Who we are
OrderSmith is a Shopify app made by BoredApp Inc. (“BoredApp”, “we”, “us”), a company based in Ontario, Canada. Merchants install it to build order forms for configurable products. Shoppers then configure those products on the merchant’s store, and OrderSmith prices each build and records a build sheet for the order.
This policy explains what personal information OrderSmith handles, why, where it is kept, for how long, and the choices you have. It covers the OrderSmith app and this website. Questions go to our privacy officer at info@boredapp.io.
Our role
- For merchants and their staff, BoredApp Inc. decides how the data needed to run your account is used. Under the GDPR we are the controller of that data.
- For shoppers who use an order form on a merchant’s store, the merchant is the controller (a “business” under the CCPA). BoredApp Inc. is the merchant’s processor, or “service provider”: we process shopper data only to provide OrderSmith to that merchant, on the merchant’s instructions, under our Terms of service and Data processing addendum.
If you are a shopper, the store you bought from is your first point of contact for your data. Its privacy policy applies to your purchase. We help merchants answer shoppers’ requests (see Your rights).
Merchant and staff data
When a store installs OrderSmith, Shopify gives us access to the store through the permissions the merchant approves. We use it as follows.
| What | Why we use it |
|---|---|
| Store details: the shop’s domain, install status and OrderSmith settings | To run the app for your store. |
| Access tokens issued by Shopify | To act in your store on your behalf, for example when you publish an order form. They are kept on our servers and never sent to browsers. |
| Staff details: the email address and name Shopify provides for the staff member using the app | To show who published, restored or reviewed something, and to keep an activity log for your store. |
| Your content: components, order forms, templates, sales, versions and the pictures you upload | To provide the order form builder, publishing and history. |
| Products in your store: titles, variants, prices, metafields, files and sales channels | To publish order forms to your products, price builds, and copy order form pictures into your store’s Shopify Files. |
| Orders: line items and their properties when an order is created | To match configured lines to their build sheets, check their prices, and tag orders that need a person to look at them. |
OrderSmith does not request or store shoppers’ names, email addresses, postal addresses or phone numbers from orders, and it never handles payment details. Shopify’s checkout takes payment.
Shopper data
When a shopper uses an OrderSmith order form on a merchant’s store, we process the following for that merchant:
- Configuration answers. These are the choices made in the order form, including any text typed into it (for example, a name to engrave). We use them to price the build, put it in the cart, and record a build sheet for the merchant.
- Uploaded files. These are files added to a file field, such as logo artwork, up to 15 MB each. They are stored behind a long, unguessable link that travels with the order, so the merchant can open them. Anyone who has the link can open the file.
- Order references. These are the order number, order ID and line, which tie a build to the order that bought it.
Shoppers should not enter sensitive information, such as health details or ID numbers, into an order form, and merchants should not set up order form fields that ask for it.
To add a build to the cart, OrderSmith creates a temporary product variant in the merchant’s store. While OrderSmith is installed, it is deleted automatically: after 24 hours if it was never added to a cart, otherwise after 14 days. For vehicle-fitment products, OrderSmith also creates a temporary variant on a hidden “Options” product, carrying the price of the chosen add-ons. It is deleted once the order is placed, or after 3 days. The order keeps its own copy of each line.
Deleting these variants needs the store’s access, which ends when OrderSmith is uninstalled. Any temporary variants left in the store at that point stay there under the merchant’s control, like the store’s orders and Shopify Files.
The order form saves answers in the browser’s session storage while a shopper adds to the cart. This is cleared when the tab is closed. OrderSmith sets no cookies on the storefront and uses no tracking, analytics or advertising tags.
Logs and the website
Our servers keep standard request logs: IP address, browser type, the address requested, and the time. They also keep application logs, which record counts and errors, not shopper data. We use them to keep OrderSmith secure and working, and they are deleted after about 30 days.
This website uses no analytics and no cookies. If you email us, we use what you send to reply. We keep it for as long as the conversation and our business records need it.
What we don’t do
- We don’t sell personal information, or share it for cross-context behavioural advertising.
- We don’t show ads, build profiles, or make automated decisions with legal or similarly significant effects.
- We don’t use one merchant’s data for another merchant.
- We don’t send merchant or shopper data to AI services. If we add an AI feature, we will update this policy and name the provider before it is turned on for any store.
Where data is stored and who processes it
OrderSmith uses one sub-processor, besides Shopify itself:
| Provider | What it does | Location |
|---|---|---|
| Google LLC (Google Cloud, Firebase) | Runs the app (Cloud Run). Stores data (Firestore), files (Cloud Storage), logs and backups. | United States |
Shopify runs the platform that OrderSmith works in. Your store, your orders and the pictures copied into your Shopify Files are held by Shopify under Shopify’s privacy policy.
Data is stored in the United States, so it may be accessed by authorities there under US law. Data from the European Economic Area, the United Kingdom and Switzerland comes to BoredApp Inc. in Canada, which those places recognise as giving adequate protection. Google is bound by data protection terms that include the European Commission’s Standard Contractual Clauses. Our Data processing addendum sets out the details.
Retention and deletion
| Data | Kept until |
|---|---|
| Access tokens | The app is uninstalled |
| Store details, staff details, your content and activity log | 48 hours after the app is uninstalled |
| Build sheets, configuration answers, order checks and uploaded files | The merchant or Shopify asks us to erase that shopper’s data, or 48 hours after uninstall, whichever comes first |
| Temporary build variants in the store | 24 hours if never added to a cart, otherwise 14 days, while OrderSmith is installed |
| Temporary “Options” variants (vehicle-fitment products) | The order is placed, or 3 days, while OrderSmith is installed |
| Temporary variants left in the store at uninstall | They stay in the store, under the merchant’s control |
| Server logs | About 30 days |
| Backups | Replaced on a rolling basis, gone within 30 days |
How deletion works
- Uninstall. When a store uninstalls OrderSmith, its access tokens are deleted straight away. Shopify sends a shop erasure request 48 hours later, and we then delete everything we hold for that store: content, build sheets, uploaded files, staff details and the activity log. Backups expire within 30 days after that.
- Shopper erasure. When a shopper asks a merchant to erase their data, Shopify sends us the orders involved. We delete the build sheets, order checks and uploaded files tied to those orders.
- Shopper data requests. When a shopper asks a merchant for their data, Shopify tells us which orders. OrderSmith collects what it holds for those orders and shows it to the merchant in OrderSmith’s Settings, so the merchant can include it in their reply.
Information already in the merchant’s Shopify store, such as order lines and their properties, and pictures in Shopify Files, stays in that store under the merchant’s control.
Security
- All traffic to and from OrderSmith is encrypted with TLS (HTTPS), and data is encrypted at rest by Google Cloud.
- The database and file storage refuse direct access from browsers. Only OrderSmith’s servers reach them, with the least access they need.
- Requests from Shopify, such as webhooks and storefront requests, are checked against Shopify’s signature before they are used.
- Testing and production run in separate projects. Access to production is limited to authorised BoredApp Inc. personnel.
If a security breach affects personal information, we will tell the affected merchants, and Shopify, without undue delay. Where the law requires, we will also tell the regulators and the people affected.
Your rights
Depending on where you live, you can ask to see, correct, delete or receive a copy of your personal information. You can also object to or restrict how it is used, or withdraw consent. We will not treat you differently for asking.
- Canada (PIPEDA and provincial laws). You can access and correct your information, withdraw consent, and complain to the Office of the Privacy Commissioner of Canada.
- European Economic Area, United Kingdom and Switzerland (GDPR, UK GDPR, FADP). We rely on these legal bases: contract, to provide OrderSmith to the merchant; legitimate interests, for security, logs and the activity log; and legal obligation. You can complain to your local data protection authority.
- United States (California CCPA/CPRA and other state privacy laws). You can ask to know, delete and correct, and to opt out of sale or sharing. We do neither. You can use an authorised agent.
Merchants and staff: email info@boredapp.io. Shoppers: please contact the store you ordered from. Its request reaches us through Shopify, and we help it answer. If you write to us directly, we will pass your request to that store.
We reply within 30 days, and may ask you to confirm your identity first.
Children
OrderSmith is a tool for businesses. It is not directed at children, and we don’t knowingly collect children’s information.
Changes to this policy
When this policy changes, we update it here with a new effective date. If a change matters to how your data is used, we will tell merchants in the app or by email before it takes effect.
Contact
BoredApp Inc.
3060 Davidson Court Unit C2, Suite 1004
Burlington, ON L7M 4X7
Canada
info@boredapp.io
See also: Terms of service · Data processing addendum