within one calendar month.
| Right | Description |
|---|---|
| Access | Request a copy of the personal data we hold about you (Subject Access Request) |
| Rectification | Ask us to correct inaccurate or incomplete personal data |
| Erasure | Ask us to delete your personal data (subject to legal retention obligations) |
| Portability | Request a machine-readable export of personal data you provided to us |
| Restriction | Ask us to restrict processing in certain circumstances |
| Objection | Object to processing based on legitimate interests, or to direct marketing (absolute right) |
| Withdraw consent | Where processing is based on consent, withdraw it at any time |
California Residents (CCPA / CPRA)
If you are a California resident, you have additional rights including the right to know, delete, correct, and opt out of the sale or sharing of personal information. Cushion does not sell or share personal information as defined by California law.
8. Cookies
Inside the Cushion app (app.cushioncashflow.com)
The Cushion app uses strictly necessary cookies only:
- Session and authentication tokens — to keep you logged in. Expire on browser close or after a fixed period.
- CSRF protection tokens — to prevent cross-site request forgery. Session-scoped.
We do not use advertising cookies, third-party tracking cookies, or analytics cookies inside the app.
On the marketing site (cushioncashflow.com)
Our marketing website uses cookies for analytics and advertising (including Meta Pixel and Google Ads). These are governed by a separate Cookie Notice at cushioncashflow.com/cookie-policy.
9. Marketing Communications
We may send you emails about new features, tips, and product updates on the basis of legitimate interests. You can opt out at any time by clicking the unsubscribe link in any marketing email or emailing support@cushioncashflow.com.
10. Children
Cushion is a business tool intended solely for use by businesses and business owners. The service is not directed at anyone under the age of 18. We do not knowingly collect personal data from anyone under 18.
11. Changes to This Policy
If we make material changes, we will notify you by email at least 30 days before the changes take effect. Your continued use of Cushion after the changes take effect constitutes acceptance of the updated policy.
12. Contact Us and Complaints
Email: support@cushioncashflow.com
Post: Shirt in a Box Ltd, trading as Cushion, One Elmwood, 1 Elmwood Avenue, Belfast, BT9 6AZ
Information Commissioner's Office (ICO):
ico.org.uk · 0303 123 1113
If you are based in the EU, you may also complain to the supervisory authority in your EU member state.
Privacy Policy v1.0 · Effective 29 September 2026