Privacy Policy

Last updated: May 29, 2026

This Privacy Policy explains how the Order Address Editor app (“the App”, “we”, “us”) handles information when a Shopify merchant installs it and when their customers use it to edit an order. By installing the App, the merchant agrees to this policy.

What the App does

The App lets a merchant’s customers — and the merchant’s own staff — correct a recently placed order (for example, a wrong shipping address) within a time window the merchant controls. To do this, the App reads the relevant order from Shopify, shows the current values, and saves the customer’s corrections back to the order.

Information we access

When an order is being edited, the App accesses, from Shopify, only the data needed for that order:

• Order number and order status (e.g. fulfillment state, creation date).
• The order’s shipping address — recipient name, company, address, city, region, postal code, country, and phone.
• The order’s contact email (used to verify the person editing owns the order).
• Order notes and line items (only when those editing features are enabled).

We request the minimum Shopify permissions required for this: read/write orders, read products, and order-edit access.

Information we store

We practice data minimization. The App does not store your customers’ names, addresses, phone numbers, or emails. Order details are read live from Shopify when needed and written straight back — never retained on our servers.

The only data we persist is:

• An edit audit log — for each successful edit we keep the shop, the order ID, the order number, whether the edit came from the customer or staff, and a timestamp. This powers the merchant’s dashboard. It contains no names, addresses, or contact details.
• Per-shop settings — the merchant’s configuration (which fields are editable, time window, branding/text).
• A Shopify session token — required by Shopify to authenticate the App for the shop.

How we protect it

• All data is transmitted over encrypted connections (HTTPS/TLS).
• Stored data is held in a managed PostgreSQL database that encrypts data at rest.
• We never sell or share personal data, and we never use it for advertising or profiling.
• Edits are verified against the order and rate-limited to prevent abuse.

Service providers

The App relies on these providers to operate:

• Shopify — the platform the App runs on and the source of all order data.
• Railway — application hosting.
• Neon — managed PostgreSQL database for the limited data described above.

Data retention & deletion

Because we don’t store customer personal data, there is nothing personal to delete on request. The edit audit log and shop settings are removed when the merchant uninstalls the App: settings are cleared on uninstall, and all remaining shop data is erased when Shopify sends the shop-redaction request (about 48 hours after uninstall). We also honor Shopify’s mandatory privacy webhooks for customer data requests and customer/shop redaction.

Your rights (GDPR / CCPA)

If you are a customer of a store using the App and want to know what data the App holds about you, or want it erased, contact the store you ordered from — they are the data controller. The App will provide or delete any data it holds (the audit-log entries for your orders) at the store’s request. You can also reach us directly using the contact details below.

Changes to this policy

We may update this policy from time to time. The “last updated” date above reflects the latest version.

Contact

Questions about privacy or this policy? Email duaassaini0@gmail.com.