OrangeShip Privacy Policy

Last updated: 2026-10-14

桔子国际物流科技（深圳）有限公司 ("we", "us") provides order fulfillment services connecting Shopify stores with international freight-forwarding warehouses and shipping lines. This policy explains what data we collect through the OrangeShip Shopify app, how we use it, and the choices merchants and their customers have.

1. Data we collect

• Store information: shop domain, authorized API access token (encrypted at rest).
• Product data: titles, SKUs, barcodes, weights, prices — used to map products to warehouse items.
• Order data: order number, paid status, amounts, line items, and the recipient's name, phone number, email and shipping address — collected solely to fulfill and ship the order.

We do not collect browsing behavior, payment card details, or any data unrelated to fulfillment.

2. How we use data

• Routing paid orders to our warehouse (WMS) or direct-ship (TMS) systems for fulfillment.
• Sharing recipient name, phone and address with the logistics carrier strictly to deliver the parcel.
• Writing tracking numbers back to Shopify so buyers can follow their shipment.
• Answering questions from the merchant's own staff through the optional AI assistant in the OMS console (see section 5).

3. Storage and security

• Access tokens and recipient name, phone, email and street address are encrypted at rest (AES-256-GCM). Recipient city, province, ZIP and country remain in plaintext for routing and reporting, then personal fields are deleted or anonymized on Shopify customers/redact and shop/redact webhooks. Copies in webhook/push logs are stripped or masked.
• Data is isolated per merchant account with row-level tenant isolation and role-based access control.
• Operational logs mask personal fields.

4. Retention and deletion

• Order and shipping records are retained for fulfillment and after-sales support. We do not currently run an automatic 2-year purge; merchants can request deletion, and we honor Shopify redact webhooks within 30 days.
• We honor Shopify's mandatory privacy webhooks: on customers/redact and shop/redact requests we delete or anonymize the corresponding personal data (including webhook and push-log copies) within 30 days; on customers/data_request we notify platform operators to export the customer's order data within 30 days (see the data-request runbook).
• When the app is uninstalled, the store's access token is invalidated immediately and syncing stops.

5. AI assistant (optional)

• The OMS console offers an optional AI assistant. It is available to merchant accounts by default once the platform operator has set up a model, and the platform operator can turn it off for any merchant account; only the merchant's own staff use it inside the OMS console. Shopify buyers never interact with it.
• When a staff member asks a question, the question and the records the assistant looks up to answer it (for example order status, line items, SKU mappings, routing settings and push results, and the recipient's name, phone, email and address only when the staff member asks for them) are sent to a third-party large language model provider chosen by the platform operator, solely to generate the answer.
• Credentials (API keys, passwords, access tokens, app secrets) are never sent. The assistant reads data and may propose a small set of changes (order routing, re-pushing orders, SKU mappings); a change runs only after the staff member confirms it, with that staff member's own permissions. It cannot change settings, turn dispatch on or off, or delete data.
• Conversation text is encrypted at rest (AES-256-GCM) and deleted automatically after 30 days. Token usage counts are kept for quota and billing.

6. Your rights

Merchants and their customers may request access, correction or deletion of personal data (GDPR / applicable privacy laws) via the merchant's Shopify admin or by contacting us directly.

7. Contact

Questions about this policy: jasontse@orangeship.cn