> For the complete documentation index, see [llms.txt](https://docs.samita.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.samita.io/b2b-lock-password-protect/reference/permissions-and-data.md).

# Permissions and data

A plain-language summary of what data and permissions Sami B2B Lock, Password Protect needs, and why.

When you install Sami B2B Lock, Password Protect, Shopify asks you to approve a set of permissions for the app. This page explains, in plain language, what each of those permissions is used for. It's a summary for merchants, not a legal document — for the complete legal detail, see the full Privacy Policy linked at the bottom of this page.

{% hint style="info" %}
This page is a plain-language summary of how the app uses its permissions. The linked Privacy Policy is the full legal document and takes precedence over anything summarized here.
{% endhint %}

## Products, collections, pages, blogs, and articles

The app reads these so you can pick what to lock. When you're setting up a lock's content type — [Products and variants](/b2b-lock-password-protect/content-to-lock/overview.md), [Collections](/b2b-lock-password-protect/content-to-lock/collections.md), [Pages](/b2b-lock-password-protect/content-to-lock/pages.md), or [Blogs and articles](/b2b-lock-password-protect/content-to-lock/blogs-articles.md) — the app needs to show you a picker of your actual catalog and content so you can choose exactly what to protect.

## Customers, their tags, and their companies

The app reads your customers, along with their tags and any B2B company account they belong to, to match customer-based access rules — [Logged-in customers](/b2b-lock-password-protect/access-rules/logged-in-customers.md), [Customer tags](/b2b-lock-password-protect/access-rules/customer-tags.md), [B2B customer](/b2b-lock-password-protect/access-rules/b2b-customer.md), [Email contains](/b2b-lock-password-protect/access-rules/email-contains.md), and [Selected customers](/b2b-lock-password-protect/access-rules/selected-customers.md) all depend on being able to check who the visitor is and what's on their account.

## Orders (read and write)

The app reads order data only to support the [Purchased items](/b2b-lock-password-protect/access-rules/purchased-items.md) and [Order quantity](/b2b-lock-password-protect/access-rules/order-quantity.md) rules — checking what a customer has already bought, or how many orders they've placed, before deciding whether they unlock a piece of content. Write access to orders is used narrowly for the same purpose, and isn't used to modify your orders in any way unrelated to these rules.

## Theme content

The app reads and writes a small amount of theme content in order to install and update the [app embed](/b2b-lock-password-protect/quick-start/enable-app-embed.md) that enforces your locks on the storefront. This is the same embed you turn on from the Theme Setup screen — without this permission, the app would have no way to add or update that embed in your theme.

## Sending email

The app sends email on your behalf for the [Request access](/b2b-lock-password-protect/request-access/overview.md) feature — the admin notification sent to your store's contact email whenever a shopper submits a request, and the access email sent to the shopper once you grant them a passcode or secret link.

## Mailchimp and Klaviyo API keys

If you connect a [Mailchimp or Klaviyo account](/b2b-lock-password-protect/access-rules/subscribe.md) to use with the "Subscribe to unlock" rule, the app stores the API key you provide encrypted, and uses it only to check whether a shopper is already a subscriber, or to add them as one, for that specific rule. The key isn't used for anything else.

## The full legal document

This page covers the practical "what and why" of the app's permissions. For the complete terms, see the [Privacy Policy](https://docs.samita.io/privacy-policy).

## Related docs

* [How it works](/b2b-lock-password-protect/reference/how-it-works.md)
* [Request access overview](/b2b-lock-password-protect/request-access/overview.md)
* [Subscribe to unlock](/b2b-lock-password-protect/access-rules/subscribe.md)
* [How locks work](/b2b-lock-password-protect/quick-start/how-locks-work.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.samita.io/b2b-lock-password-protect/reference/permissions-and-data.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.