Privacy policy

FixOrder is a Shopify app made by Sallitar. This policy describes exactly what the app reads, stores, and deletes.

Effective October 12, 2026

Who we are

FixOrder (“we”) is operated by Sallitar. Questions about this policy or your data go to sallitar.apps@gmail.com.

For order and customer data, the merchant who installed FixOrder is the controller and we process it on their behalf. Customers who want to access or delete their data should contact the store they bought from; the store's request reaches us through Shopify (see Data requests and deletion).

What we read from Shopify

When a customer opens an order in a FixOrder block, the app reads that one order live from the Shopify Admin API. It doesn't keep a copy of the order or the customer. The fields it reads are:

the order's ID, name, confirmation number, status, tags, and the order email;
the customer's Shopify ID and first name;
the shipping address: name, company, street, city, province, country, postal code, and the shipping-address phone number;
line items with their prices, variants, product tags, and images;
the order's Shopify Protect status;
your shop's name, myshopify.com domain, email, contact email, and currency.

The phone number is read only because it is part of the shipping address: Shopify replaces the whole address on an update, so the app must send the phone back to avoid erasing it.

FixOrder doesn't read payment details, billing addresses, order history, or marketing consent. It subscribes to the orders/create, orders/updated, orders/cancelled, and fulfillments/create webhooks; their contents are not stored, and the logs record only the topic, shop, and order ID.

What we store

The app's database holds these records and nothing else:

Record	What it contains	How long it's kept
Shop session `Session`	Your shop's domain and the Shopify access token (with its granted scopes, expiry, and refresh token, if any) that FixOrder uses to call the Admin API.	Deleted as soon as you uninstall the app.
Shop record `Shop`	Your shop's domain, install and uninstall dates, billing status and subscription ID, and setup signals: when each customer block last loaded, when an order webhook last arrived, how many orders shipped inside the edit window, and when you last dismissed the failed-email notice.	Until shop/redact (48 hours after uninstall).
Settings `ShopSettings`	Your edit window, which actions are on, blocked tags, cancel reasons, email on/off switches and templates, the optional merchant notification email, and when and by which Shopify staff user ID the Shopify Protect notice was acknowledged.	Until shop/redact (48 hours after uninstall).
Edit log `EditRequest`	One row per customer change: the order ID and name, the action, which page it came from, the result, and timestamps. It also keeps what the customer submitted: for an address fix, the new shipping address (name, company, street, city, province, country, postal code, and phone); for a swap, the line item and variant IDs; for a cancel, the chosen reason. It holds no customer ID and no email address.	For as long as the app is installed, until customers/redact for that order or shop/redact.
Email outbox `EmailMessage`	The confirmation emails to the customer and the merchant: recipient, subject, body, and delivery status.	Recipient, subject, and body are erased as soon as the email is handed to the mail provider, or once delivery has failed for good. The empty row (status and timestamps) stays as the "already sent" marker until customers/redact or shop/redact.

Application logs record shop domains, order IDs, action results, and error codes. Email addresses are masked in every log line. The app doesn't log shipping addresses, although an error message returned by Shopify can occasionally quote a submitted field, such as an invalid postal code. Log retention is set by the hosting provider.

How we use it

to show a customer what they can change on their own order, and to apply that change;
to send the customer and the merchant a confirmation email about the change;
to show the merchant recent changes, setup status, and email delivery problems in the app.

We don't sell or share personal data, send marketing, build profiles, or use it to train models. Customer emails are transactional only, and merchants can turn them off.

Cookies and tracking

These public pages set no cookies and load no analytics, advertising, or third-party scripts. The customer blocks inside Shopify contain no third-party code. Inside Shopify admin, the app uses Shopify's own session mechanism to sign you in.

Service providers

Render hosts the app and its PostgreSQL database in Oregon, United States.
Our email delivery provider (currently Resend) receives the recipient, subject, and body of each confirmation email in order to deliver it.
Shopify is where the order data lives; FixOrder only works through Shopify's APIs.

Security

All traffic to and from the app uses HTTPS. Shopify webhooks are verified with HMAC signatures.
Customer requests must carry a session token signed by Shopify, and the order must belong to that customer (or match the order's confirmation number on the Thank you page).
The database is encrypted at rest by Render, reachable only from the app's private network, and connected to over TLS.
Access to production systems is limited to the people who operate the app.

Retention

Email recipients and content are erased once the email is sent or has failed for good.
The edit log is kept for as long as the app is installed, so the merchant can see what changed, until Shopify asks us to redact that order or the shop. There is no shorter fixed period today.
Deleted data can remain in the hosting provider's encrypted database backups for up to 7 days before it's gone for good.

When you uninstall

Immediately: the shop's sessions and access token are deleted, billing is marked inactive, and the customer blocks stop showing anything.
Settings and the edit log are kept for 48 hours in case you reinstall. Shopify then sends the shop/redact webhook and the app deletes everything it holds for the shop: emails, the edit log, settings, the shop record, and any remaining sessions.

FixOrder handles Shopify's mandatory privacy webhooks:

customers/data_request: the request is logged, and we send the store the data we hold for the listed orders (the edit log entries) within 30 days.
customers/redact: the edit log entries and email records for the listed orders are deleted.
shop/redact: everything stored for the shop is deleted, as described above.

Merchants can also email sallitar.apps@gmail.com to request a copy or deletion of their shop's data at any time.

Changes

If what the app reads or stores changes, we update this page and its effective date before the change ships.

See also the terms of service and support.