Privacy Policy

Easy Order Withdraw — Last updated: June 15, 2026

Easy Order Withdraw ("the App", "we", "us") is a Shopify application that gives customers a self-service cancel button compliant with the EU 14-day right of withdrawal. This policy explains what data we collect, how we use it, and your rights.

1. Data We Collect

When you install and use Easy Order Withdraw, we collect:

• Shop access token and session data — stored in our database to authenticate API calls on your behalf. This includes your shop domain, access token, and token scope.
• App settings — cancellation window, refund preferences, button labels, and translations you configure inside the app. These are stored per shop in our database.
• Order identifiers — when a customer cancels an order, the order ID is sent to our backend to execute the cancellation via Shopify's Admin API. We do not store order IDs after the request completes.

We do not collect or store any customer personal information (names, emails, addresses, payment data, or browsing history).

2. How We Use Your Data

• To authenticate your Shopify store and make Admin API calls on your behalf.
• To execute order cancellations and refunds requested by your customers.
• To serve your configured translations and settings to the customer-facing cancel button.

3. Third-Party Services

Session and settings data is stored in a PostgreSQL database hosted on Neon (neon.tech), located in the EU (eu-central-1). Neon's data handling is governed by their Privacy Policy.

Contact form messages are sent via Resend (resend.com). Resend's data handling is governed by their Privacy Policy. We do not share your data with any other third parties.

4. Data Retention

• Session records are deleted immediately when you uninstall the app.
• All remaining session and settings data is permanently deleted within 48 hours of uninstall in response to Shopify's shop/redact webhook.
• Order IDs used for cancellation requests are not stored after the request completes.

5. GDPR & Your Rights

If you are located in the European Economic Area (EEA), you have rights under GDPR including the right to access, correct, or delete personal data we hold. Because we hold only shop session tokens and configuration settings (not customer personal data), most GDPR requests related to end customers can be fulfilled by confirming we hold no customer records. To exercise any rights or request data deletion, contact us at the address below.

6. Security

All data is transmitted over HTTPS. Access tokens are stored encrypted at rest. We do not log or retain order content beyond the duration of a cancellation request.

7. Changes to This Policy

We may update this policy from time to time. The "Last updated" date at the top of this page will reflect any changes. Continued use of the App after changes constitutes acceptance of the updated policy.

8. Contact

For privacy questions or data requests, contact us at: ggman.kr@gmail.com