Privacy Policy

Last updated: October 13, 2026

TagKit is a Shopify app that adds tags to a merchant's orders according to rules the merchant sets. This policy explains what data the app processes, why, and how it is protected.

Order data, no personal fields. To evaluate its rules, TagKit reads each new or updated order when it arrives: totals, status, sales channel and point of sale location, discount codes, payment and shipping method names, the order note, line-item products (vendor, SKU, type, tags) and, for the customer on the order, only their customer ID, customer tags and order count (to tell a first order from a returning customer's). TagKit does not request or store customers' names, email addresses, phone numbers or addresses. The order is read, evaluated and discarded; the note and other order contents are never stored. On the Pro plan, a merchant can also ask TagKit to apply their rules to orders from the last 60 days; those orders are read the same way.

What we process

• Merchant / store data: the store's myshopify.com domain, an expiring Shopify access token, and the subscription plan tier.
• Store owner's email: the email address on the store owner's Shopify account (as set in Shopify, not the store's public contact email), its admin language, and whether it is a development store — used only to email the store owner: account alerts, a one-time welcome note on upgrading to a paid plan, and a one-time note after uninstalling asking what we could improve.
• Rules: the tagging rules the merchant creates.
• Tagging records: for orders TagKit tagged, the order's ID and number and the tags added or removed (the activity log, kept 30 days), and which tags TagKit itself added (kept 90 days, so it never removes a tag someone else added).
• A short work queue: order IDs waiting to be evaluated, deleted as soon as each is processed.
• Support messages: If you message us from inside the app (including a free setup or customization request), we store your messages, your shop domain, the reply-to email address and name you provide or that Shopify lists for your store, and your admin language — used only to answer you and to email you when we reply.

Why we process it

Solely to provide the app's functionality to the merchant, including customer support (in-app support messages and free setup and customization help). The store owner's email is used only for the emails described above, and the reply-to address only to answer your support messages. We do not use it for advertising, profiling, or sale.

Sharing

• Shopify — the platform APIs the app is built on.
• DigitalOcean — hosts the server and database.
• Mailgun — our email provider; delivers our emails to the store owner and to the reply-to address you give us for support messages (sent from support@nerdlabs.us), using the email addresses described above.

We do not sell data or share it for any other purpose.

Retention and deletion

Activity records are deleted after 30 days and tag-ownership records after 90 days. When the app is uninstalled, sessions are removed. Roughly 48 hours later Shopify sends a shop/redact request and we delete all data stored for that shop, including the store owner's email, in all cases within 30 days of uninstall. Support messages are deleted when that request arrives, or sooner on request. Backup copies of support messages age out within 30 days. Because we hold no customer personal data, the customers/redact and customers/data_request webhooks have nothing to act on and are acknowledged.

Security

The app's database is stored on a DigitalOcean server, on an encrypted storage volume, with SSH-key-only administrative access. Backups of the app's database are kept on the same encrypted volume for 7 days. Support messages are held in our support-inbox database on the same server. All traffic uses HTTPS. App secrets are held only in the server environment.

Changes

We may update this policy; material changes will be reflected here with a new "last updated" date.

Contact

Questions about this policy or your data: support@nerdlabs.us.