Privacy policy · GMVify Order Editing

GMVify Order Editing (“the app”) is a Shopify app by Vitamin Creative Lab Limited (“we”, “us”). It lets a store’s customers change their own orders before they ship or go into production: the shipping address, the items and quantities, cancelling, and the personalization on an item, such as its text or photo. This policy explains what the app keeps, why, who receives it and how long it stays. It covers merchants who install the app and the customers who edit orders with it.

What we collect

Data	From	Why
Store domain and access token	Shopify, when the merchant installs	To run the app
Plan, billing interval, trial end, coupon used, the store’s order count for the last 30 days and whether it’s a development store	Shopify billing and the store’s orders	To apply plan limits and show the Plans page
Each edit: the order’s ID and number, the kind of edit, whether the customer or staff made it, its status, the amount to pay or refund and its currency, the names of the address fields that changed (not the address), the items and quantities changed, the personalization fields changed and their version number, and how a refund was made	The edit page and the admin	To make the edit, settle any difference, and show the edit log
Orders on hold: the order’s ID and when its hold ends	The app	To release the fulfillment hold when editing closes
Photos customers upload to replace one: the file, and its order, line, field, file type, size and dimensions	The edit page	To put the new photo on the order
Data requests Shopify forwards: the customer’s ID and order IDs	Shopify	So the merchant can export that customer’s edit records
A staff member’s chosen admin language, with their Shopify user ID	The admin	To show the app in that language

The merchant’s settings, such as which edits are allowed and for how long, are kept in the merchant’s own store as an app metafield, not in our database.

Customer data

To show customers their order, check and change the shipping address and send emails, the app reads protected customer data from Shopify: names, email addresses, shipping addresses and phone numbers. It does not keep them in its database. An address edit is logged by the names of the fields that changed, not the address itself.
When a customer changes the personalization on an item, each version is written to the merchant’s order in Shopify (an order metafield, an order attribute with a summary, and a tag). That is the merchant’s order data; it stays with the order after the app is uninstalled.
Photos customers upload to replace one are kept in private storage (Cloudflare R2). Every link to a photo expires after an hour.
Differences are paid through Shopify’s own payment link, and refunds are made through Shopify. The app never sees card details.
After each edit the customer gets a confirmation email and the store gets a notice, unless the merchant turns them off. They are sent from mail.gmvify.com through Resend and contain the order number and what changed.

Who we share data with

We do not sell data, use it for advertising or share it with ad networks. These providers receive data to run the app:

Provider	What for	What it receives
Render (Ohio, USA)	Hosting the app and its database	Everything listed under “What we collect”
Cloudflare	Private storage for replacement photos (R2)	The photo files
Resend	Sending the emails after each edit	The recipient’s email address, the order number and what changed
Shopify	The platform the app runs on	What the app writes to the store: order edits, personalization versions, holds, refunds and settings

We may also disclose data when the law requires it.

How long we keep it

While the app is installed, edit records and photos stay so the merchant can see the edit log and make the right version.
When a merchant uninstalls, the access token is deleted at once, editing stops and any paid plan ends.
48 hours later Shopify asks us to erase the store’s data, and we delete every record and photo listed above. We keep only the store’s domain, its trial’s end date and the coupon it used, with no personal data, so a reinstall doesn’t start a second trial.
When Shopify sends a customer’s erasure request, we delete the edit records and photos of that customer’s orders. When Shopify sends a customer’s data request, we keep it so the merchant can export that customer’s edit records from the app.

Your rights

Customers: the store you bought from controls your order. Ask the store to see or delete your data; when Shopify sends us the store’s request for your orders, we act on it as described above. You can also contact us directly.

Merchants: uninstalling removes your data as described above. Depending on where you live (for example the EU, UK or California) you have the right to access, correct, delete or move your data and to complain to a data protection authority.

Changes and contact

If we change this policy we will update the date above, and tell merchants in the app when the change is significant. Questions or requests: email support@gmvify.com or see the support page.