Privacy notice

1. Scope

This notice explains how Order Document Studio handles information when a Shopify merchant installs or uses the app, visits these public pages, or contacts support.

Order Document Studio is an independent product and is not affiliated with, endorsed by, or sponsored by Shopify.

2. Information we handle

Installation and session records

Shopify authentication creates framework session records that may include the shop domain, installation and session identifiers, access tokens, token expiry information, and related authentication fields. The app also reads the shop name to prefill the configurator. We use these records to authenticate the installation, keep shops isolated, operate the app, and respond safely to lifecycle events.

Billing entitlement cache

The production database stores a short-lived entitlement record under a one-way SHA-256-derived shop key. The cache does not hold the raw shop domain. It can contain active or inactive state, allowed plan handles, trial and cancellation status, pending update status, and timestamps needed to apply freshness, entitlement-end, and deletion limits.

Active results are fresh for five minutes and inactive results for one minute. During a temporary Shopify Partner API failure, only a previously confirmed positive result may remain usable for up to six additional hours, and never beyond its confirmed trial or billing-period end.

Merchant configuration

Visual collection, colours, Shopify-hosted logo reference, business contact details, return address, wording, display choices, and other document settings are stored as JSON in an app-data metafield attached to the merchant's Shopify app installation. Order Document Studio does not use that field for passwords, API keys, payment information, or customer data.

Previews and generated templates

App previews use fictional sample orders. The first release does not request order, customer, product, inventory, theme, or file access scopes and does not send real order data to Order Document Studio to render previews. If a merchant supplies a logo, the app accepts a Shopify CDN HTTPS URL; the app does not proxy or copy the image.

Technical and support information

Hosting and security systems may process standard request details such as timestamps, IP addresses, browser or device information, error categories, and security events. If a merchant contacts support, we process the contact information and message content they choose to provide. Merchants should use fictional or fully redacted information in screenshots and examples.

3. How we use information

• Authenticate merchants and maintain secure app sessions.
• Identify and isolate the correct app installation.
• Verify access to an eligible Shopify app plan.
• Load, save, reset, and generate document configuration.
• Provide support and diagnose reproducible defects.
• Secure, monitor, and maintain the service.
• Respond to legal obligations and authenticated Shopify privacy requests.

We do not sell personal information, use it for third-party advertising, or automatically enrol merchants in marketing.

4. Storage and sharing

Document configuration is stored by Shopify on the relevant app installation. Session and entitlement-cache records are stored in the app's DigitalOcean managed production database. The application and database are configured for DigitalOcean's Toronto, Canada region. DigitalOcean routes application traffic through Cloudflare's global network. Shopify provides the commerce platform, app authentication, installation storage, and app billing services. Namecheap Private Email provides the support mailbox.

We disclose information only as needed to Shopify and providers that host, secure, monitor, or support the service; when required by law; or as part of a legitimate business transfer subject to appropriate safeguards. Provider operations and email delivery may involve processing outside a merchant's province or country.

5. Retention and deletion

• Saved configuration remains on the Shopify app installation until it is replaced, removed with Reset saved settings, or becomes inaccessible under Shopify's uninstall behaviour.
• Active-database session records are kept while needed to operate or secure an installation. Authenticated uninstall and shop-redaction events delete the shop's active session rows.
• Entitlement records use the short freshness periods described above. Expired rows are removed during later entitlement-cache reads; authenticated uninstall and shop-redaction events delete the shop's matching row directly.
• Technical and support records are kept only as long as reasonably needed to operate, secure, support, and document the service or meet legal obligations.
• Deleted records may remain in provider backups until those backups complete their normal rotation, and are not used for ordinary operations.

The app implements Shopify's required customer data request, customer redaction, and shop redaction webhook endpoints even though the app does not request customer or order data.

6. Security

We use encrypted transport, access controls, secret management, authenticated Shopify sessions, input validation, dependency review, and monitoring appropriate to the information handled. No internet service can guarantee absolute security.

7. Choices and privacy requests

Depending on location, a merchant may have rights to request access, correction, deletion, or a copy of information associated with the merchant or app installation, or to object to or restrict certain processing. We may need to verify the request through the relevant Shopify installation.

Send privacy or security requests to [email protected]. Please do not email passwords, access tokens, customer lists, payment-card information, or unredacted order details.

8. Other terms

The app is intended for Shopify merchants and authorized business users, not children. We may update this notice as the product, providers, law, or Shopify platform changes. The effective date above will be updated when material changes are published.