Privacy Policy
Book My Market helps a market host sell vending spaces through their own Shopify store and see who is trading where. This page explains what the app holds, why, for how long, and who else touches it.
Who is responsible for what
The merchant who installs Book My Market decides what data is collected from their vendors and why. They are the controller of that data. Roaming Travelers is a service provider: we process it only to run the app for that merchant, on their instructions. Under the California Consumer Privacy Act we are a service provider, not a third party.
We do not sell or share personal information, and we do not use it to train models, build profiles, or advertise. There is no advertising, analytics or tracking software in this app at all — no third-party scripts of any kind.
What the app holds
| Data | Why | Where it comes from |
|---|---|---|
| Store domain, access and refresh tokens, granted permissions, plan | To connect to the merchant’s Shopify store and apply their plan | Shopify, at install |
| Booking records: order number, market date, space, vendor name, vendor email, vendor phone, order status | To build the roster and the printed sheet, and to let staff contact a vendor about their market day | The merchant’s Shopify orders |
| Vendor documents: seller’s permit, proof of insurance | So a market host can verify a vendor is licensed before they trade | Uploaded by the vendor at checkout |
| Market map: site plan image and the named spaces drawn on it | The picker vendors book from and the map staff read | Uploaded by the merchant |
| Settings: roster passcodes, mail-out address, order tag, map colors, roster header, logo | Merchant configuration | Entered by the merchant |
| Failed roster sign-in timestamps | To rate-limit passcode guessing | Generated by the app |
We do not request or store shipping or billing addresses, payment details, or card numbers. Payments happen entirely inside Shopify and never reach us.
Vendor documents
These deserve saying plainly, because they are other people’s business paperwork:
- They are stored in private object storage with no public URL. A document cannot be reached by guessing an address.
- They are served only to someone holding that market’s Admin View passcode. The Limited Staff View passcode does not open them. A session is bound to one store, so one market’s staff cannot read another market’s documents.
- They are deleted automatically 90 days after the last market day they apply to. A document uploaded during a checkout that was never completed is deleted after 30 days. This runs nightly and cannot be switched off.
Cookies
One, strictly necessary and signed, holding only a store domain, an access level and a check value that stops working when the passcode changes — never personal data:
roster_session— keeps staff signed in to the roster.
Inside Shopify admin the app sets no cookie: every request is checked against a short-lived session token issued by Shopify.
There are no advertising, analytics or third-party cookies.
Who else touches the data
- Vercel Inc. — hosting and file storage, United States.
- Neon Inc. — the database, United States.
- Shopify Inc. — the source of order data and the payment processor.
Data is stored in the United States. We do not transfer it to anyone else, and there are no other subprocessors.
How long it is kept
- Vendor documents: as described above.
- Everything else: for as long as the app is installed. When a merchant uninstalls, Shopify notifies us and we delete all of that store’s data — bookings, settings, map, documents and logo. Reinstalling starts from nothing rather than restoring what was there.
Your rights
Vendors: your booking and any documents you uploaded belong to the market you booked with. Contact that market first — they can see and remove your details. If you cannot reach them, write to us at support@roamingtravelers.com and we will help, acting on that merchant’s instructions.
Merchants: uninstalling deletes everything. To see or export what we hold before that, email us.
California residents have the right to know what personal information is collected, to have it deleted, to correct it, and not to be discriminated against for exercising those rights. Because we act as a service provider, requests are fulfilled through the merchant whose store the data belongs to, or by us on their behalf.
Children
Book My Market is a tool for businesses and is not directed at children. We do not knowingly collect data from anyone under 16.
Changes
If this policy changes in a way that affects what we collect or who sees it, we will update the effective date below and notify installed merchants by email.