Fulfillment Invoice Control
Privacy Policy
Fulfillment Invoice Control does not store the personal data of your buyers — or of anyone else. The app reconciles your ShipBob fulfillment charges against your own Shopify order records and the rates you confirmed. What it keeps in its database are your commercial records — charges, fee types, amounts, order and tracking references, expected rates, and the variance findings computed from them. No names, no email addresses, no phone numbers, no postal addresses, no payment data.
1. Who we are
Fulfillment Invoice Control (the “app”) is built and operated by Orumio (“we”, “us”).
| Operator | Orumio |
|---|---|
| Representative | Masanori Iwata |
| Address | Mitsuhashi Building 3F, 1-3-3 Kita-Aoyama, Minato-ku, Tokyo 107-0061, Japan |
| Contact | support@orumio.com |
| Telephone | We will disclose this without delay in writing or by email upon request. Please send requests to the contact address above. |
When you install the app in your Shopify store, you are the controller of the data in your store and in your ShipBob account, and we act as your processor: we process it only to provide the app to you, on your instructions. The terms of that relationship are set out in our Data Processing Agreement, which forms part of your agreement with us.
2. What the app processes
2.1 From Shopify
The app reads your store’s order and fulfillment records to build the evidence used in reconciliation. It requests the minimum access scopes for that (read_orders, read_locations), and it deliberately requests none of the customer identity fields: customer names, email addresses, phone numbers, and postal addresses are not part of any query the app makes. What it stores from an order are operational facts — order references, fulfillment and tracking references, quantities, fulfillment locations, sales-channel identity, and timestamps.
2.2 From ShipBob, connected by you
When you connect your ShipBob account, the app reads your billing records — invoices, charges, fee types and amounts — and the channel and order references needed to attribute each charge to your Shopify store. ShipBob’s own copies of order data can include recipient details on ShipBob’s side; the app extracts references, channel identity, quantities and timestamps only, and never persists recipient personal data.
2.3 About order and tracking references
An order reference (such as #1001) or a parcel tracking number identifies an order or a shipment, not a person. The app holds no name, address or contact detail to connect them to; a buyer could be identified from them only inside your own Shopify or ShipBob account, under your control. They are kept because they are the evidence that a charge relates to a real order — the substance of the reconciliation you installed the app to do.
2.4 Stored by the app
| Data | Personal data? | Why it exists |
|---|---|---|
| Your shop’s myshopify domain and Shopify shop ID | No — business identifiers | Identifies your installation |
| Shopify access token; ShipBob access and refresh tokens | No — credentials | Lets the app ingest and audit while nobody is signed in. Protected as described in §5 |
| ShipBob invoices and charges (fee types, amounts, references) | No — your commercial billing records | The subject matter of the audit |
| Order/fulfillment operational facts (references, quantities, locations, channels, timestamps) | No — order-level references (§2.3) | Cross-system evidence for reconciliation |
| Your confirmed expected rates and their version history | No — your commercial terms | What charges are compared against |
| Audit runs, matches, variance findings and their evidence | No — derived results | The product’s output, reproducible on demand |
| Subscription plan and status | No | Billing |
| An audit trail of security-relevant actions (connections, rate changes, review decisions) | No — shop domain as actor, IDs only | Accountability for changes in your account |
3. Why we process it
One purpose only: to provide the app — ingest your ShipBob billing and Shopify operational records, compare charges against the rates you confirmed, and present explainable variance findings for your review. This is the purpose we declared to Shopify when we requested access to protected order data.
We do not, and the app has no mechanism to:
- use your data for marketing, advertising or profiling;
- sell or share your data with anyone;
- use your data to train machine-learning models;
- benchmark, aggregate or compare your rates or charges against other merchants’.
The app makes no automated decisions about people. It computes billing variances and presents them as items for your review; every decision about a finding is yours.
4. Who else processes it (sub-processors)
Below, by what they do. The providers we engage to process your store’s data are named, with their locations, in the Data Processing Agreement, Annex III; before we add or replace one we announce it to installed merchants at least 30 days in advance (its §6).
The app talks to a deliberately small number of external services. The app itself has no analytics SDK, no error-reporting service receiving payloads, no email service, and no third-party script in the server path.
| Service | Role | Data it can see |
|---|---|---|
| Shopify | The platform your store runs on | All store data — Shopify is the source of truth, governed by your agreement with Shopify |
| ShipBob | Your fulfillment provider, connected by you | Your fulfillment and billing data lives there already — governed by your agreement with ShipBob |
| Our hosting provider (United States, primarily) | Runs the app: application hosting, the database, job queues, scheduled jobs and runtime logs | Everything listed in §2.4, at rest; data in transit while a request is served; plus runtime logs (§6) |
| Our email service (United States) | Receives and sends our email — our own correspondence with you, not processing of your store’s data | What you write to support@orumio.com and the emails we send you |
Our data is held primarily in the United States (the database is placed with a North-American location hint to our hosting provider, not a guarantee); requests are served from its global network. If you are in the European Economic Area or the United Kingdom, this means your data is transferred outside that region; the safeguards for that transfer are set out in the Data Processing Agreement.
5. How it is protected
- Minimisation first. Personal data is never written to our database — customer identity fields are not even requested from Shopify, and ShipBob recipient details are never persisted. Data that was never stored cannot leak from storage.
- Encryption in transit. The app is served only over HTTPS, and all connections to Shopify and ShipBob use TLS. The database is never reached over a network connection: it is bound to the running app inside our hosting provider, so there is no database endpoint, password, or connection string that could be intercepted or leaked.
- Encryption at rest. Our hosting provider encrypts the database and its point-in-time history at rest. There is no self-managed backup or export pipeline, so no unencrypted copy of the database exists anywhere.
- ShipBob credentials encrypted a second time. Your ShipBob access and refresh tokens are additionally encrypted with AES-256-GCM before they reach the database, cryptographically bound to your installation — a stolen database row cannot be replayed against another account. Your Shopify access token is short-lived (about one hour) and rotated automatically.
- Tenant isolation. Every record is keyed to your installation, and every query filters through it. This is covered by automated cross-tenant tests.
- Confidential treatment of commercial data. Your invoices and rates are commercially sensitive even though they are not personal data. We treat them as confidential business data: no secondary use, no benchmarking, no disclosure.
- Access control. The app is operated by a single person. There are no staff accounts, contractors, or support agents with access to merchant data. Every account with access is protected by two-factor authentication and a unique password stored in a password manager.
We maintain a written data protection policy and a security incident response policy, and we review both whenever what the app does with data changes.
6. Logging
The app writes operational logs so that failures can be diagnosed. Those logs record identifiers, classifications, counts and timestamps — never access tokens, never raw invoice payloads, and never personal data. Logs are held in our hosting provider’s runtime log storage; nothing is forwarded to any third-party log or analytics service.
7. Cookies and tracking
The app sets no advertising, analytics or tracking cookies. Inside the Shopify admin it authenticates with Shopify session tokens rather than its own login. Shopify may set its own cookies as part of the admin and the installation flow; those are governed by Shopify’s privacy terms, not this policy.
This policy covers the app. Our listing page on the Shopify App Store is a Shopify-operated page, and we use Shopify’s own listing-analytics feature there, which reports to a web-analytics service in the United States, to see how merchants find the listing. That is separate from the app: it never runs inside the admin, it never sees your store’s or your orders’ data, and nothing measured there is joined to anything in this policy.
8. How long it is kept
- Personal data: not retained at all, so there is nothing to expire.
- Your charges, rates, findings and configuration are kept while the app is installed — they are your reconciliation audit trail, and historic findings are deliberately immutable so that results stay reproducible.
- When you disconnect ShipBob, the stored ShipBob credentials are destroyed immediately. Reconnecting requires a fresh authorization in ShipBob.
- When you uninstall, the app immediately deletes its Shopify session credentials and destroys the stored ShipBob tokens, so no further processing can happen.
- Deletion. Shopify sends us a shop redaction request approximately 48 hours after uninstall; that deletes your installation and everything attached to it — charges, invoices, operational facts, rates, findings, audit history and subscription records. If you reinstall before it arrives, your data is kept — it is in active use again.
- Backstop. Because that request is a webhook and can fail to arrive, the app itself deletes any installation that has been uninstalled for more than 30 days, with the same cascade. The window is long enough never to pre-empt a reinstall, and finite so that a lost message cannot become indefinite retention.
- Earlier deletion on request, at any time, by writing to support@orumio.com.
9. Requests from buyers
If a buyer asks to access or delete their personal data, that request belongs to the merchant whose store holds it. Shopify forwards such requests to us as well, and we handle them as follows:
- Data request: we return nothing, because we hold no buyer personal data.
- Customer redaction: no action is required for the same reason — the app stores order-level references, not customer-keyed records.
- Shop redaction: we delete the merchant’s entire tenant as described in §8.
If you are a buyer and are not sure which merchant holds your data, write to support@orumio.com and we will help you reach them.
10. Security incidents
If we confirm an incident affecting your data, we notify the affected merchants directly and in plain language — what happened, what data was involved, what we have done, and what if anything you need to do — targeting within 72 hours of confirming it. We also report incidents involving protected customer data or platform credentials to Shopify promptly, without waiting for a complete root-cause analysis.
11. Changes to this policy
If we change what the app does with data, we update this page and its version number before the change ships. Material changes are announced to installed merchants.
12. Contact
Questions, requests, or anything that looks wrong in this policy: support@orumio.com.