Privacy policy: Order Documents

Last updated: 2026-10-26

Order Documents is a Shopify app that creates packing slips, invoices and quotes from your orders and draft orders, and can email invoices and quotes to your customers. This page explains what data the app processes and why.

What we process

For orders you choose to print, the app reads from Shopify: the order number, line items, shipping address, billing address, customer name and email, and the customer note. For draft orders you open or quote, it reads the draft's number, line items, shipping and billing address (with name and company), customer email and note. It reads this data only when you open an order or draft order, generate a document, run a batch or send an email. We also store your shop domain, your business details and logo (settings you enter), and your plan. When you email an invoice or quote, we store the recipient address, subject and message, and send them with the PDF to our email provider (see Subprocessors), with your reply-to address.

Shopify also sends the app a notification with the full order (including customer details) whenever an order of your shop is updated and whenever one is paid. The app receives the paid-order notification for every paid order of your shop, whether or not automatic invoice email is turned on. From the update notification it reads only the order id and the time of the update, to mark saved documents for that order as outdated; from the paid notification it reads only the order id and the order's creation time. The rest of each notification is discarded: it is not stored or logged.

If you turn on automatic invoice email (Paid plan), the app then reads that order and its customer's email from Shopify and emails the invoice to that address the same way. It keeps a record of each order emailed automatically, which holds only the order id (no name, address or email), so that no order is emailed automatically twice.

Why

Only to produce the documents you request and to operate the app (usage limits for the free plan, billing status, security and abuse prevention). We do not sell personal data, use it for advertising or share it with anyone except the subprocessors below.

Retention

Generated documents, batch jobs and the order data saved in them are deleted automatically 30 days after creation. Email recipient addresses and email bodies (with the subject) are stored encrypted and deleted 30 days after the email was created. Resend, our email provider, keeps its own copy of each email sent through it for up to 30 days. Records that an access took place (who, what, when, with an order or document id and no customer names or addresses; staff are recorded by Shopify user id only) are kept for 90 days, and so are records of customer data requests we receive from Shopify. The record of which orders were emailed automatically holds only the order id (no name, address or email) and is kept until your shop's data, or that customer's, is erased. Records that a Shopify or email-service notification was already handled (its id and type, with no order or customer data) are kept for 7 days. Our application logging redacts customer names, addresses and emails (uncaught framework errors may include error text).

Security

Order data in saved documents and the recipient, subject and message of emails are encrypted at rest. Download links are signed and expire after 15 minutes. Every shop can only access its own data. Access to protected customer data is logged.

Subprocessors

Deletion and data requests

When you uninstall the app, jobs stop and your sessions are removed; Shopify then sends a shop erasure request about 48 hours later, and we delete all data held for your shop. We process Shopify's customer data request and customer erasure requests: erasure removes the stored documents and emails for the customer's orders, and a data request is answered to you, the merchant, within 30 days. Quotes are made from draft orders, which Shopify's requests do not list, so we find a customer's quotes by the email address on the draft order: each quote and each quote email stores a keyed hash of the draft order's email (never the address itself). Erasure also removes the quotes and quote emails that match the customer's email address, and a data request includes them. A quote for a draft order without an email address, or with a different address from the one in Shopify's request, can't be matched this way; it is deleted within 30 days of creation anyway. You can also write to us at the contact address below.

Our data processing addendum sets out the terms for merchants.

Contact

Questions, data requests and security reports: support@merchfinch.com.