OrderlyPrivacy Policy

This Privacy Policy describes how Orderly (“the App”), operated by Xeon Apps (“we”, “us”, or “our”), collects, uses, and shares information when merchants install the App on their Shopify store and when the App emails their team and their customers about orders.

Orderly finds the orders that need attention — for example, orders still unfulfilled after a few days, orders awaiting payment, or every new order since the last report — and emails them on the schedule a merchant sets: as order lists to the merchant’s team, or as order updates to the customers who placed them. By installing or using the App, you agree to the collection and use of information as described in this policy.

When the App is installed, we access certain Shopify store data through the permissions (scopes) granted during installation, and we store the notifiers and settings merchants create in the App:

• Store information: your shop domain, store name, timezone, the store’s email address and customer contact email, your Orderly plan, and the authentication tokens required for the App to communicate with Shopify on your behalf.
• Order information: read from Shopify each time a notifier runs — order number, dates, payment and fulfillment status, totals, tags, notes, discount codes, the order status page link, the items in the order (title, variant, SKU, vendor, and quantity), and shipment tracking details — so the App can find the orders that match a notifier and fill in its emails.
• Customer information in those orders: the customer’s name, email address, and tags, and the shipping address and phone number on the order, used to filter orders, to show them in the order lists you design, and to send customer emails to the address on the order.
• Notifier configuration: the notifiers you create — name, which orders to include, filters, schedule and timezone, email recipients, subject, message and design, whether to attach a CSV file, and the tags to add to emailed orders.
• Email settings: the sender names, sender and reply-to email addresses, and sending domains you add, and the link to the logo image shown in customer emails.
• Run records: the outcome of each notifier’s latest run — when it ran, whether it sent, how many orders and emails it covered, and any team recipient addresses that were left out and why — and, for customer email notifiers, which orders have been emailed (order ID, status, and time only), so that no customer is emailed twice about the same order.
• Support and feedback: messages you send our support team, and the ideas and votes you post on the App’s feature request board.

We don’t keep your orders. Order and customer details are read from Shopify when a notifier runs, used to build that run’s emails, and never written to our database. We keep only the IDs of the orders a customer email notifier has emailed, and our email service keeps the addresses it sent to for up to 35 days (see section 6).

We do not collect or store payment or credit card information. Payments are handled entirely by Shopify.

We use the information we collect to:

• provide the App’s core functionality — running each notifier on its schedule or when you run it by hand, finding the orders that match it, and sending its emails: order lists (optionally with a CSV file of those orders) to the recipients you choose, or an update about each order to the customer who placed it;
• add the tags you choose to the orders an email covered, when you turn that on;
• send test emails to your store’s email address, and show run results and plan usage to the merchant in Shopify admin;
• register your sending domains so emails can come from your own address, and keep sending limits, bounces, spam reports, and unsubscribes in check so that emails keep reaching inboxes;
• respond to support requests and troubleshoot issues; and
• improve the reliability and performance of the App.

You decide which orders a notifier includes, who receives your team’s order lists, and what customer emails say. We process order and customer data on your behalf, only to carry out those instructions.

We do not sell, rent, or trade your data, and we do not use it for advertising or marketing to your customers.

Notifier, email settings, run, and session data are stored in a secured database operated by us; order details are not stored (see section 2). All data is transmitted over encrypted connections (HTTPS/TLS), and access to production systems is restricted to authorized personnel who need it to operate and support the App.

While we take commercially reasonable measures to protect your information, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

We only share information in the following limited circumstances:

• The recipients you choose: order lists and their CSV files go to the email addresses you enter in each notifier, and customer emails go to the email address on each order — once delivered, they sit in the recipients’ inboxes, outside our control;
• Email delivery providers: Twilio SendGrid and Mailgun receive each email’s sender, recipients, and content in order to deliver it and report bounces and spam complaints, and the sending domains you add are registered with SendGrid;
• Support chat: the App loads Segment, which starts our Intercom chat and passes your shop domain so our support team knows which store is writing, and Intercom keeps the conversations you have there;
• Service providers: with infrastructure providers (such as cloud hosting, database, and logging services) strictly as needed to run the App;
• Shopify: data flows between the App and Shopify as required for the App to function, including the tags the App adds to orders; and
• Legal requirements: when required to comply with applicable law, regulation, legal process, or enforceable governmental request.

We retain notifiers, email settings, and run records for as long as the App is installed on your store. When you uninstall the App, we delete the store’s data immediately, including the sending domains registered with SendGrid, and Shopify’s mandatory privacy webhooks provide a second guarantee:

• Customer data requests — the only customer-related records the App keeps are which of the customer’s orders a customer email notifier has emailed (order ID, status, and time); we compile these for the merchant on request;
• Customer data erasure — we delete those records for the customer’s orders; and
• Shop data erasure — after uninstallation, Shopify issues the shop redact request and we run the deletion again, in case anything remained.

Some records also expire on their own. Our record of which orders were emailed is deleted after 400 days. Our email service keeps each address it sent to for up to 35 days to track bounces and spam reports, and keeps addresses that bounced, were reported as spam, or unsubscribed on a suppression list so they are not emailed again. Tags the App added to orders stay on those orders in Shopify.

Merchants can also request deletion of their data at any time by contacting us directly.

Depending on where you are located, you may have rights under data protection laws such as the GDPR (European Economic Area / United Kingdom) or the CCPA (California), including the right to:

• access the personal information we hold about you;
• request correction of inaccurate information;
• request deletion of your personal information; and
• receive a copy of your data in a portable format.

To exercise any of these rights, contact us using the details below. If you are a customer of a store using Orderly, you can also direct your request to the merchant, and we will assist them in fulfilling it.

The App uses session tokens and strictly necessary cookies to authenticate merchants inside Shopify admin and keep the App working securely. For the in-app support chat, it also loads Segment and Intercom, which set their own cookies and browser storage. We do not use advertising or cross-site tracking cookies, and Orderly adds nothing to your online store, so your shoppers never load any of its code or cookies.

We may update this Privacy Policy from time to time to reflect changes in the App or in applicable law. When we do, we will revise the “last updated” date at the top of this page. Significant changes will be communicated to merchants through the App or by email.

If you have questions about this Privacy Policy or how your data is handled, contact us at support@xeonapp.com.