Checkout Note Pro Privacy Policy

1. Scope

Checkout Note Pro (the “App”) provides configurable quick order notes and note-entry and display features in the cart, checkout, and thank-you page (the “Service”) to merchants who use Shopify to power their stores. This Privacy Policy explains how we collect, use, share, retain, and delete personal information when a merchant installs or uses the App. Shopify’s own privacy policy separately governs Shopify’s processing of data on its platform.

2. Personal information the App collects or processes

We obtain information through Shopify APIs and authorized sessions, app settings submitted directly by merchants, and limited technical logs needed to provide the Service. Except as described below, we do not collect account, payment, or contact information directly from a merchant’s customers.

• Store and merchant data obtained through Shopify APIs and authorized sessions: store domain, store name and description, Shopify store identifier, and the name, email, user identifier, locale, role, and granted permissions that Shopify makes available in an authorized session. The App requests write_checkouts, read_checkouts, read_themes, and read_products permissions to provide the functions described below. Shopify’s App Store data-access disclosure also identifies store-owner phone and address and device, activity, and geolocation data as viewable by the App; we do not use these fields to build customer profiles.
• App settings: enabled status, prompts and quick-note templates created by the merchant, onboarding status, and the enabled status of theme or checkout components.
• Product and store content: the app reads necessary current-theme configuration to check component status. Only when a merchant selects “Analyze store,” the app reads the store name and description, product types, titles, handles and descriptions for up to 20 collections, and titles, descriptions, types, vendors, tags and categories for up to 30 recently updated products.
• Order notes: delivery instructions, gift messages, packaging requests, or other notes entered by a customer are written to or displayed from the Shopify cart, checkout, and order context. The app does not copy order-note content into Whalebud’s own database.
• Technical data: Shopify and our hosting provider may process limited technical data such as IP address, request time, browser or device information, error logs, and webhook events for authentication, reliability, and security.
• Cookies and similar technologies: the App does not place advertising cookies, pixels, or similar cross-site tracking technologies on merchant customers’ devices. When a merchant uses the embedded admin interface, Shopify or our hosting provider may use session or technical cookies that are necessary for authentication, security, and basic functionality. Because the App does not use behavioral-advertising tracking technologies, browser “Do Not Track” signals do not change the App’s data practices.

3. How we use data

• Authenticate the store and maintain an authorized app session.
• Save and provide merchant-configured quick-note options to cart, checkout, and thank-you page components.
• Allow customers to add, edit, and view order notes within Shopify.
• Check whether the app’s theme component is enabled and provide setup guidance.
• Analyze store content and generate product-relevant quick-note suggestions only when requested by the merchant.
• Troubleshoot, prevent abuse, secure the app, and meet legal and Shopify platform obligations.

4. Legal bases for processing

Where applicable law requires a legal basis, we process personal information as necessary to perform our contract with the merchant; for our legitimate interests in operating, securing, and improving the App; to comply with applicable law and Shopify platform obligations; and with consent where required. For customer order notes that a merchant chooses to collect through Shopify, the merchant is responsible for determining the applicable legal basis, and we process the information only on the merchant’s instructions and as needed to provide the Service.

5. Sharing your personal information

We do not sell personal information or share it for cross-context behavioral advertising. We disclose information to the following providers only as needed to provide and protect the App or comply with legal obligations:

• Shopify provides authentication, the Admin API, cart and checkout capabilities, order-note storage, app components, and compliance webhooks. Shopify stores customer order notes on the merchant’s behalf.
• Google Cloud hosts the application and related infrastructure and may process store sessions, app settings, and limited operational logs.
• DeepSeek receives the store domain and the store, collection, and product summary described above only when the merchant selects “Analyze store,” in order to generate quick-note recommendations. Customer order notes and customer contact details are not sent to DeepSeek. The app does not create a conversation history with DeepSeek; DeepSeek may perform short-term security processing or caching under its API terms.
• Legal and safety disclosures: we may disclose the minimum information necessary when required by applicable law, subpoena, court order, or other valid legal process, or to protect the rights, safety, and property of merchants, customers, Whalebud, or others.

6. Behavioural advertising

The App does not use personal information for targeted or cross-site behavioural advertising and does not sell or share personal information for those purposes. Accordingly, the App does not provide a separate behavioural-advertising opt-out mechanism.

7. Data retention and uninstall

• While installed: authorization sessions and app settings are retained only while needed to provide the service. Operational and security logs are generally retained for no more than 30 days unless a longer period is required for law, security, or dispute resolution.
• At uninstall: after Shopify sends an app/uninstalled notice, the app deletes access tokens and session records from Whalebud’s database and can no longer access the store through the Shopify Admin API.
• Approximately 48 hours after uninstall: Shopify sends a shop/redact request. After receiving and verifying it, we delete remaining store identifiers, configuration, and settings status from our database.
• Data in Shopify: orders and order notes remain under the merchant’s control in Shopify and follow the merchant’s and Shopify’s retention rules. Shopify-hosted app metafields, app blocks, and other platform records are handled through Shopify’s uninstall process; merchants can also inspect and remove residual configuration in Shopify Admin.
• Backups and legal holds: data in restricted backups is removed through backup rotation and is not returned to ordinary use. Any minimum data that must be kept by law is retained only for the legally required period.

8. Your privacy rights

Depending on where you live and applicable law, you may have rights to know about or access personal information we process, request correction, updating, or deletion, restrict or object to processing, receive a portable copy, and withdraw consent where processing is based on consent. You will not be discriminated against for exercising applicable privacy rights. You may also lodge a complaint with the data protection or privacy authority in your jurisdiction.

Merchants and customers may submit a request by emailing us below. A customer may also contact the store where the order was placed; the store can submit a customers/data_request or customers/redact request through Shopify. Because order notes are stored in Shopify, access to, correction of, or deletion of an order or its note will normally need to be completed by the relevant merchant in Shopify.

Please include the store’s .myshopify.com domain, the email associated with the request, and enough information for us to verify identity and locate relevant records. Do not email passwords, payment-card numbers, or complete identity documents. We will respond within the period required by applicable law.

9. International transfers and security

Whalebud is established in China, and the App serves Shopify merchants worldwide. Data may be processed outside the country where a merchant or customer is located, including in regions where Shopify, Google Cloud, and DeepSeek provide services. Where required by applicable law, we rely on contractual or other lawful safeguards for international transfers. We use reasonable safeguards such as access restrictions, encryption in transit, verified Shopify webhooks, and access controls, but no online service can guarantee absolute security.

10. Minors

The App is a business service for Shopify merchants and is not directed to individuals under 18. We do not knowingly collect children’s personal information directly. Merchants are responsible for ensuring that their collection of order notes through Shopify complies with applicable age and consent requirements.

11. Changes to this policy

We may update this policy when the app, service providers, or legal requirements change. Material changes will be posted on this page with a revised effective date.