Privacy Policy

PO Desk helps Shopify merchants turn customer purchase orders into reviewed Shopify Draft Orders. This policy explains what data the app processes, why it is needed, and how merchants can request access or deletion.

Data We Process

Merchants may upload PDFs, spreadsheets, CSV files, and images that contain purchase order information. These files can include customer names, business names, email addresses, phone numbers, shipping addresses, purchase order numbers, product identifiers, quantities, prices, and notes supplied by the merchant or their customer.

PO Desk also stores Shopify product and variant data needed for SKU matching, draft order identifiers returned by Shopify, simple subscription status, and app configuration needed to run the workflow.

How We Use Data

Data is used only to provide the app workflow: extracting purchase order content, matching PO lines to Shopify products and variants, showing review screens to the merchant, creating Shopify Draft Orders after merchant confirmation, and supporting app security, diagnostics, and compliance.

PO Desk does not create Shopify orders or draft orders without a merchant review action. Customer data is not sold and is not used to train public models.

Service Providers

The production app runs on Google Cloud Run with Cloud SQL and private Google Cloud Storage. Google Cloud Vision may be used to extract text from scanned PDFs and images. Operational alerts are sent through configured monitoring webhooks without intentionally including purchase order payloads.

Retention and Deletion

Original uploaded files are retained for up to 60 days by default. Parsed order records are retained for up to 180 days by default unless a merchant requests earlier deletion or a longer retention period is required for security or legal reasons.

PO Desk implements Shopify privacy webhooks for customer data requests, customer redaction, and shop redaction. On app uninstall or a valid deletion request, customer-identifying fields are removed or anonymized according to Shopify requirements and the app retention schedule.

Security

App routes require Shopify authentication, file storage is private, webhook requests are verified, and sensitive runtime credentials are stored outside the source repository. Access to merchant data is limited to the functions needed to operate and support the app.

Contact

For privacy, support, or deletion requests, contact support@po-desk.app.