Privacy Policy

Last updated: June 6, 2026

1. Introduction

OrderEdit ("we", "our", "us") provides a self-service order editing application for Shopify merchants. It lets a merchant's customers modify their own orders — change the shipping address, cancel the order, swap a variant or change quantity, or cancel a single line item — before the order ships. This Privacy Policy explains what data we collect, how we use it, and your rights.

2. Data We Collect

When you install and use OrderEdit, we process:

Store information: Your Shopify store domain, used to associate edit requests and settings with your account.
Order data: To apply a requested edit, we read and write order details through Shopify's Admin API using the read_orders, write_orders, read_order_edits, and write_order_edits scopes. This includes the order ID and name, fulfillment status, line items, variants, quantities, and the shipping address being changed.
Customer identifier: The Shopify customer ID associated with an order, used to verify that the customer requesting an edit owns that order.
Edit requests: A record of each requested change (type, payload, status, and mutation result) so merchants can audit edits in the dashboard.
Session data: Shopify session tokens required for authentication.

We do not collect payment card numbers or store customer passwords. The shipping address a customer submits is sent directly to Shopify to update the order; it is retained only as part of the edit-request audit record.

3. How We Use Your Data

To verify order ownership and edit eligibility (unfulfilled status, edit window, enabled operations).
To apply the requested order change via Shopify's Admin API (address change, order cancel, line-item edit, item cancel).
To display edit history and analytics in your merchant dashboard.
To enforce billing plan limits (e.g., monthly edit counts).

4. Data Sharing

We do not sell, rent, or share your data with third parties. Order and edit data is only accessible to the merchant who owns the Shopify store. Order mutations are transmitted only to Shopify to fulfill the requested edit.

5. Data Storage & Security

Data is stored in a secured PostgreSQL database hosted on Supabase. All connections use TLS encryption. All order mutations run server-side using the merchant's offline Admin API token; the customer-account extension never receives or uses the merchant's Admin API credentials. Shoppers are authenticated via the extension session token before any edit is performed.

6. Data Retention & Deletion

When you uninstall OrderEdit, Shopify sends us a shop/redact webhook within 48 hours. Upon receiving this webhook, we permanently delete all data associated with your store, including store settings, edit requests, and session data.

Customers may request deletion of their personal data through their Shopify store. When we receive a customer redact request, we delete all edit requests linked to that customer's orders.

7. GDPR Compliance

We comply with GDPR requirements. We support customer data requests (access and deletion) through Shopify's mandatory webhook system. If you are an EU resident and have questions about your data, contact us at the address below.

8. Changes to This Policy

We may update this policy from time to time. Changes will be posted on this page with an updated revision date.

9. Contact Us

If you have questions about this Privacy Policy, please contact us at support@orderedit.com.