Privacy Policy

1. Who we are

Standing Orders (listed on the Shopify App Store as “Orumio — Standing Orders”) (the “app”) is built and operated by Orumio (“we”, “us”).

When you install the app on your Shopify store, you are the controller of the data in your Shopify store, and we act as your processor: we process it only to provide the app to you, on your instructions. The terms of that relationship are set out in our Data Processing Agreement, which forms part of your agreement with us.

2. What the app processes

3. Why we process it

One purpose only: to provide the app — store management, and creating scheduled B2B draft orders for your company locations on your behalf. These are the purposes we declared to Shopify when we requested access to protected customer data, and they are enforced in the code: every read of a protected field must declare one of a fixed list of permitted purposes.

We do not, and the app has no mechanism to:

• use your data for marketing or advertising, or profile anyone for those purposes;
• sell or share your data with anyone;
• use your data to train machine-learning models;
• build analytics or audience products out of your data.

Two things sit outside the data described above and outside that list, and we would rather point at them than let you find them. Once, when the app is installed, we tell an affiliate network that your store installed it, so that a partner who recommended the app to you can be paid; it carries no buyer data and nothing from your store, and it is described in full under Affiliate attribution below. And the app measures how its own screens are used, so that we can find where it is hard to use; that is our own processing rather than yours, it captures no buyer data and stores nothing in your browser, and it is described in full under Product usage measurement below.

The app makes no automated decisions about people. It creates draft orders on a schedule you configured; the decision is yours, made in advance, and has no legal or similarly significant effect on any buyer.

4. Affiliate attribution

Agencies, freelancers and consultants recommend apps to the merchants they work with, and we pay the ones who recommend this app. To know who to pay, we have to be able to connect an install back to the recommendation that led to it. We use an affiliate network for Shopify apps to do that.

What we send, and when. The first time the app is opened after it is installed, the app sends the affiliate network two things about you: your store’s myshopify.com domain, and the IP address of the browser that opened the app. The rest of the message identifies us — our own account and app — and nothing else is included. It is sent once per installation — again only if you uninstall and install the app afresh — and never on any other occasion.

What we never send. No buyer personal data. No company, contact, product or order data. No standing orders and no execution history. Not your notification email address, and not your Shopify access token. The affiliate network has no access to your store and no access to our database.

Why an IP address. The affiliate network matches the install against the browser that followed the partner’s referral link. Without the address there is nothing to match on. It is used for that comparison and is not used to locate you, to profile you, or to advertise to you.

Our role here is different. Everywhere else in this policy we act as your processor, handling your store’s data on your instructions. This one transfer is not that: it is our own measurement of our own marketing, and for it we are the controller. That is why the affiliate network is not listed in the table below and is not a sub-processor under the Data Processing Agreement — it processes none of the data that agreement covers. Where the GDPR or the UK GDPR applies, our lawful basis is legitimate interests: knowing which recommendations bring merchants to a small app, weighed against a single transmission of a business domain and an address your browser sends to every site it visits.

If you would rather we had not. Write to support@orumio.com and we will ask the affiliate network to erase the record for your store. Objecting costs you nothing: the transfer has no bearing on your subscription, what you pay, or anything the app does.

5. Product usage measurement

The app measures how its own screens are used, so that we can find where it is hard to use. We use a product-analytics service, hosted in the European Union (Frankfurt), for this. It runs in your browser, inside the app’s own screens, and nowhere else: the server side of the app is unchanged, and no measurement code runs there.

What is sent. Seven named events — that a screen was viewed, that a form was previewed or rejected (with a count of errors, never the errors), that Run now was pressed and what it returned, and that the feedback box was opened or sent — together with a recording of how the app’s screens were used. In that recording every piece of text is masked and every form control is blocked: the layout, the movements and the sequence are visible; no name, no email address, no product, no company and nothing you typed ever is. The recording is kept for 30 days.

What identifies you. An opaque identifier the app assigned to your installation — not your store domain, not a person, not a device. Alongside it we record whether the installation is a development store, when the app was installed, and the subscription status. Nothing else about you or your staff is recorded.

Nothing is stored in your browser. The measurement sets no cookie, writes nothing to local storage, and does not fingerprint the device. Nothing is written to, or read from, your browser beyond what it sends with the request itself. Your IP address is discarded by the analytics service on receipt and is not stored. The parameters Shopify places in the app’s address — including your session token and your store domain — are removed from every address before it leaves your browser.

Our role here is different, as it is for the affiliate notice above. This is our own measurement of our own product, for which we are the controller and the analytics service is our processor; it is not processing we do on your instructions. That is why it is not listed in the table below and is not a sub-processor under the Data Processing Agreement, which says so in its Annex I and Annex III. Where the GDPR or the UK GDPR applies, our lawful basis is legitimate interests: a single operator has no other way to see where a merchant gets stuck, weighed against pseudonymous, masked measurement held in the EU, stored nowhere on your device, and used for nothing but the product.

If you would rather we did not. Write to support@orumio.com and we will exclude your store. Objecting costs you nothing: the measurement has no bearing on your subscription, what you pay, or anything the app does.

If you installed the app before this version. Your store is not measured until 30 days after this policy’s effective date, and the app shows you a notice each time you open it until then — the same notice period we give before any change to who processes your data.

6. Who else processes it (sub-processors)

The app talks to a deliberately small number of external services. There is no analytics SDK in the server path, no error-reporting service receiving payloads, and no third-party script in the server path; the measurement that runs in your browser is described under Product usage measurement above and is not a sub-processor of yours.

Below, the providers we engage are described by what they do. Those that process your data on your behalf are named, with their locations, in the Data Processing Agreement, Annex III; before we add or replace one we announce it to merchants with an active installation at least 30 days in advance (its §6).

Our database and application servers are located in the United States, primarily — the database is placed there with a location hint to our hosting provider — and requests are served from its global network. If you are in the European Economic Area or the United Kingdom, this means your data is transferred outside that region; the safeguards for that transfer are set out in the Data Processing Agreement.

7. How it is protected

• Minimisation first. Buyer personal data is never written to our database. Data that was never stored cannot be leaked from storage, exposed in a backup, or taken in a database breach.
• Encryption in transit. The app is served only over HTTPS. Its database is never reached over a network connection: our hosting provider hands the running app a binding to the database inside its own network, so there is no database endpoint, password or connection string that could be intercepted or leaked.
• Encryption at rest. Our hosting provider encrypts the database and its point-in-time history at rest. There is no self-managed backup, export, or snapshot pipeline, so no unencrypted copy of the database exists anywhere.
• Credentials encrypted a second time. Your Shopify access and refresh tokens are additionally encrypted with AES-256-GCM before they reach the database, cryptographically bound to your shop domain — a stolen database row cannot be replayed against another store.
• Tenant isolation. Every record reaches your installation by foreign key, and every query filters through it.
• Access control. The app is operated by a single person. There are no staff accounts, contractors, or support agents with access to merchant data. Every account with access is protected by two-factor authentication and a unique password generated and stored in a password manager.

We maintain a written data protection policy and a security incident response policy, and we review both whenever what the app does with data changes.

8. Logging

The app writes operational logs so that failures can be diagnosed. Those logs record identifiers, classifications, counts and timestamps — never access tokens, never webhook payloads, and never buyer personal data. Your notification email address is not logged either: a notification log line records which store and which execution, not the address it went to.

Where the app reads a protected customer field, it records an access log entry containing the purpose, the resource, the names of the fields read, whether a person or the scheduler triggered it, and how many records were involved. It never records the values.

The app reports page-performance measurements (such as load time and layout stability) for its own admin screens, tagged with your shop domain and the screen name. These contain no personal data and are used only to keep the app fast.

Logs are held in our hosting provider’s runtime log storage. No log data is forwarded to any third-party log or analytics service. The usage measurement described above is a separate, browser-side system: nothing in these logs is sent to it, and nothing it captures is written to these logs.

9. Cookies and tracking

The app sets no advertising, analytics or tracking cookies, and the usage measurement described above sets none either — it keeps nothing in your browser at all. Inside the Shopify admin the app authenticates with Shopify session tokens rather than its own login. Shopify may set its own cookies as part of the admin and the installation flow; those are governed by Shopify’s privacy terms, not this policy.

This policy covers the app. Our listing page on the Shopify App Store is a Shopify-operated page, and we use Shopify’s own listing-analytics feature there, which runs on a third-party web-analytics service, to see how merchants find the listing. That is separate from the app: it never runs inside the admin, it never sees your store’s or your buyers’ data, and nothing measured there is joined to anything in this policy.

There is no tracking of you across sites, no device fingerprinting and no advertising identifier anywhere in the app. The only things the app sends about you to a third party for a purpose other than running it are the installation notice under Affiliate attribution above, which happens once, and the masked measurement of the app’s own screens under Product usage measurement above — and neither sets anything in your browser.

10. How long it is kept

• Buyer personal data: not retained at all, so there is nothing to expire.
• Your configuration and history are kept while the app is installed, because they are the app.
• When you uninstall, the app immediately revokes the stored credentials so no further processing can happen, and cancels every scheduled occurrence that had not yet run.
• Deletion. Shopify sends us a shop redaction request approximately 48 hours after uninstall; that deletes your installation record and everything attached to it — entitlement, standing orders, order lines, execution records, activity events and any feedback you sent.
• Backstop. Because that request is a webhook and can fail to arrive, the app itself deletes any installation that has been uninstalled for more than 30 days, with the same cascade. The window is long enough never to pre-empt a reinstall, and finite so that a lost message cannot become indefinite retention.
• The affiliate record described above is a single row saying that your store was reported and when. We delete it the moment you uninstall, and it is covered by both deletions above. What the affiliate network keeps on its own side is governed by its own privacy policy.

11. Requests from buyers

If a buyer asks to access or delete their personal data, that request belongs to the merchant whose store holds it. Shopify forwards such requests to us as well, and we handle them as follows:

• Data request: we return nothing, because we hold no buyer personal data.
• Customer redaction: no action is required for the same reason. A standing order refers to a company contact by Shopify identifier, which is a pointer into Shopify, not personal data we own.
• Shop redaction: we delete the merchant’s entire tenant as described under how long data is kept.

If you are a buyer and are not sure which merchant holds your data, write to support@orumio.com and we will help you reach them.

12. Security incidents

If we confirm an incident affecting personal data, we notify the affected merchants directly and in plain language — what happened, what data was involved, what we have done, and what if anything you need to do — targeting within 72 hours of confirming it. We also report incidents involving protected customer data or platform credentials to Shopify promptly, without waiting for a complete root-cause analysis.

13. Changes to this policy

If we change what the app does with data, we update this page and its version number before the change ships. Material changes are announced to merchants with an active installation.

14. Contact

Questions, requests, or anything that looks wrong in this policy: support@orumio.com.