QuickOrder B2B Install on Shopify

Privacy Policy

Effective date: July 25, 2026

This policy describes what data QuickOrder B2B ("the App"), published by Leria Technologies ("we", "us"), processes when a merchant installs it from the Shopify App Store, and how we handle privacy requests. We wrote it to be read, not skimmed — it is short because the App genuinely processes very little data.

The short version

  • We store your shop's settings and, if you're on the Pro plan, your buyers' saved order lists — nothing else about your customers.
  • A saved list is: a list name, product variant ids, quantities, and the Shopify customer id it belongs to. No names, no emails, no addresses.
  • The App requests a single permission: read products. It cannot read your customer records or your orders.
  • GDPR export and deletion webhooks are implemented for real — a customer's saved lists are exported or purged on request, automatically.
  • When you uninstall, your data is deleted within 30 days.

1. Data we process

When you install the App, we store:

  • Shop identification: your myshopify.com shop domain and the API access token Shopify issues to the App, used solely to operate the App for your store.
  • Merchant-entered settings: your catalog configuration (included collections and tags, exclusions), quantity rules (min/max/increments per product), page setup, design options, and your selected plan.
  • Saved lists (Pro plan): when a logged-in buyer saves a re-order list on your quick-order page, we store the list name they typed, the product variant ids, the quantities, and the numeric Shopify customer id that Shopify's signed App Proxy attaches to the request. This id is how we return the right lists to the right buyer. We never look the id up against your customer records — the App has no permission to.
  • Aggregate usage counters: daily totals per shop — how many times the form was displayed and how many bulk add-to-cart actions happened (e.g. "2026-07-25: 118 views, 9 bulk adds"). These are shop-level numbers with no visitor identifiers, no IP addresses, and no way to trace back to any individual.
  • Support correspondence: if you email us, we keep the email thread so we can help you.

2. Data we do not collect

The App never accesses or stores:

  • Customer names, email addresses, phone numbers, or shipping/billing addresses
  • Order data, order history, or payment information
  • Visitor IP addresses, device identifiers, or fingerprints
  • Individual browsing or click behavior

The order table itself is rendered by Shopify (Liquid) inside your storefront pages — including any negotiated B2B prices for logged-in company buyers on Shopify Plus, which are resolved by Shopify and never pass through our servers. Adding to cart uses Shopify's standard Cart AJAX API, entirely between the buyer's browser and your store. The only storefront requests that reach our servers are the saved-lists and CSV SKU-lookup calls on the Pro plan, made through Shopify's signed App Proxy; they carry the customer id and the requested SKUs or list content, nothing more. The App sets no cookies and uses no tracking on your storefront.

3. How we use the data

  • To render and operate the quick-order form according to your settings.
  • To store and return each buyer's saved lists (Pro plan).
  • To resolve SKUs from uploaded CSV files to the matching variants (Pro plan).
  • To show you usage trends (views, bulk adds) in the App's dashboard.
  • To provide support when you contact us.

We do not sell or rent any data. We do not use your data for advertising. We do not share your data with third parties except the infrastructure providers that host the App's production database.

4. Where the data lives

Settings and saved lists are stored in the App's production database hosted with our cloud hosting provider. A copy of your form configuration is stored in an app-owned metafield on your own shop (inside Shopify's infrastructure) so the table can render without contacting us. Access to production systems is limited to the App's developer and protected by authentication.

5. GDPR and privacy requests

The App implements all three mandatory Shopify privacy webhooks, and they are honored automatically:

  • customers/data_request — a customer asks for their data. We export every saved list stored for that customer id on your shop (list names, variant ids, quantities, dates) and provide it so you can pass it on to the customer.
  • customers/redact — a customer asks for deletion. We permanently delete every saved list stored for that customer id on your shop. This is a real deletion, not a flag.
  • shop/redact — sent by Shopify 48 hours after you uninstall the App. We permanently delete your shop's settings, access token, all saved lists, and aggregate counters from our database within 30 days of receiving it.

If you are a merchant in the EU/EEA, UK, or a jurisdiction with similar rights, you may also request access, correction, or deletion of the data we hold for your store at any time by emailing us — we will respond within 30 days.

6. Data retention

  • While the App is installed: settings, saved lists and aggregate counters are retained so the App can function.
  • After uninstall: everything is deleted within 30 days via the shop/redact flow described above.
  • Saved lists: kept until the buyer deletes them, a customers/redact request removes them, or the shop is redacted — whichever comes first.
  • Support emails: retained for up to 24 months so we have context if you contact us again, then deleted.

7. Changes to this policy

If we ever change what the App collects — for example, if a future feature requires new data — we will update this page, change the effective date at the top, and summarize the change in the App's changelog before it takes effect.

8. Contact

Questions, or a privacy request? Email anadvisory.fr@gmail.com. We read everything and reply within one business day.