Data processing addendum: Order Documents

Last updated: 2026-10-26

This addendum applies to personal data of your customers that Order Documents processes on your behalf. You (the merchant) are the controller; we are the processor.

Subject matter and purpose

We process order data (customer name, shipping and billing address, email, order contents and notes) only to generate the documents you request, to deliver them to you and, when you choose to email an invoice or quote, to send it to the recipient you confirm, or, when you turn on automatic invoice email, to send each newly paid order's invoice to the order's email address, following your instructions in the app.

Categories of data and data subjects

Data subjects: your customers. Data: name, shipping and billing address, email, order lines and customer note as present on the Shopify order or draft order, and for emailed documents the recipient address, subject and message.

Duration and deletion

Saved documents and batch jobs are deleted 30 days after creation. Email recipient addresses and email bodies (with the subject) are stored encrypted and deleted 30 days after the email was created. Resend, our email provider, keeps its own copy of each email sent through it for up to 30 days. All data for a shop is deleted when Shopify sends the shop erasure request after uninstall, and a customer's stored documents and the emails for their orders are deleted on Shopify's customer erasure request. A customer's quotes and quote emails are deleted on the same request when the draft order's email matches the customer's email address in the request, found by a keyed hash of the draft order's email stored with each quote and quote email (never the address itself); a quote for a draft order without an email address, or with a different address, can't be matched and is deleted within 30 days of creation anyway. Access records contain no customer personal data (staff are recorded by Shopify user id only) and are kept for 90 days. The record of which orders were emailed automatically holds only the order id (no name, address or email) and is deleted with the shop's data or on the customer erasure request for those orders. Shopify's order-updated and order-paid notifications contain the full order; we read only the order id and its update or creation time, and discard the rest without storing or logging it.

Our obligations

• Process personal data only on your documented instructions (use of the app).
• Ensure that people with access are bound by confidentiality. Production access is limited to the owner.
• Keep appropriate security measures: encryption at rest, signed expiring links, per-shop isolation, an access log for protected data reads, application logging that redacts customer names, addresses and emails (uncaught framework errors may include error text).
• Assist you with data subject requests (access, erasure) and answer Shopify's privacy webhooks.
• Notify you without undue delay, and in any case within the time the law requires, after becoming aware of a personal data breach.
• Delete the data as described above when processing ends.
• Make available information needed to show compliance and allow reasonable audits.

Subprocessors

You authorise the use of the following subprocessors. We will update this list before adding or replacing one.

• DigitalOcean (DigitalOcean, LLC): Application hosting and the PostgreSQL database. Runs the app and stores all data the app keeps (shop settings, saved documents, email records and access logs; order data and email contents encrypted by the app). Region: United States (San Francisco).
• Backblaze (Backblaze, Inc.): Encrypted nightly database backups, kept for 30 days. Backups are encrypted before they leave our host. Region: United States.
• Resend (Resend, Inc.): Sending document emails. Receives the recipient address, subject, message and PDF attachment of each email you send from the app, and reports delivery and bounces. Region: United States (check against Resend's DPA).

Contact

Questions, data requests and security reports: support@merchfinch.com.