Privacy Policy

Who we are

This policy explains how İzzet Uzunalioğlu, sole proprietorship trading as Caelus Technology ("we", "us") handles data in the Shopify app "Reorderly" (the "app"). Merchants install the app. It gives the merchant's B2B buyers a page in their customer account to search past orders, reorder, export CSV, download invoices and see company pricing.

For merchant and buyer data that the app receives from Shopify, the merchant is the data controller and we act as processor on the merchant's behalf. For the merchant's own account data (for example support messages) we are the controller.

What data the app processes

The app keeps only what it needs. Data is stored in a Postgres database, separated by shop.

• Shop record: shop domain, country, import status and progress, and technical error codes.
• Session: staff sessions created by Shopify sign-in for the merchant admin. A session holds the access token and the staff member's name, e-mail, locale and user id as provided by Shopify. Sessions are deleted when the app is uninstalled.
• Order index (Level 1 protected customer data): order number, date, PO number, currency, total, payment and fulfillment status, cancellation date, and Shopify identifiers of the order, customer, company and company location.
• Order line index: SKU, product and variant titles, quantity, unit price, and Shopify identifiers of the line, product and variant.
• Company access: which buyer (Shopify customer identifier) has which role (Location admin or Ordering only) at which company location. It decides which orders a buyer can see.
• Billing status: plan, interval, trial end and whether the founding discount applies. Payment is handled by Shopify.
• Trial ledger: the shop domain and the date of its first free trial end. We keep these after uninstall, to prevent repeated free trials (our legitimate interest in preventing abuse). They contain no buyer or staff data.
• Download link records: a random token id, shop, buyer identifier, kind of download and a reference (for example an order identifier or export filter), expiry and use count.
• Invoice settings: logo address, company name and address, tax ID, number prefix and footer note entered by the merchant.
• Issued invoice numbers: the order identifier, the invoice number and the issue date.
• Invoice number counter: the shop domain and the last invoice number used. It contains no personal data. We keep it after uninstall, so that a reinstall never reuses an invoice number.
• Invoice ZIP: a temporary file for bulk invoice download (see "Where personal data exists").
• Company pricing rules and pricing settings: company or location identifiers, rule values, and the state of the Shopify discount that the app manages.
• Support tickets: messages and chat transcripts the merchant sends us, and records of Shopify customer data requests.
• Assistant message counter: a per-shop, per-day count of Help assistant messages.
• Usage counters: a per-shop count of buyer searches, including a monthly count used for the Free plan limit, and whether we have asked for an app review.
• Reorder attribution: order identifier, total and date of orders placed through the app's reorder flow.
• Reorder reminders sent: for stores on a plan with reorder reminders, a record of each "Reorder due" trigger sent to the merchant's Shopify Flow (shop, Shopify customer identifier, product variant identifier and due date), kept 180 days so the same reminder is not sent twice. We never e-mail buyers ourselves: the merchant sends any e-mail through Shopify Flow under their own brand and is responsible for the buyer's e-mail consent.
• Saved lists: list name and the items and quantities a buyer saved (Shopify customer identifier, product variant identifier, SKU, product title and quantity), kept until the buyer deletes the list or the data is deleted as described below.
• Access log: which buyer (identifier) used which feature (search, export, invoice, invoice ZIP) and how many results. It never contains search text, names, e-mail or addresses.
• Background job queue: internal jobs in the same database that contain shop and Shopify identifiers only.

Where personal data exists

The database tables above have no columns for a buyer's name, address, e-mail or phone number. Personal data of that kind exists only in these places:

• Invoice PDFs are generated on demand from live Shopify data and are not stored.
• Invoice ZIP files for bulk download contain those PDFs, including the buyer's name, address, e-mail and phone. They are held in the database for 1 hour and then expire. Expired files cannot be downloaded and are deleted when the shop requests a new ZIP and by a daily cleanup job.
• Sessions hold the name and e-mail of the merchant's staff members.
• Support messages: whatever a merchant types into a support message or the chat. Please do not paste order or buyer data there.
• PO numbers and product titles in the order index can contain text that a merchant or buyer chose to enter.
• We do not store payment card or bank details.

Invoices

When a buyer asks for an invoice, the app reads the order from Shopify at that moment. Level 2 protected customer data is needed for this: the buyer's name, e-mail, billing address and phone number. Without Level 2 approval for the store, these fields, and the company name and tax ID, may be left blank on the invoice. The invoice is delivered through a private download link. A link is valid for 5 minutes and is tied to the shop and the buyer. Because browsers often open a link more than once, after the first use it keeps working for 120 seconds, up to 5 times in total, and never past its original 5 minutes. Link records are deleted a day after they expire.

Changes the app makes in your store

For company pricing the app creates and updates one automatic discount called "Reorderly company pricing" and writes app metafields on company locations (write_discounts and write_companies access). Shopify allows at most 25 automatic discounts per store, so creating it fails if the store is at that limit. The app also reads companies, customers, orders and products, and which catalogs and sales channels each product is published to so buyers only see products they can buy (read_companies, read_customers, read_orders, read_all_orders for order history older than 60 days, read_products, read_publications).

Help assistant and support e-mail

The Help page in the merchant admin has an assistant powered by a language model service. It receives our help articles, the store's setup status (plan, order import progress, whether extended order access is granted, and scrubbed technical error codes) and the text the merchant types. The app does not send order or buyer data to the assistant. Please do not type buyer or other personal data into it.

When a merchant uses the e-mail form, we save the message and chat transcript as a support ticket and e-mail them to our support mailbox. To let us reply, we read the shop's contact e-mail from Shopify when the message is sent and use it as the reply address of that e-mail. We do not store it in our database.

Service providers

The app and its Postgres database are hosted by Railway in its EU West region (Amsterdam, the Netherlands).

We use these providers. They process data only to provide their service to us.

• Shopify: platform, sign-in, billing and the source of order and company data.
• Railway: application hosting and the Postgres database, in its EU West region (Amsterdam, the Netherlands).
• Sentry: error monitoring. We configure error reports to exclude request data, cookies, headers and user details, and we scrub message text, to keep buyer data out of error reports.
• Google (Gemini API): language model for the Help assistant. It receives only what is described in the previous section, never buyer or order data.
• Google Workspace (Gmail): sends support e-mails, including the merchant's contact e-mail as the reply address.

Security

Traffic to the app uses HTTPS (TLS). Buyer requests are authenticated with Shopify session tokens, and a buyer can only see orders that belong to them or to company locations where they are a Location admin. Download links are signed, short-lived and tied to the shop and the buyer. Our application logs use event names and internal identifiers and do not contain buyer names, e-mail addresses, addresses or search text. We keep data to a minimum and delete it as described below.

Retention and deletion

We keep a shop's data while the app is installed, with these shorter limits: invoice ZIP files 1 hour, download link records until a day after expiry, the access log 90 days and reorder reminder records 180 days.

Support tickets are deleted 3 years after they were created, or 48 hours after uninstall, whichever comes first. Chat counters are kept while the app is installed.

When a merchant uninstalls the app, sessions are deleted immediately and all other data of the shop (order index, company access, billing status, settings, invoices, pricing, tickets, counters, access log) is deleted 48 hours after uninstall. The only exceptions are the trial ledger entry (shop domain and first trial end date), which we keep to prevent repeated free trials, and the invoice number counter (shop domain and last invoice number), kept so a reinstall never reuses an invoice number. We also handle Shopify's mandatory privacy webhooks:

• customers/data_request: we record the request with the data we hold about that customer (order index, company access, saved lists and reorder reminder records), and provide it to the merchant manually.
• customers/redact: we delete that customer's orders and lines, company access, download link records, invoice ZIPs, access log entries, reorder reminder records, saved lists and data request records. Issued invoice numbers (an order reference and an invoice number, with no buyer details) are kept for the merchant's tax records until the shop's data is deleted. Background job records that can hold a customer reference are not deleted by this request; the job queue removes them automatically (with its default settings, completed jobs are archived after 12 hours and deleted 7 days later, and jobs that never complete expire after 14 days).
• shop/redact: for a shop that has uninstalled, we delete all remaining data of the shop immediately, except the trial ledger entry and the invoice number counter described above. For a shop that is still installed we ignore it, so that a reinstall does not lose data.

Legal retention

We do not keep invoice records after uninstall: issued invoice numbers are deleted with the other shop data, 48 hours after uninstall. The only things we keep are the trial ledger entry described above and the invoice number counter (shop domain and last invoice number), kept so a reinstall never reuses an invoice number. The counter holds no personal data.

Invoice PDFs are produced from the merchant's Shopify order data and are not stored by us. The merchant must keep its own copies for as long as its tax and accounting law requires (for example 5 years or more in Turkey and 10 years in some other countries). Please download them before uninstalling.

Your rights

Buyers who want to see, correct or delete their data should contact the merchant they bought from. The merchant can request an export or deletion through Shopify, which reaches us through the webhooks above. You can also write to us and we will help route the request. Where laws such as the GDPR apply, you may have rights of access, rectification, erasure, restriction and objection, and the right to complain to your data protection authority.

Türkiye: for merchants and their staff in Türkiye, the notice under Article 10 of Law No. 6698 (KVKK) is at /kvkk (Turkish).

Changes to this policy

If we change this policy we will update the date at the top of this page. For material changes affecting merchants we will also tell them in the app or by e-mail.

Contact

Questions or requests about privacy: support@caelustechnology.com.

İzzet Uzunalioğlu, sole proprietorship trading as Caelus Technology, KONUTKENT MAH. 2960 SK. ÖZDE EVLER NO: 2 /9 ÇANKAYA/ ANKARA

Tax ID: Doğanbey Tax Office, 9030071903