Privacy policy · Bundle-Aware Reorder Planner

In short

The app only reads your store: products, inventory, locations and orders. It never changes anything in Shopify.
Orders are read only to count units sold per variant per day. The app doesn’t read or store customer names, emails, phone numbers or addresses, or order numbers.
Supplier contacts (names, emails and phone numbers) are personal data you enter yourself. The app never emails them.
Everything it stores for your store is deleted within an hour of uninstalling.
It runs on Fly.io in Ashburn, Virginia (US). There are no analytics, no tracking, no ads and no marketing emails, and I never sell or share your data.

Who this policy covers

This policy covers the Shopify app Bundle-Aware Reorder Planner (“the app”), made by Christian Ortiz, an individual publishing as Christian Ortiz Studio (“I”, “me”). It explains what the app does with data from the Shopify stores where it’s installed, and how I handle the information you share with me.

It doesn’t cover Shopify itself, which is governed by Shopify’s privacy policy.

Questions about this policy: support@christianortiz.studio.

What the app can access

When you install the app, Shopify asks you to approve four permissions, all read-only:

Products: variants, SKUs, titles, vendors, product types, status, unit costs and Shopify bundle components, to build your catalog, filters and purchase order lines.
Inventory: available, on-hand and incoming quantities per variant and location, to work out stock, incoming and buildable quantities.
Locations: location names, for per-location and combined views and the ship-to location on purchase orders.
Orders: line items, to count units sold per variant per day. The app’s queries ask for no customer, email, phone or address fields.

Orders are protected customer data under Shopify’s rules, so the app is subject to Shopify’s requirements for it, even though it reads no customer details. It has no write permissions at all. Billing goes through Shopify; the app never sees or collects payment details.

What the app stores, and for how long

The app keeps its data in its own database, on the server that runs it.

Data	Why	Personal data	Kept
Your store’s myshopify domain, currency, timezone, plan, the date your order history starts, last sync time and install time	Run the app and count sales by your local day	No	Until you uninstall
The access token Shopify issues for your store	Read your store in the background, for syncs and the nightly check	No	Deleted as soon as you uninstall
Your settings: lead time, coverage, safety days, sales window, location scope, ship-to location, exclusions and saved CSV column mappings	Calculate suggestions the way you set them	No	Until you uninstall
Products and variants: titles, SKUs, vendors, product types, status, unit costs, sales rank and Shopify bundle components	Catalog, filters and purchase order lines	No	Until you uninstall; removed when you delete the product in Shopify
Location names and stock quantities per variant and location	Available, incoming and buildable quantities	No	Until you uninstall; kept current by Shopify’s notifications
Sales totals: units sold per variant and location per day, and how many came through bundles	Forecast demand	No	Daily totals for 120 days; older days are combined into weekly totals, kept for 106 weeks (about two years), then deleted
Planning modes, min and max values, overrides, component maps and suggestions with their full calculation	Core features	No	Until you uninstall, or until you delete them
Suppliers: name, email, phone, lead time, pack size, currency and notes, entered or imported by you	Group purchase orders and fill in the email you send	Yes, when a contact is a person	Until you delete the supplier or uninstall
Purchase orders and their lines: supplier, ship-to location, SKUs, titles, quantities, unit costs, status and dates	Purchase orders and incoming stock	No	Until you uninstall
Sync and import records: the kind of job, status, progress, counts and error messages, and an uploaded import file until it’s applied	Show progress, resume after a restart, preview imports	No	Until you uninstall; an applied import file is removed when the import finishes
Tour progress: each staff member’s Shopify staff user ID and when they saw or finished the tour	Show the first-run tour once per person	Yes	Until you uninstall

The app stores no order IDs, customer IDs or customer details. Product data can contain personal data only if you’ve typed it into a product field yourself.

CSV exports and store bundles are created when you download them and aren’t kept on the server.

Where the app runs

The app runs on a server I operate with Fly.io, on the machine cos-shopify-apps in Fly.io’s iad region (Ashburn, Virginia, US). It shares that machine with my other Shopify apps, but it runs as its own process with its own database. Its data is stored on that server’s disk.

Backups: Fly.io takes a daily snapshot of the disk, and each snapshot is kept for 14 days. So data deleted from the app’s database can remain in a snapshot for up to 14 days, after which it’s gone. Snapshots are used only to restore the service after a failure.

The app’s screens run inside your Shopify admin and load Shopify’s own App Bridge and Polaris files from Shopify. They load nothing from anyone else.

Deleting your data

When you uninstall: the app deletes your store’s access token at once and stops all work for your store. About ten minutes later (so a quick reinstall doesn’t lose your setup), it deletes everything else it stores for your store: settings, catalog, stock, sales totals, suggestions, suppliers, component maps, purchase orders, job records and tour progress. All of it is gone within an hour. Shopify also sends a request to erase your store’s data 48 hours after you uninstall, and the app deletes anything left at that point. Reinstalling after that starts fresh.
To keep your data, export a store bundle from Import & export before you uninstall.
In the app: delete a supplier or a component map from its own page.
Ask me: email support@christianortiz.studio from your store’s contact address with your myshopify domain, and I’ll confirm what’s stored or delete it.

The app handles Shopify’s mandatory privacy requests:

Customer data request and customer redaction: the app stores no customer data, so there’s nothing to report or delete. It records only that the request arrived.
Shop redaction, sent 48 hours after you uninstall: the app deletes everything it stores for your store.

Every request from Shopify is checked for Shopify’s signature before the app acts on it.

Logs

The app’s server writes a log so I can find and fix problems, kept by Fly.io’s log service. Log lines can include your store’s domain, the name of a job that failed and Shopify’s error messages. When Shopify sends a customer privacy request, the log line recording it includes the customer ID from Shopify’s request. Logs contain no customer names, emails or addresses.

Who’s responsible for your data

For the data the app handles from your store, including supplier contacts you enter, you (the merchant) are the controller and I’m the processor: the app processes it only to do what you ask it to.
For support emails you send me, I’m the controller.
Under the California Consumer Privacy Act, I’m your service provider. I don’t sell or share personal information.

I don’t sell, rent or share your data with anyone. The app’s data is handled by Shopify, as the platform it runs on, and by Fly.io, which hosts its server, database and backups (Fly.io’s privacy policy). There are no other third parties: no analytics, no email service and no AI service. I’d disclose information only if the law required me to.

Security

The app asks only for the read permissions it needs. It can’t change your store.
It uses Shopify’s own sign-in for embedded apps: every request from your admin carries a session token from Shopify, which the app verifies.
Every notification from Shopify is checked for its signature, and unsigned ones are refused.
Connections to the app are encrypted (HTTPS). Access to the server and database is limited to me.
Security contact: email support@christianortiz.studio with Security in the subject line. I acknowledge security reports within two business days.
If I learn of a security incident that affects your data, I’ll tell affected merchants without undue delay.

Your rights

Depending on where you live, you may have the right to access, correct, delete or move your personal data, or to object to how it’s used. Email me and I’ll respond within 30 days. If a supplier contact or a customer of your store contacts me directly, I’ll pass the request on to you.

Children

The app is a business tool and isn’t directed at children.

Changes to this policy

If I change this policy, I’ll update the date at the top of this page. If a change affects how your data is handled in a meaningful way, I’ll also say so in the app or its App Store listing before it takes effect.

Contact

Christian Ortiz, publishing as Christian Ortiz Studio
support@christianortiz.studio