Privacy policy
OrderSpec is a Shopify app for merchants who make personalised products. It shows a merchant their open custom orders and checks the personalisation text before the item is made. This policy explains what the app stores, why, for how long, and who else touches it. It is written to describe exactly what the software does.
Who this applies to
Merchants who install OrderSpec on their Shopify store are our customers. Their customers (shoppers) only meet OrderSpec if a merchant sends them a confirmation link (described below); otherwise the app only sees the parts of their orders described here. Merchants remain the data controller for their shoppers' data; we act as a processor on their instructions.
What we store
| Data | Why | Kept |
|---|---|---|
| Shop domain and an access token for the Shopify API | To read orders and products for that shop | Until uninstall |
| Order number, dates, payment and fulfilment status, tags | To list and sort open custom orders | While the order is open, then 90 days after it is fulfilled or cancelled. An order that is never fulfilled or cancelled is kept until uninstall |
| Line items: product, quantity, SKU, and the personalisation fields the shopper typed (for example a name to engrave, a gift message, a chosen font) | To display, check and print the specification the merchant has to make | Same as the order |
| Checks and flags on those fields, and whether the merchant dismissed them | To show problems before production and keep a record of decisions | Same as the order |
| Customer confirmations: a random link code, whether the shopper confirmed, and any correction they typed on the confirmation page | So the merchant can check the personalisation with the shopper before making the item | Same as the order; links stop working after 14 days |
| Product title and thumbnail for products that appear on orders | To show what the item is | Until uninstall |
| The merchant's field rules and workflow settings | The merchant's own configuration | Rules are stored on the merchant's own Shopify store and stay there after uninstall; our copy until uninstall |
| Rule suggestions: the labels, limits and allowed values the AI proposed for a product | So the merchant can review a proposal before saving it | Until uninstall |
| A log of actions taken in the app (status changes, dismissed flags, saved rules, privacy requests from Shopify) with the time and who did it: a staff member identified only by a numeric Shopify user ID (no name or email), the customer, or OrderSpec | An audit trail for the merchant | Same as the order it relates to; otherwise until uninstall |
What we do not store
We do not read or store shoppers' names, email addresses, phone numbers, shipping or billing addresses, or payment details. The app asks Shopify only for permission to read orders and products; it never changes an order. Personalisation text is never written to application logs, and searching the order list happens in the merchant's browser, so search text is never sent in a web address.
Automated checks
Every incoming order is checked against the merchant's rules (character limits, required fields, allowed values). Free-text fields that pass those rules may additionally be sent, without any shopper identity, to an AI model operated by Anthropic to judge whether the text is ambiguous or contains a likely typo. The result is a suggestion shown to the merchant. When the merchant sets up a product's rules, the field names and a few sample values from that product's past orders are sent to Anthropic in the same way, so the AI can propose limits and allowed values; nothing is saved until the merchant confirms. No decision about an order is made automatically: the merchant can dismiss any flag, and OrderSpec never modifies, holds or cancels an order in Shopify.
Customer confirmation page
A merchant on the Pro plan can create a link to a page that shows a shopper their order number, the products and the personalisation, so the shopper can confirm it or type a correction. The merchant sends the link themselves; OrderSpec never receives the shopper's email address or phone number. The page needs no login, is hidden from search engines, and only opens with the random code in the link. It opens on the merchant's own store address, and once the link expires or the merchant starts making the order it no longer shows the personalisation. A correction the shopper types is shown to the merchant, printed on the run sheet, never written to logs, and deleted with the order.
Who processes data on our behalf
| Provider | Role | Location |
|---|---|---|
| Vercel Inc. | Hosting and request handling | United States |
| Neon Inc. | Database (encrypted at rest) | United States (AWS us-east-1) |
| Inngest Inc. | Background job scheduling; receives the shop domain and order and product identifiers only, never personalisation text | United States |
| Anthropic PBC | AI checks of personalisation fields and rule suggestions; no shopper identity is sent; not used to train models; Anthropic deletes the inputs and outputs within 30 days unless it must keep them longer to enforce its usage policy | United States |
| Telegram | Delivers alerts to a chat the merchant links (Pro plan only); receives order numbers and flag types, never personalisation text | Global network |
| jsDelivr | Serves the font files used to draw PDFs in the merchant's browser; sees the browser's IP address, never order data | Global network |
| Shopify Inc. | The platform the app runs on | Canada / global |
Apart from jsDelivr, Telegram and Shopify, which run worldwide, every provider processes data in the United States. For merchants outside the US this is an international transfer, governed by each provider's own data processing terms.
Security
All traffic uses TLS. The database is encrypted at rest by the provider. Access tokens are stored server-side only. Webhooks from Shopify are verified by signature before anything is read.
Deletion
When a merchant uninstalls OrderSpec, every row we hold for that store is deleted at once, and again when Shopify sends its 48-hour redaction request. Field rules saved on the merchant's own Shopify store stay there. Fulfilled and cancelled orders are deleted automatically 90 days after completion.
We hold no shopper identity, but the personalisation a shopper typed is still their data. When Shopify forwards a shopper's erasure request, every order it lists is deleted from OrderSpec at once, with its personalisation, flags and history. When Shopify forwards a shopper's data request, OrderSpec records in its History page which of the listed orders it holds, so the merchant can open them and send the shopper those details.
Your rights and contact
Merchants can ask what we hold about their store, ask for its deletion, or raise a concern by writing to tmanon007@gmail.com. Shoppers should contact the merchant they bought from, who controls their data. MD Tariqul Islam Manon, trading as Web-Pex, 102/1, East Basabo, Dhaka, 1214, Bangladesh.
Changes
We will update this page when the software changes what it stores, and change the date at the top.