> For the complete documentation index, see [llms.txt](https://docs.samita.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.samita.io/sa-request-a-quote/reference/permissions-and-data.md).

# Permissions and data

The Shopify permissions SA Request a Quote asks for, what it does with each one, and what happens to your data if you uninstall.

When you install the app, Shopify asks you to approve a list of permissions. This page explains what each one is for, in plain terms, so you can answer questions from your team or your customers.

## What the app can access

<table><thead><tr><th width="270">Permission</th><th>What the app uses it for</th></tr></thead><tbody><tr><td>Read and write products</td><td>Show your products and variants inside quote forms, quote emails and the quote list. Writing is used when a quoted price has to be applied to the order you create from a quote.</td></tr><tr><td>Read and write customers</td><td>Recognise a logged-in customer so their details fill in automatically, and create a customer record when a quote comes from someone new.</td></tr><tr><td>Read and write draft orders</td><td>Turn an accepted quote into a Shopify draft order, so you can send an invoice and take payment.</td></tr><tr><td>Read themes</td><td>Detect your active theme so the quote button can be placed correctly on product, collection and cart pages.</td></tr><tr><td>Read and write script tags</td><td>Part of the storefront permission set Shopify asks you to approve at install. What actually puts the quote button and the request form on your storefront is the app embed in your theme, not this permission — see <a href="/sa-request-a-quote/getting-started/enable-app-in-theme.md">enable-app-in-theme.md</a>.</td></tr><tr><td>Read and write content</td><td>Manage the storefront pages the app uses — <strong>Request for quote</strong> at <code>/pages/request-for-quote</code> and <strong>Quote history</strong> at <code>/pages/quotes-history</code>.</td></tr><tr><td>Read locales</td><td>See which languages your store publishes under <strong>Settings → Languages</strong>, so quote text can be translated to match.</td></tr></tbody></table>

If your IT or security team asks for the exact handles rather than the plain-language version, these are the Shopify access scopes the app requests:

* Products — `read_products`, `write_products`
* Customers — `read_customers`, `write_customers`
* Draft orders — `read_draft_orders`, `write_draft_orders`
* Themes — `read_themes`
* Script tags — `read_script_tags`, `write_script_tags`
* Content — `read_content`, `write_content`
* Locales — `read_locales`

{% hint style="info" %}
Shopify shows this list again whenever the app needs a new permission. The app cannot quietly gain access — you always approve the change first.
{% endhint %}

Approving these permissions does not by itself put anything on your storefront. That is a separate, reversible step: the app embed in your theme, which the dashboard's **Setup guide** tracks as **App embed is enabled** or **App embed is disabled**. Turning the embed off leaves the permissions in place and takes the quote button and request form off your store.

## What the app stores

To do its job, the app keeps:

* **Quote requests** — the products, quantities and any prices or notes on each quote.
* **What your form collected** — the contact, company, shipping, billing and payment details your quote form asks for.
* **Files customers upload**, when your form asks for them.
* **Your settings** — button text, position and style, your **Hide price** rules, email templates, translations and integration connections.

Your integration keys (for example Klaviyo or Mailchimp) are stored for the connection and are masked in the app once saved, so they can't be read back out of the screen.

### Which files customers can upload

When your form includes a file upload, the app accepts these types:

<table><thead><tr><th width="230">Kind of file</th><th>Extensions</th></tr></thead><tbody><tr><td>Documents and data</td><td>pdf, doc, docx, txt, csv</td></tr><tr><td>Images</td><td>jpg, jpeg, png</td></tr><tr><td>Design files</td><td>psd, ai, eps</td></tr><tr><td>CAD and manufacturing files</td><td>stl, stp, step, dxf, gbr, ex2</td></tr></tbody></table>

Anything outside that list is refused, which matters most for made-to-order stores whose customers send drawings with a request.

{% hint style="info" %}
File limits depend on your plan — the **PRO** card lists **Maximum allowed file size: 50MB**, **Storage size: 2GB** and **File history: 3 month**. For the limits your own store has right now, the dashboard's **Pricing plan details** card shows your **Storage size**, **Used storage** and **Maximum file size**, and the plan cards in **Pricing plans** show what each plan allows.
{% endhint %}

<figure><img src="https://2993310686-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIvNtDAMNVIdy5nl9kiOU%2Fuploads%2Fgit-blob-7217adaee7417a2c1a4b60d846fb3de5a2dd5e13%2Fscreenshot-dashboard-overview.png?alt=media" alt="App dashboard with the Pricing plan details card showing Current plan, Quote number, Storage size, Used storage and Maximum file size"><figcaption><p><strong>Pricing plan details</strong> on the dashboard shows the storage and file limits you actually have.</p></figcaption></figure>

## Customer data requests

The app registers Shopify's mandatory privacy webhooks, so it hears about privacy actions you take in your Shopify admin. Three things reach it:

<table><thead><tr><th width="270">When this happens</th><th width="200">Shopify webhook</th><th>What the app is told</th></tr></thead><tbody><tr><td>A customer asks for a copy of their data</td><td><code>customers/data_request</code></td><td>A data request, so the quote data held for that customer can be gathered.</td></tr><tr><td>A customer asks to be erased</td><td><code>customers/redact</code></td><td>A redaction request for that customer.</td></tr><tr><td>Your store is erased after you uninstall</td><td><code>shop/redact</code></td><td>A redaction request for the whole shop.</td></tr></tbody></table>

You start all three from your Shopify admin, in the usual place for customer privacy requests — there is nothing to do inside this app. Because the app is registered for these webhooks, it is notified when you raise one in Shopify, so you don't have to send a separate request to Samita as well.

## If you uninstall

Uninstalling removes the app's access to your store immediately, and the quote button and hide price rules stop applying to your storefront.

{% hint style="warning" %}
Uninstalling also ends your ability to open the quotes you've collected. If you need them, export them first — see [Export quotes to CSV](/sa-request-a-quote/managing-quotes/export-csv.md). Exporting quotes to CSV is a **PRO** feature: if **Export** is greyed out with a padlock line reading "🔐 This feature is available on …", that is your plan rather than a fault, and you can download the quotes you need as PDFs instead — see [Download a quote as PDF](/sa-request-a-quote/managing-quotes/download-pdf.md).
{% endhint %}

## The full policy

This page is a plain-language summary, not the legal terms. For the complete detail:

* [Privacy policy](https://docs.samita.io/privacy-policy)
* [Terms and conditions](https://samita.io/pages/terms-and-conditions)

If you need something the policy doesn't cover, email <support@samita.io>.

## Next steps

* [How it works](/sa-request-a-quote/reference/how-it-works.md) — what the app does at each stage of a quote
* [Plan comparison](/sa-request-a-quote/reference/plan-comparison.md) — what each plan includes, and why a control is greyed out
* [Contact support](/sa-request-a-quote/help/contact-support.md) — how to reach the team


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.samita.io/sa-request-a-quote/reference/permissions-and-data.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.