Trust
Security & privacy
How Carnet handles your stockists' data under the GDPR.
Last updated:
Roles
For your stockists' order details, you (the brand) are the controller and Carnet is your processor, under our Data Processing Agreement. For your own account data, Carnet is the controller.
Terms, privacy policy and DPA are published before the app launches.
The notice buyers see on order pages names the brand and gives privacy@ordersheet.net.
What we store
- Sheets and links you create
- Order requests: lines, quantities, references
- Buyer contact details: name, email, company, phone if given
- No card or payment data: payment stays in Shopify
Protection
- Buyer contact details, email recipients and link tokens are encrypted at rest, with a key per store. Order lines are not.
- Signed links you can pause or revoke
- Each public link is rate-limited per 24 hours
- Shopify's GDPR requests handled automatically (customer data request, customer redact, shop redact)
- Limited Shopify access: Carnet reads products, themes, markets, languages and customers (to match stockists) and creates draft orders. It does not edit your theme and does not read your orders or inventory. See the table below.
Setup and permissions
These are all the Shopify access scopes Carnet asks for at install.
| Scope | What Carnet uses it for |
|---|---|
read_products | Reads your products, images and variants to build line sheets |
read_customers | Reads customers, to match stockists |
write_draft_orders | Creates draft orders from stockist orders |
read_markets, read_locales, read_translations | Reads your markets, store languages and translations, for buyer pages |
read_themes | Reads your theme's colours and fonts for the theme import. Carnet has no write access to themes: it does not edit your theme. |
write_app_proxy | Lets buyer links open on your store's own domain under /apps/carnet (Shopify's app proxy), so a link looks like your store's |
Carnet has no scope to read your orders or inventory.
Retention
| Data | Kept |
|---|---|
| Order request details | 180 days after processing (60 days if never processed) |
| Email bodies | 7 days after sending |
| Backups | Backups keep encrypted copies until they expire |
| After uninstall | Deleted following Shopify's data deletion request |
Sub-processors
| Provider | Purpose |
|---|---|
| Shopify | Platform |
| Microsoft Azure | Hosting, database, email |
| Cloudflare | Network and buyer link hosts |
Contact
Merchants: hello@ordersheet.net. Buyers: privacy@ordersheet.net.