Privacy Policy — Duplicate Order Defender

Last updated: August 11, 2026

What this app does

Duplicate Order Defender helps Shopify merchants detect probable duplicate orders and limit-bypass order clusters. It reads order data, writes order tags, and — only when the merchant enables it — places fulfillment holds. It never cancels, refunds, merges, or blocks anything.

Data we process

To detect duplicates, we store per-order matching keys on behalf of the merchant: order number, customer email address, phone number, shipping address, purchased item SKUs and quantities, order totals, and discount codes used. We also store the shop's domain, the merchant's app settings (including an optional alert email address), and records of the tags and holds the app has placed.

We do not collect or store payment card details, passwords, browsing behavior, or any data beyond what duplicate detection requires.

How we use it

Order data is used exclusively to detect duplicate and limit-bypass orders and present the evidence to the merchant who installed the app. Detection is fully deterministic and rule-based. We do not use merchant or customer data to train AI or machine-learning models, do not sell it, and do not share it for marketing.

Retention and deletion

• Stored order matching keys are automatically deleted 90 days after collection.
• Customer redaction requests (GDPR/CCPA, via Shopify's compliance webhooks) delete every matching key stored for that customer, promptly and automatically.
• Uninstalling the app deletes all of the shop's stored data; Shopify's shop-redaction webhook is honored as a second pass.

Where data lives

Data is stored in a managed PostgreSQL database hosted on Railway (United States), encrypted in transit and at rest. Access is restricted to the app's developer. Our subprocessors are: Shopify (platform), Railway (hosting and database), and — only if the merchant enables email alerts — Resend (email delivery of alert notifications to the merchant's own address).

Your rights

Merchants can request an export or deletion of their shop's data at any time. Customer data requests and deletions flow through Shopify's standard privacy processes and are honored automatically. For anything else, contact darthpizzo71@yahoo.com.

Our agreement with merchants

By installing Duplicate Order Defender, the merchant appoints us as a data processor for the order data described above, and this policy — together with Shopify's API Terms — forms the data processing agreement between us: we process that data only as described here, apply the retention and deletion commitments above, and honor deletion instructions delivered through Shopify's privacy webhooks or by email.

Changes

We'll update this page when our practices change and revise the date above. Material changes will be communicated through the app.