Team Orders: Privacy Policy

Last updated: April 2026

1. Who We Are

Team Orders is a Shopify application developed and published by SaltCore Group Limited under the SaltAI brand ("SaltAI", "we", "us", or "our").

SaltCore Group Limited is a company registered in England and Wales. You can contact us at: privacy@saltai.app

We are the data controller for information collected through this app.

2. What Data We Collect

When you install and use Team Orders on your Shopify store, we may collect and process the following categories of data:

2.1 Shopify Store Data

To provide the services offered by Team Orders, we access data from your Shopify store through the Shopify API, including:

Your Shopify store domain and shop identifier
Product and variant data (titles, descriptions, IDs, SKUs)
Order data, where necessary for app functionality
Shop owner name and contact email address (provided by Shopify on installation)
Shopify access tokens used to authenticate API requests

2.2 End Customer Data

Depending on the features you enable, Team Orders may process limited data about your store's customers, including:

Customer names and email addresses, where needed for app features
Order details, where needed to deliver app functionality
Any data submitted through forms or widgets served by the app

We process end customer data only as necessary to provide the service and on your instructions as a data processor under UK GDPR Article 28.

2.3 Technical and Usage Data

We collect basic technical data to operate and improve the app, including:

Server log data (IP addresses, request timestamps, error logs)
App usage events (page views within the app admin interface)
Performance and error monitoring data

3. How We Use Your Data

We use the data we collect to:

Provide, operate, and maintain the Team Orders app and its features
Authenticate your Shopify store and authorise API requests
Display app features on your storefront as configured
Send you essential communications about the app (security updates, billing changes)
Diagnose and fix technical issues
Improve app performance and reliability
Comply with our legal obligations

We do not sell your data or your customers' data to third parties. We do not use your data for advertising or profiling purposes unrelated to providing the app service.

4. Legal Basis for Processing (UK GDPR)

We process personal data under the following legal bases:

Contractual necessity (Article 6(1)(b)): Processing required to provide the Team Orders service you have subscribed to.
Legitimate interests (Article 6(1)(f)): Processing for security, fraud prevention, and service improvement, where these interests are not overridden by your rights.
Legal obligation (Article 6(1)(c)): Processing required by applicable law, including UK tax law and data protection law.

5. Data Sharing and Third Parties

We share data with a limited number of third-party service providers who help us operate the app:

Shopify Inc.: Our app operates within the Shopify platform. Shopify's privacy policy governs their processing of your store data.
Neon (database infrastructure): We use Neon as our PostgreSQL database provider. Data is stored in the EU.
Railway (hosting infrastructure): Our app servers are hosted on Railway.

All third-party processors are bound by data processing agreements and handle data only as instructed by us.

6. International Data Transfers

We take steps to ensure that any transfer of personal data outside the UK is subject to appropriate safeguards, including standard contractual clauses where required.

7. Data Retention

We retain data for as long as necessary to provide the service and comply with legal obligations:

Active account data: Retained for the duration of your subscription to Team Orders.
Post-uninstall: Upon uninstalling the app, your store data is deleted from our systems within 30 days, except where we are required to retain it by law.
Log data: Retained for up to 90 days for security and debugging purposes.

8. Your Rights Under UK GDPR

As a data subject under UK GDPR, you have the following rights:

Right of access: Request a copy of the personal data we hold about you.
Right to rectification: Request correction of inaccurate personal data.
Right to erasure: Request deletion of your personal data, subject to our legal retention obligations.
Right to restriction: Request that we restrict processing of your data in certain circumstances.
Right to data portability: Receive your personal data in a structured, commonly used format.
Right to object: Object to processing based on legitimate interests.

To exercise any of these rights, contact us at privacy@saltai.app. We will respond within 30 days.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

9. Security

Our technical and organisational security measures include:

All data transmitted is encrypted using TLS
Database access is restricted and authenticated
Shopify OAuth tokens are encrypted at rest
Regular security reviews and dependency updates
Access controls limiting staff access to data on a need-to-know basis

10. Cookies

The Team Orders admin interface may use cookies to maintain your session when logged in to the Shopify admin. We do not use third-party advertising cookies. Any storefront widgets served by Team Orders do not place tracking cookies on your customers' browsers.

11. Children's Privacy

Team Orders is not directed to individuals under the age of 18. We do not knowingly collect personal data from children.

12. Changes to This Policy

We may update this privacy policy from time to time. We will notify merchants of material changes by email or through the Shopify admin. The date above reflects the most recent update.

13. Contact

Email: privacy@saltai.app
Subject line: "Privacy Enquiry — Team Orders"