Last updated: 28 August 2026. Basis Receivables is a Shopify app operated by Basis Gova Binyan Veyazamut Ltd. (Israel). Contact: support@basis-s.co.il.
Basis Receivables is a B2B accounts-receivable dashboard for Shopify merchants: an A/R aging report, per-company customer statements, and a dunning queue that drafts payment reminders. It runs embedded inside the Shopify admin.
With the permissions granted at installation, the app reads the data needed to compute your receivables via the Shopify Admin API: your orders and their payment terms (read_orders, and read_all_orders so the aging report can reach invoices older than 60 days), and B2B companies (read_companies, read_payment_terms). The app requests no write scopes — it cannot change anything in your store.
No merchant or customer records. Order and company data is fetched from the Shopify Admin API and processed in memory, per request, to render your dashboard — it is never written to any database, never backed up, and discarded as soon as the response is sent. The only thing the app keeps server-side is the store's API access token, which Shopify issues so the app can make those reads; it is held in memory, never logged, and never sent to the browser. Our server writes operational log lines (the store domain, counts, and timing of each request) to our hosting provider's log stream so we can run and debug the service; those lines contain no customer names, emails, addresses, or order contents.
We do not sell, rent, or share your data with anyone, and we send it to no advertising or analytics service. Your order and customer data is used only to render your own dashboard. The one third party in the path is our hosting provider (see Sub-processors), which processes requests in transit only. Reminder drafts are exactly that — drafts; the app never sends an email or message on your behalf.
The app's backend is hosted by Render, Inc. (United States), which processes your requests in transit to run the service and retains the operational log lines described above; it holds no customer records at rest. Requests reach it through Render's own content-delivery and edge network (which fronts the service in transit); Render's own sub-processors are listed in its sub-processor documentation. Because the operator is established in Israel and the host is in the United States, data is processed across those regions. Beyond the hosting provider and its network layer, no other sub-processor is involved.
Because no customer records are persisted, there is almost nothing to retain: a data request (customers/data_request) has no stored customer data to report, and a redaction request (customers/redact) has none to erase. Operational log lines (store domain, counts, timing — no customer PII) roll off the hosting provider's log retention automatically. When a store uninstalls the app (shop/redact), the store's access token — the one piece of per-store state — is discarded. The app implements all three of Shopify's mandatory privacy webhooks.
All traffic is encrypted in transit (TLS). Every API request from the embedded dashboard is authenticated with a Shopify session token verified server-side; webhook deliveries are verified with Shopify's HMAC signature. Access to the app's infrastructure is limited to the operator.
If this policy changes, the "Last updated" date above changes with it. Questions or data requests: support@basis-s.co.il.