Privacy Policy

1. Information We Collect

When you install and use OrderRules, we collect the following types of information:

• Store information: Your Shopify store domain, store name, shop owner name, email address, country, currency, Shopify plan, and timezone.
• Order data: Order numbers, order timestamps, order counts and quantities, and whether an order was blocked and why — used to enforce your capacity limits and show your dashboard. We do not store payment details.
• Customer identifiers: Shopify customer IDs, used to enforce the per-customer limits you configure. For each customer, we keep the usage those rules need — such as orders, units, spend, or weight within a period. Some of this usage is also stored as a metafield on the customer record in your own Shopify store.
• Delivery and pickup selections: The delivery or pickup date, time slot, and pickup location a customer chooses, saved on the order in your Shopify store and counted against the capacity you set.
• App configuration: The rules, limits, schedules, and settings you configure within OrderRules.
• Usage analytics: Aggregate data about how features are used, to help us improve the app. No personally identifiable information is included.

When you export shipments to a carrier CSV file, OrderRules reads the recipient's name, address, and phone number from Shopify to build the file. We do not store them.

2. How We Use Your Information

We use the information we collect exclusively to provide and improve the OrderRules service:

• Enforcing the order limits, store hours, delivery rules, and customer rules you configure
• Displaying your dashboard, analytics, and reports within the app
• Sending email notifications you opt into (capacity alerts, daily summaries) and service emails about your account
• Providing customer support when you contact us
• Improving app performance and fixing bugs

We do not sell, rent, or trade your data to third parties. We do not use your store or customer data for advertising.

3. Data Storage, Security & Retention

Our application runs on Vercel, with data stored in a PostgreSQL database. We implement industry-standard security measures including:

• Encrypted connections (HTTPS/TLS) for all data in transit
• Encrypted storage for sensitive configuration data
• Access controls limiting data access to authorised personnel only
• Regular security reviews of our codebase and infrastructure

Retention. We keep your data while OrderRules is installed on your store. When you uninstall the app, we stop processing your store's orders and mark the store as uninstalled; your configuration is kept until Shopify sends its store data deletion request, which Shopify sends 48 hours after uninstall. We then delete your store data, including configuration, order counts, logs, and customer usage records, unless retention is required by law. If your Shopify store is closed or suspended without the app being uninstalled, Shopify does not send an uninstall event or deletion request; you can ask us to delete your data at any time using the contact details below.

Customer deletion requests. When Shopify sends us a request to delete a specific customer's data, we delete the records we hold for that customer.

4. Third-Party Services

OrderRules uses the following third-party services to operate:

• Shopify: We access your store via Shopify's official API under their Partner Program terms.
• Vercel: Our app and website are hosted on Vercel.
• Resend: We use Resend to send email notifications and to deliver messages sent through our website's contact form. Only the email address and message needed for delivery are shared.

5. Customer Data (Your Shopify Customers)

When you use per-customer limits or delivery and pickup scheduling, OrderRules processes limited data about your store's customers solely to enforce the rules you configure. We act as a data processor on your behalf. We do not:

• Use your customers' data for any purpose other than enforcing your configured rules
• Share your customers' data with third parties
• Store customer payment details, addresses, or personally identifiable information beyond what is needed for rule enforcement

6. Our Website: Cookies, Analytics & Chat

The OrderRules app dashboard uses session cookies required by Shopify's authentication system.

Our marketing website, orderrules.com, uses:

• Google Analytics 4, which sets cookies to measure visits and how pages are used, including clicks on our Shopify App Store install buttons. Google processes this data under its own privacy policy.
• Tawk.to live chat, which loads a chat widget and may set cookies to keep a conversation going. Anything you type into the chat is processed by Tawk.to.
• A contact form, which sends your name, email address, and message to us through Resend. To stop spam, we briefly process your IP address for rate limiting.

You can block or delete cookies in your browser settings.

7. Your Rights

Depending on your location, you may have rights regarding your personal data, including the right to access, correct, or delete your data. To exercise these rights, contact us at privacy@orderrules.com. If you are a customer of a store that uses OrderRules, you can also contact that store directly.

8. Children's Privacy

OrderRules is a business-to-business service intended for Shopify merchants. We do not knowingly collect information from individuals under the age of 18.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you via email or through a notice in the app dashboard.

10. Contact Us

If you have questions about this Privacy Policy:

• Email: privacy@orderrules.com
• Support: support@orderrules.com
• Website: orderrules.com