On this page
1. Overview
NextBatch Preorders (“the App”) is a Shopify app by ShopOpsy. It lets merchants take preorders against production batches and send back-in-stock alerts. This policy explains what data the App handles, why, where it goes, and how long it is kept.
The merchant decides how their store uses the App. For customer data, the merchant is the controller and ShopOpsy processes the data on the merchant’s behalf.
Your use of the App is also governed by our Terms of Service. For the ShopOpsy website, see the website Privacy Policy.
2. Data we collect
Merchant data
- Store details: shop domain, store name, store contact email, currency and time zone, read from Shopify when you install the App.
- Authentication: session and access tokens, used only to call the Shopify API for your store.
- Your App content: preorders, products and variants you add, production batches, settings, email texts, sender name and reply-to address.
- Billing: your plan, and for each paid preorder order the order number, preorder revenue and fee charged.
- Klaviyo API key: only if you choose Klaviyo for back-in-stock alerts. It’s stored encrypted (AES-256-GCM) and never shown again in the App.
Customer data
Preorder customers. From each order that contains a preorder item, we store:
- The order ID and order number
- The email address on the order and the customer’s language
- The preorder items (product, variant, quantity, price) and the batch each one is in
- For preorders with a deposit: the deposit, the balance, its due date and whether it was charged
We use this only to keep production batches correct, to send emails about that order (confirmation, ship date changes and “ready to ship”) and, for deposit preorders, to charge the balance. We don’t store names, phone numbers or addresses.
Payment details. We never see or store card numbers or other payment details. For a deposit preorder, the App asks Shopify to charge the balance to the payment method the customer saved at checkout; Shopify holds that payment method and processes the payment. We use it only for that order’s balance.
Back-in-stock subscribers. The email address a shopper types into the back-in-stock form, and the product and variant they asked about. We use it only to send that one alert.
Email log. For each email: recipient, email type, subject, date and whether it was delivered. You can see it in the App.
We don’t use customer data for marketing, profiling or advertising, and we don’t sell it or share it with anyone except the processors below. The storefront blocks set no cookies and do no tracking. To limit abuse of the signup form, we store a hashed counter per email address and per store. We don’t store IP addresses.
3. How customers can opt out
- Every back-in-stock email has an unsubscribe link and a one-click unsubscribe header.
- Every preorder email has a link to stop update emails for that order, and to ask the store to cancel the preorder.
4. Processors
| Service | Purpose | Data |
|---|---|---|
| Shopify | Platform, orders, billing | Everything above comes from or goes through Shopify |
| Vercel | Hosting the App | Requests to the App |
| Neon | Database (PostgreSQL) | Everything listed above |
| Resend | Sending customer emails | Recipient email, email content |
| Klaviyo (only if the merchant chooses it) | Back-in-stock alerts through the merchant’s own Klaviyo account | Subscriber email, product details |
| frankfurter.dev (European Central Bank reference rates) | Converting order totals to USD for the usage fee | Currency code and date only, no personal data |
5. Retention
- Email log: deleted after 180 days.
- Customer data request exports: deleted after 30 days.
- Background job records: deleted after 14 days (90 days if they failed).
- Preorder records: kept while the App is installed, so batches and orders stay correct.
- After you uninstall: sessions are deleted at once and pending emails are canceled. When Shopify sends its shop data erasure request (48 hours after uninstall), every record for your store is permanently deleted.
6. Privacy requests (GDPR, CCPA and similar)
The App handles Shopify’s mandatory privacy webhooks:
- Customer data request: we gather everything the App holds about that customer (preorders, back-in-stock alerts, emails sent) and show it to the merchant in Settings for 30 days, to send to the customer.
- Customer data erasure: we delete that customer’s back-in-stock alerts and email log, and remove the email address and language from their preorders. The preorder lines themselves stay, without personal data, because they match orders that still exist in Shopify and use production capacity.
- Shop data erasure: we delete all data for the store.
7. Security
- All traffic uses HTTPS.
- Requests from Shopify are verified (webhook HMAC, app proxy signatures).
- Merchant API keys are encrypted at rest.
- Access to production systems is limited to ShopOpsy.
8. Changes
We’ll update the “Last updated” date when this policy changes. We’ll tell merchants in the App about material changes.
9. Contact
Questions about this policy or your data:
- Company name
- ShopOpsy
- hi@shopopsy.com
- Website
- https://www.shopopsy.com