Data processing terms
Last updated October 22, 2026
These terms apply between Order Edits and every store that installs the app. By installing the app the store agrees to them. They sit alongside the privacy policy, which lists exactly what the app stores.
Roles
The store is the controller of its customers' personal data. Order Edits processes that data only on the store's behalf and only to provide the app.
What Order Edits commits to
- Use customers' personal data (name, shipping address and phone number on an order) only to show and change that order at the customer's request.
- Not store that personal data, sell it, share it for advertising or use it to contact customers.
- Use only Fly.io (fly.io), which hosts the app, and Neon (neon.com), which hosts its database, as sub-processors.
- Send all data over encrypted connections and keep it in an encrypted database.
- Limit access to the app's systems to the developer, with strong passwords and two-factor login.
- Delete the store's data when it uninstalls, and a customer's records when the store asks through Shopify, as the privacy policy describes.
- Help the store answer its customers' data requests.
Security incidents
If Order Edits learns that data it handles has been accessed, changed or lost without permission, it will:
- Contain the problem straight away, for example by rotating access tokens and secrets or taking the app offline.
- Find out which stores and data were affected.
- Tell affected stores and Shopify within 72 hours of learning of it, saying what happened, what data was involved and what was done.
- Fix the cause and record what happened and what changed.