Privacy policy

What the app stores

When a manager buys a Shopify Shipping label from the order page, the app stores on the order the tracking number, the carrier, the tracking URL, the Shopify label id, the staff member who bought it, and the name of the order's delivery method. Shopify does not give the app a label's price, so no price or currency is stored. The shop's audit log records the Shopify label id, the Shopify purchase result id, the tracking number, the tracking company, the carrier code, the delivery method name, and the Shopify label document URL. EasyPost label buying is not available yet. When EasyPost labels are live, the app will store the tracking number, the carrier, the tracking URL, and the EasyPost label file URL for an order that has a label, so the seller can ship the order, reprint the label, and request a void. The label file will be hosted by EasyPost. This app will store the URL, not a copy of the label file. That file will show the customer's name and the shipping address. These fields will stay until Shopify asks us to delete that customer's data, until the order is deleted 365 days after it last changed, or until the shop is erased.

The app does not store a customer's name, email, phone, or street address as its own fields. A packing slip reads the ship-to name and address and prints them on the slip. It does not store them. An order row keeps a Shopify order id and the order name.

Shopify Shipping label buying is limited to store managers and owners on the order page; floor sign-ins are never allowed to buy one. When a manager buys a Shopify Shipping label from the order page, the app sends Shopify that order's Shopify fulfillment order id, the package dimensions and weight, and a ship date. The app does not choose the carrier or service: Shopify keeps the delivery method the customer chose at checkout when that rate is available, and otherwise uses its default selection. Shopify sets the price; the app cannot see or cap it. The app does not send an address; Shopify uses the shipping address it already has for that order. The app asks Shopify not to notify the customer. The label is paid through the seller's own Shopify Shipping account and Shopify bill, not by Maverick Solutions. EasyPost label buying is not available yet. When EasyPost labels are live, buying an EasyPost label will send that order's shipping address, the warehouse address, and the package dimensions and weight to EasyPost. Those sends will be only to make the label.

A store manager can save an EasyPost API key on the app's EasyPost settings page. The seller's EasyPost API key is encrypted before it is stored, and the settings page shows only the last 4 characters. After uninstall, that encrypted key is kept for up to 7 days. EasyPost label buying is not available yet. When EasyPost labels are live, that key will be kept after uninstall only to request refunds for voided labels, and deleted once those refunds settle. The daily check can take that to 8 days. Reinstalling within that window keeps the key. A shop data erasure request deletes it immediately.

When a store owner turns on sending to printers and saves their own PrintNode API key, the app uses PrintNode (printnode.com) to send pages to the seller's printers. Today the only page sent is a test page with the printer's name and the time; it has no order or customer data. The PrintNode key is encrypted before it is stored, the Printers page shows only the last 4 characters, and it is deleted when the app is uninstalled or the owner removes it. PrintNode bills the seller's own PrintNode account.

A Shopify session stores the shop staff member's name and email from that session. Floor staff rows store an email and a password stored as a one-way hash. Failed sign-ins store the IP address so the app can lock out repeated attempts.

If the owner turns on web sign-in, an owner or manager who sets it up has a web password stored as a one-way hash, a 2FA secret that is encrypted before it is stored, 10 recovery codes stored only as one-way hashes, and web sign-in sessions. A web session cookie holds only a random value; the app stores a one-way hash of it. Web sessions end after 8 hours, or 30 minutes without use. Failed web sign-in addresses follow the same 24-hour rule as other failed sign-ins. Web pages read the shop's data with the shop's offline Shopify access, and only for that shop.

The app also stores that shop's warehouse work: bins, receipts, picks, packs, shipments, holds, and inventory counts. The app records who counted each bin and when they started and submitted. Managers and owners can see per-worker average time and variance rate. Returns and refunds sync from Shopify. Access tokens on the Shopify session are encrypted before they are written.

When an owner or manager imports a CSV of bins or stock, the app keeps a history row for that import: who imported it, how many rows were in the file, how many were saved, how many failed, and the rejection reasons for the rows that were not saved. That history is shop work, not customer data. A customer data request or a customer delete does not include it or clear it. It is kept until the shop is erased.

A damage photo taken while receiving is stored with its hold, up to 1.5 MB. Only owners and managers can view it, on the receipt. It is kept as long as the hold record and is deleted with the rest of the shop's data on a shop data erasure request.

Customer privacy requests

When Shopify asks us to export one customer's data, we store a copy of the tracking number, the carrier, and the tracking URL for the orders Shopify lists. We store that copy so the shop owner can give it to the customer. EasyPost label buying is not available yet. When EasyPost labels are live, that copy will also include the EasyPost label file URL and the EasyPost shipment id. The label file will show that customer's name and shipping address. We will store the URL, not a copy of the label file. This app does not send email. The shop owner sees a notice in the admin with a download. That file stays for 30 days. The daily check can take that to about 31 days. We record the time the owner downloads it. We do not put that file in the webhook response. Name, email, phone, and street address are not stored as separate fields, so they are not separate fields in the download.

When Shopify asks us to delete one customer's data, we clear the label file URL, tracking number, carrier, and tracking URL stored on the orders Shopify lists. For Shopify Shipping labels and shipments on those orders, we also clear from the audit log the tracking number, tracking URL, tracking company, label document URL, Shopify label id, label reference, purchase result id, label claim reference, cancel error, and delivery method name, and the tracking number recorded with each ship. The audit log keeps the carrier code, what was done, by whom and when, the Shopify fulfillment id, and the shipped quantities. There is no label file stored in this app to delete. A ship still in progress stays. EasyPost label buying is not available yet. When EasyPost labels are live, a label that was bought and has not shipped will stay, so the shipment can finish and a second label is not bought. Those skipped fields will stay on the order until the order is deleted 365 days after it last changed, or until the shop is erased. They will not be cleared when the shipment later finishes. The EasyPost shipment id will stay until the order is deleted or the shop is erased, so a void can still be requested. A stored copy of those orders is removed from the download.

How long we keep it

A daily check deletes an order 365 days after that order last changed, when that order is cancelled or every fulfillment is shipped, cancelled, or closed. That delete removes the fulfillment rows, pick tasks, pack and ship rows, label file URL, tracking, released holds, and manager notes on that order. The daily check can take that to about 366 days.

These orders stay. An open order stays. An order with a ship still in progress stays. An order with an open hold stays. An order with an unfinished pick stays. An order with picked stock that has not shipped stays, and a cancelled order is kept for the same reason. EasyPost label buying is not available yet. When EasyPost labels are live, an order with an open label refund will stay, and an order with a label purchase still in progress will stay.

Inventory movements stay until the shop is erased. Cycle counts stay until the shop is erased. Bins and receipts stay until the shop is erased.

Audit rows are deleted 365 days after they were written. The dashboard shows the latest of those rows. A count's variance stays on the count. The daily check can take that to about 366 days.

A record of a message Shopify already sent is deleted 30 days after it was received, once the handler has finished. A handler that is still working is kept. The daily check can take that to about 31 days.

An inventory update Shopify has already accepted, or that the app has given up on, is deleted 90 days after the last attempt. An update that is still waiting is kept. The daily check can take that to about 91 days.

A person who was turned off, other than the owner, is deleted 90 days after that row last changed, once no audit row still names them. The owner row stays, including an owner who was turned off. The catalog system user is not a person and is not deleted by this check. The daily check can take that to about 91 days.

A repeated floor submit is remembered for 7 days so the same tap does not run twice. The daily check can take that to about 8 days.

Failed sign-in addresses are kept for 24 hours after that sign-in window ends. They are not tied to the shop, so uninstalling does not delete them sooner. The daily check runs once a day, so a row can stay until the next check.

Neon Launch point-in-time restore keeps change history for 1 day by default. The window can be set up to 7 days. A deleted row can stay in that history until the window ends.

When you uninstall

When you uninstall, the app marks the shop uninstalled, deletes floor and web sign-in sessions, and deletes the Shopify session rows. Those session rows held the staff name, email, and access token. The encrypted EasyPost key stays for up to 7 days. EasyPost label buying is not available yet. When EasyPost labels are live, open label refunds will be requested by the daily check, not during uninstall, and the key will be kept only to request refunds for voided labels and deleted once those refunds settle. The daily check can take that to 8 days. Reinstalling within that window keeps the key. A shop data erasure request deletes it immediately. A saved PrintNode key is deleted at uninstall.

The shop's warehouse work stays until 48 hours later, when Shopify asks us to erase the shop's data. Until that erase, bins, receipts, picks, packs, shipments, holds, inventory counts, inventory movements, CSV import history, label file URLs, and tracking numbers stay. The erase deletes the shop and those rows. It also deletes shop staff and floor staff rows (name, email, and the password stored as a one-way hash), the failed-login counts stored for an email, leftover Shopify sessions, records of messages Shopify already sent, and the email lockout rows. It also deletes web sign-in data: web passwords, 2FA secrets, recovery codes, setup links and web sessions.