Terms of service.

1. Who we are, and what these terms cover

Ordryx is made by Ordryx LLC, a Colorado limited liability company (Colorado ID 20268283789, formed 20 October 2026), 1430 8th St, Greeley, CO 80631, United States, the address for legal notices (section 18). "We" and "us" mean Ordryx LLC. "You" means the business that uses Ordryx, and the person who agrees to these terms for it.

These terms apply when you use an Ordryx account, a shop's Ordryx (hosted by us or run yourself), the Ordryx app for Shopify or the Ordryx for WooCommerce plugin. You agree to them for your business with a tick box, beside links to these terms and the privacy policy, when you set up your account and when you connect the Shopify app or the WooCommerce plugin. Each agreement records the version you agreed to, and when. If you already have an account, we ask you once, at your next sign-in.

Ordryx is for businesses only, not for consumers. The person who agrees must be 18 or older and able to bind the business to these terms.

Our privacy policy says what we collect about the people who use Ordryx and visit ordryx.com. Part 2 of this page, the data processing agreement, says how we handle the personal data you keep in Ordryx about your customers, contractors, suppliers and staff.

Ordryx is new. It's being built with the businesses that use it, so it changes often. Something our docs call planned isn't a promise.

2. The parts of Ordryx

• Your shop's Ordryx: inventory, production, sales, shipping, purchasing and the rest, each a module your shop's owner switches on or off. We host it for you (section 3), or you run it on your own computer (section 4).
• The Ordryx account at account.ordryx.com: your sign-in with us. It links a self-hosted Ordryx to us (Ordryx Link), connects Shopify stores and WooCommerce sites to the right Ordryx, gives a linked Ordryx a name for HTTPS on your network, carries support conversations, and lets you download a hosted shop's backups.
• Remote access: a way to reach a self-hosted Ordryx from outside your network, through our relay. The connection is encrypted from the visitor's browser to your Ordryx, and the relay can't read it. It isn't offered to other shops yet.
• Ordryx off-site: storage we keep for hosted shops' encrypted backup copies, on a server in Colorado, USA, under Ordryx LLC's control, on encrypted storage, away from our servers' host.
• The Ordryx app for Shopify and the Ordryx for WooCommerce plugin: they connect a store to your Ordryx (sections 9 and 10).
• Point of sale: selling in person from your shop's Ordryx, with card payments through your own Stripe account. The phone app isn't released yet.
• AI access: lets an AI assistant you choose read some of your shop's figures. It's off until your shop's owner, or someone they let manage outside access, turns it on.
• ordryx.com: this site.

3. Hosted shops

If we host your shop, it runs on our servers at DigitalOcean in New York, United States, in a container of its own with its own database. No other shop can reach it.

• We keep it running. Fleet, the tool we run hosted shops with, checks its health every five minutes. If a shop goes down, Fleet alerts us and, unless you turn it off, emails you when it goes down and when it's back (not if the shop was paused or archived meanwhile). If our server itself is down, these alerts can't go out.
• We update it to new versions of Ordryx. Each update starts with a verified backup. If the new version isn't healthy, the old one comes back with that backup restored. When your shop is updated automatically, we email your account's address at least 7 days before a routine update, and the update waits for it; a security fix may go at once.
• It makes its own backups each night: 14 kept by default, your shop's setting, within your hosting plan's limit on copies and space. With Ordryx off-site on, it also sends an encrypted copy each night to our backup server in Colorado (section 26).
• You can download your shop's backups from your account at any time, after your password and a code, or a passkey.
• A hosted shop can't send email yet (our server's host blocks mail), and it can't reach printers or other devices on your network.

The companies we use to run hosted shops are listed in Annex B.

4. Running Ordryx yourself

If you run Ordryx on your own computer, it's yours to look after. We hold no copy of its database and can't see into it. You're responsible for:

• The computer and its disk: who can reach it, its updates, and whether its disk is encrypted. Ordryx doesn't encrypt its whole database on your disk. It encrypts saved keys to other services, authenticator keys, W-9s and tax IDs, and every order's ship-to address.
• Your network: on your own network Ordryx uses plain HTTP unless your Ordryx is linked to your account. Once it's linked and your test of HTTPS passes, browsers on your network are sent on to HTTPS, and your shop's owner can turn on Require HTTPS, which refuses sign-ins over plain HTTP (since Ordryx 0.0.217).
• Backups: where they go, whether they're encrypted (Settings › Backups › On this server › Lock them), and keeping the passphrase and the key file (secret.key) safe. We don't keep a copy of your passphrase, so a lost one means encrypted backups nobody can read. Without secret.key, a restored backup's saved keys and customers' addresses can't be read.
• Keeping Ordryx up to date.
• The people you let sign in, and what you let them do.
• Following the law, and your stores' rules, for the customer data on your computer (section 31).

We make no promise about a self-hosted Ordryx's uptime. That's yours.

If you link it to your account, the account carries messages between it and us, Shopify and WooCommerce. Part 2 covers what passes through.

The licence. Self-hosted Ordryx is Ordryx LLC's software, all rights reserved. We license it to your business to run for its own use while these terms apply. You may not copy it, pass it on or resell it (section 6). The Ordryx for WooCommerce plugin is different: it's free software under the GPL (section 10). Activation isn't built, so nothing locks today.

5. Your account and your shop's sign-ins

An Ordryx account is for one person. You sign in with your email, a password of at least 10 characters and a code from an authenticator app, or with a passkey. Keep your sign-in to yourself, keep your recovery codes somewhere safe, and tell us at security@ordryx.com straight away if you think someone else has signed in.

Your shop's own sign-ins are separate from the account. Your shop's owner decides who can sign in to the shop and what each person can do. Everyone on your shop's staff signs in with two steps: a password and a code, or a passkey. Contractors you invite to the contractor portal see only their own work and pay, and may choose two-step sign-in. You're responsible for what's done with the sign-ins you give out.

You can download your account's data, and delete your account, in the account itself. An account can't be deleted while it has a linked self-hosted Ordryx or a hosted shop: remove those first.

6. Using Ordryx fairly

Don't:

• break the law with Ordryx, or help someone else do it;
• put in data you have no right to hold or use;
• try to get into another shop, another person's account or our servers, or test them for weaknesses without asking us first;
• get around the limits Ordryx sets (sign-in tries, download limits, file sizes), or overload it;
• use Ordryx to send spam, or messages people didn't ask for;
• use someone else's sign-in, or share yours;
• sell, rent or resell Ordryx or access to it without our written OK;
• copy, pass on or take apart the software, except where the law allows (section 4). The WooCommerce plugin is GPL and may be copied under that licence.

Nothing here stops you using other software, building your own, or competing with us.

Found a security problem? Tell us at security@ordryx.com (also published at https://ordryx.com/.well-known/security.txt). We won't take action against you for a report made in good faith that keeps to these rules: report it to security@ordryx.com, give us reasonable time to fix it before telling anyone else, don't reach other people's data beyond what shows the problem, and don't disrupt Ordryx or anyone's shop.

7. Your data

What you put in Ordryx, and what your connected stores send it, stays yours. You let us hold, copy and handle it only to provide Ordryx to you, keep it safe and fix faults, as Part 2 sets out.

• We don't sell it, rent it, or use it for advertising.
• We never use it to train AI.
• We don't contact your customers.
• You can take it with you. Reports download as Excel and CSV, and a hosted shop's whole backup downloads from your account.

If you send us ideas or suggestions, we may use them without owing you anything. What you send in a support conversation or a diagnostics file is handled as Part 2 says.

8. Services you connect

Ordryx works with services you choose: Shopify, WooCommerce, shipping accounts (EasyPost, Shippo, ShipStation, UPS, FedEx, USPS and DHL Express), Stripe for card payments, your own mail server, your own backup storage, and an AI assistant. They're your accounts, under your agreements with them. You're responsible for following their terms, and we aren't responsible for what they do.

When you use one, Ordryx sends it what that use needs, with your keys:

• Asking for shipping rates, or buying a label, sends the recipient's name, company, address and phone to each shipping account you've connected with Enable rates on. A parcel across a border also sends a customs declaration. Never the customer's email. Rates and labels asked for with a shipping account's Test key never get the customer's name, street, company or phone: they go to a sample recipient in the order's own town, state, ZIP and country.
• Postage is charged by your shipping account, not by us.
• Card payments go from Stripe's reader (or, once the POS app is released, Stripe's software on a linked phone) to your Stripe account. Card numbers never reach Ordryx.
• An AI assistant gets only what its tools answer: stock, plans, printer status and the like. Never a customer's name, email or address. Each module's tools start Off, and they can only read.

Keys you save for these services are stored encrypted and never shown again.

What you ship is your responsibility. You alone are responsible for everything you ship with labels bought through Ordryx: what's in each package, how it's packed, marked and labelled, and how it's declared to the carrier, including hazardous materials, lithium batteries, customs and export. You must follow every federal, state and local law and rule that applies (the Department of Transportation's hazardous materials rules and export controls among them), those of each country a package goes to, and each carrier's terms, and keep up with them as they change. Ordryx's hazmat categories, battery codes, allowed services and customs fields only help you fill in what a carrier asks. They may be out of date or wrong for your package, and they aren't legal or compliance advice. Ordryx LLC takes no responsibility and accepts no liability for what you ship or how it's declared, or for any fine, penalty, surcharge, refused, returned or destroyed package, or claim that follows from it. Your shop's owner accepts this in Ordryx before its first label (since Ordryx 0.0.234).

9. The Ordryx app for Shopify

The Ordryx app connects your Shopify store to your Ordryx. You install it on Shopify's own consent screen. It reads your store's orders, fulfillments, products and locations. Once Shopify approves it, it also reads the ship-to of orders still waiting to ship: name, company, address and phone. Never email.

It writes one thing to your store, and only if your shop's owner turns on Tell Shopify the tracking number (it starts off): when you buy a label in Ordryx, a fulfillment with the carrier and tracking number. A void cancels it. Shopify then emails your customer unless you turn off Email the customer in Shipping's settings, or untick it when buying that label.

Your Ordryx reads your store itself. account.ordryx.com never reads your orders: it hands your store's key to your Ordryx and forgets it, and passes it through again each hour when it's renewed.

Shopify's API Terms (6.1.2) also ask that this agreement be at least as protective of Shopify as those terms. Nothing in these terms gives anyone exclusivity, stops you building or using competing products, or limits how you use your data or run your business, and section 14's limits never shift any liability to Shopify. Section 29 covers deletion after an uninstall.

10. Ordryx for WooCommerce

The Ordryx for WooCommerce plugin is free software under the GNU General Public License, version 2 or later. That licence, not these terms, covers its code. These terms cover what it connects to: account.ordryx.com and your Ordryx.

• Your Ordryx reads your store with a read-only WooCommerce key, which you allow on WooCommerce's own screen. It reads products, and orders with the billing name and email, and the shipping name, company, address and phone. Never the billing address, the billing phone or customer accounts.
• The plugin itself writes to your store: when you ship an order from Ordryx, it marks the order Completed, adds its tracking (as a note to your customer if your store keeps no tracking of its own) and adds a private note naming who shipped it in Ordryx. WooCommerce then sends its own email to your customer. Only a tracking number, a carrier's plain name and a link to that carrier's own tracking page reach your customer (since Ordryx 0.0.219 and the plugin 0.5.3). Once your store is disconnected, the plugin deletes Ordryx's key from it.
• The plugin tells account.ordryx.com when an order changes (with no order details), sends the codes and names needed to connect, and passes on erasures you make in WordPress so your Ordryx forgets those customers. Its readme lists each call.

11. Fees

Ordryx is free while hosting is being tested. Prices, billing and refunds will be added to these terms, and emailed to you 30 days before anything is charged; you choose whether to go on.

When we do charge, payment will go through Stripe on Stripe's own page. We never see or keep your card details.

12. Suspending and ending

You can stop at any time. Uninstall the app or the plugin from your store, unlink a self-hosted Ordryx, or ask us to remove a hosted shop. To close one, ask at privacy@ordryx.com: we confirm it with you and remove it within 7 days. Its backups can then be downloaded from your account for 30 days, and are deleted after (section 29).

We may suspend a hosted shop, a linked Ordryx's connection or an account if it puts other shops or our servers at risk, if it breaks these terms, or if the law requires it. We'll tell you first and give you a chance to fix it, unless it's urgent. Suspending stops it. It deletes nothing.

We may stop offering Ordryx, or a part of it, with 30 days' notice by email.

If Ordryx LLC ever closes, we intend to publish a key that unlocks every self-hosted Ordryx so it keeps working, and we'll give hosted shops 30 days to download their data before we turn the servers off. Activation isn't built, so nothing locks today.

What should outlast the end does: your data's ownership, Part 2's confidentiality and deletion, the limits on liability, and Colorado law.

13. No promises beyond these

Ordryx is provided as it is and as available, without any warranty beyond what these terms say, as far as the law allows. We work to keep it right and running, but we don't promise it's free of faults, always available, or right for your business, and we make no promise of uptime, for a hosted shop or any other part of Ordryx. Check what matters before you rely on it: stock counts, costs, tax figures, labels and postage.

14. Limits on liability

If something goes wrong, Ordryx LLC's total liability to you is limited to the greater of $100 or the fees you paid us in the 12 months before the claim. We aren't liable for lost profits, lost sales, lost data you could have restored from a backup, or other indirect losses. These limits don't cover fraud, wilful misconduct, or a breach of our data protection and security duties in Part 2. Some laws don't allow these limits; where they don't, they don't apply. These limits are between you and us: they never shift liability to Shopify (section 9).

Claims from your use. You cover us against claims that come from your own misuse of Ordryx, or from your own instructions about your customers' data. We give no indemnity beyond our duties in Part 2.

15. Colorado law

Colorado law governs these terms, without its rules on conflicts of law. A dispute is heard by the state courts of Weld County, Colorado (in Greeley), and we both agree to them. Either of us may still bring a claim in small claims court. There's no arbitration.

16. Changes to these terms

We may change these terms. Each version has a number and a date at the top. Before a change takes effect, we email the address on your account 30 days ahead. If you don't agree, you can stop using Ordryx before then. Once it's in force, the account asks you to agree to the new version once, at your next sign-in, and records it.

17. The rest

• These terms, the privacy policy and anything else we both sign in writing are the whole agreement between us about Ordryx.
• If a court finds part of these terms can't be enforced, the rest still stands.
• Not enforcing a term straight away doesn't mean we've given it up.
• Neither of us is responsible for delays caused by things outside our control.
• You may not pass these terms to someone else without our OK. We may pass them to a company that takes over Ordryx, only under these same promises, and we'll tell you 30 days before.
• We send notices to the email on your account. Send yours to the contact below.

18. Contact

• Legal notices under these terms: by post to the address above.
• Privacy and your customers' data (a data request, a question about Part 2): privacy@ordryx.com.
• A security problem (section 6), or a sign-in you think isn't yours (section 5): security@ordryx.com, also published at https://ordryx.com/.well-known/security.txt.
• Anything else: info@ordryx.com.

19. What this part covers

This part is our data processing agreement with you. It applies whenever we handle personal data for you: in a hosted shop, and in what passes through account.ordryx.com on its way to or from your Ordryx. We handle it for as long as you use Ordryx, then as section 29 says. Where this part and Part 1 disagree about personal data, this part wins.

The words we use:

• Personal data means anything about a person who can be identified.
• Your customers' data means personal data you keep in Ordryx, or connect to it, about anyone you deal with: people who buy from you, your contractors, your suppliers' contacts and your staff.
• Controller and processor mean what data protection laws mean by them. The controller decides why and how personal data is used. A processor handles it for the controller.
• Subprocessor means a company we use that handles your customers' data for us.
• Breach means anyone getting at, changing, losing or destroying your customers' data without being allowed to, by accident or on purpose.

Ordryx is offered only to businesses in the United States, for now. If it's ever offered abroad, these terms will change first. Under US state privacy laws we're your processor, or service provider: we handle your customers' data only on your instructions (section 22), pass you any request a person sends us (section 28), and allow audits (section 30). Colorado's Privacy Act and California's CCPA probably don't reach Ordryx LLC at its size, but we follow a processor's duties under them all the same.

20. Who decides what

• You're the controller of your customers' data. You decide what goes in Ordryx, who in your shop sees it, and what's done with it.
• A hosted shop: we're your processor for everything in it.
• account.ordryx.com: we're your processor for your store's data that passes through it: the order numbers in a Shopify customer's redaction, the order numbers in a WordPress erasure, a shipped order's tracking on its way to your WooCommerce site (with the name of who shipped it), Shopify's request number and the order numbers in a Shopify customer's data request, Shopify's privacy messages (which carry the customer's email and phone, and which we drop unread), the names of your store's people who connect it, use the app's page or the plugin, or agree to these terms for it, and the support conversations and diagnostics files you send. For the account's own records of the people who sign in to it (their email, password and sign-ins), we're the controller, and the privacy policy covers them.
• A self-hosted Ordryx: you handle your customers' data on your own computer. We aren't your processor for it, and we can't see it. We're your processor only for what passes through the account (above), and for what you choose to send us.

21. What we handle, and why

Here is what a shop's Ordryx holds about people, why, and how long it keeps it. It's the same on a hosted shop and a self-hosted one. The privacy policy lists every copy and how long each lasts.

Your own records (the orders and customers you type in, till receipts' emails, a WooCommerce buyer's name and email while the store is connected, your staff, their sign-ins and your activity log) are kept until you delete them. Ordryx removes none of them by itself, and has no button to delete most of them today. On a hosted shop we keep them as your processor. Your store orders' addresses follow the rules in the table.

Every order's ship-to is kept encrypted in your shop's database. Only the people you give See customers' addresses see it, and each time it's shown to someone, your activity log records who, when and which order (never the address). When a store order's address is cleared, what else could hold it goes with it: the store's mark of the address it last sent, carriers' error messages and rate notes, the parcel's towns and ZIPs, and the label's file and customs form. The database overwrites what's cleared.

Backups hold all of this too, except label files and customs forms, and with the ship-to addresses only encrypted (the key isn't in a local backup). Something cleared stays in the backups made before, until they're pruned: 14 local backups and 30 off-site copies by default (each your shop's setting, from 1 to 365; a hosted shop's plan limits copies and space), and, for Ordryx off-site, 30 more days in its trash.

We handle this data only to run your Ordryx for you, keep it and its backups safe, fix faults and answer you. Never to sell it, advertise with it, profile people or make automated decisions about them. Ordryx shares no customer data for advertising or sale, so there's nothing for your customers to opt out of: their addresses go only to the shipping accounts you connect, to deliver the parcels you send. That's a service to you, not sharing.

22. Only on your instructions

We handle your customers' data only on your instructions. Your instructions are these terms, what you and your people do and choose in Ordryx (its settings and switches included), and what you ask us in writing. If we think an instruction breaks the law, we'll tell you. If the law makes us handle the data some other way, we'll tell you first, unless the law forbids it: we give your customers' data to the police or a court only with a valid legal order.

If we can't meet any duty in this part, we'll tell you promptly, and Shopify too where your Shopify store's data is involved.

We open a hosted shop's data only to keep it running or safe, to fix a fault, when you ask us in writing, or when the law requires it, and we note each time. Opening it only with your consent, asked each time, is planned, not built. Today our server's administrator (root) can reach every hosted shop's data and reset a sign-in.

Fleet, the tool we run hosted shops with, reads only what it needs to watch a shop's health: its version, health check, module switches, two settings (time zone and backup destination), its off-site backup records and a few backup entries from its activity log, its performance figures and its log lines, whether it's set up yet, its disk use and its backup files' names and sizes. Not orders, customers or addresses.

If California's law applies to you

Where you're covered by California's Consumer Privacy Act, we're your service provider, and as well as the rest of this part:

• we don't combine your customers' data with personal data we get from anyone else, or from our own dealings with other people;
• we meet the Act's duties that apply to us, and give the data the same protection the Act requires of you;
• we'll tell you if we can no longer meet those duties;
• you may take reasonable steps to stop and put right any use of the data that this part doesn't allow.

23. Confidentiality

Everyone at Ordryx who can reach your customers' data is bound to keep it confidential, and reaches it only for the reasons in section 22.

Today that's Ordryx LLC's owner only, its only member, bound as such. Nobody else can reach it. An AI coding assistant the owner uses runs only commands the owner approves, whose output names no customer, and never reads a hosted shop's data, logs or backups. If one ever did, its company would become a subprocessor and join Annex B first.

24. Security

We protect your customers' data with the measures in Annex A, and keep them up to date. Annex A says what's in place now, what's decided but not built yet, and the gaps we know of.

25. Subprocessors

We use the subprocessors in Annex B: DigitalOcean and Fastmail. Each is bound by a written agreement that puts on it the same duties this part puts on us, at least as protective as this part (and, for your Shopify store's data, as Shopify's API Terms), and we stay responsible for them. Both agreements are in place: DigitalOcean's and Fastmail's standard data processing agreements apply to all their customers, us included, and we keep a copy of each.

Before we add or replace one, we'll tell you by email 30 days ahead, and update Annex B with the date. If you object for a good reason, tell us. If we can't settle it, you may stop using the part it affects. Nothing is charged while hosting is tested, so there's nothing paid ahead to give back.

Services you connect yourself (section 8) aren't our subprocessors. They're yours: you choose them, under your own agreements, and Ordryx sends them data only when you use them.

26. Where the data is

Hosted shops, the account and Fleet run on servers in the United States, at DigitalOcean in New York. Ordryx off-site's copies and Fleet's own backups are kept on a server in Colorado, USA, under Ordryx LLC's control, on encrypted storage. Fastmail sends our email from the United States (Annex B).

Ordryx is offered only to businesses in the United States, for now; if it's ever offered abroad, these terms will change first. Your own buyers may live anywhere, and their data is stored in the United States. You're responsible for your own notices to your buyers.

27. Breaches

If we learn of a breach of your customers' data that we hold, or that passes through us, we'll:

• tell you without undue delay, and within 24 hours of knowing your shop is affected, by email to the address on your account, and on the account's sign-in page if many shops are affected;
• tell Shopify within 24 hours where your Shopify store's data is involved, as Shopify's API Terms (6.2.10) require;
• say what happened, which data, what we've done to stop it, what you should do, and who to talk to, and tell you more as we learn it;
• contain it and find out how it happened: suspend or lock down a shop, end sign-ins, change keys, disconnect stores;
• help you tell your customers and regulators where the law requires. That's your decision as the controller, unless the law puts it on us.

Our security incident response policy says who does what. It and our data protection policy aren't published: we give them to you, and to Shopify, on request.

On a self-hosted Ordryx, a breach on your own computer is yours to handle. When the cause is ours (a flaw in Ordryx, or something at our account, Link or the remote-access relay), we tell you within the same 24 hours and help you contain it. Tell us straight away at security@ordryx.com if your Shopify store's data may be involved, so Shopify hears within 24 hours.

28. Helping you answer people

People may ask you to see, correct or delete what you hold about them. Ordryx helps:

• Seeing and correcting: an order's ship-to is on its order page, for the people you give See customers' addresses, and they can change it there.
• Shopify redactions: when a customer asks Shopify to delete their data, Shopify tells us, we pass it to your Ordryx, and your Ordryx clears those orders' addresses as soon as it receives it, with every copy it keeps (the parcels' towns and ZIPs, carriers' messages, the label's file), and never reads them again. This reaches your Ordryx only through the Ordryx app: for a store connected with its own app, clear the address on the order's page.
• WordPress erasures: erasing a customer in WordPress clears those orders' names, emails and addresses in your Ordryx at once, while the store is connected.
• Shopify data requests: when a customer asks Shopify for their data, Shopify asks for it to be given to you directly within 30 days. We pass the request on to your Ordryx, which shows it under Sales › Customers' data with its due date. There you download that customer's data as a structured, machine-readable file (JSON or CSV), with what was already cleared and when, and send it to them. Ordryx never emails it.

If someone asks us directly about data you hold, we'll pass it to you and won't answer it ourselves. Where Ordryx's tools aren't enough, ask us at privacy@ordryx.com and we'll help within 30 days. We'll also give you what we have to help with a data protection impact assessment, or with a regulator you consult.

29. Deleting it at the end

A hosted shop

Before a hosted shop is removed, and for 30 days after (section 12), you can take your data with you: download its backups from your account. 30 days after it's removed, our dashboard deletes it from our server by itself: its folder, with its database, documents and backups, any copies a restore set aside, and its keys. Its Ordryx off-site copies are deleted 30 days after it's removed.

Your Shopify store's data

When you uninstall the Ordryx app or disconnect the store, your Ordryx clears the ship-to of orders still waiting to ship as soon as it hears of it, and every other order's 29 days after the uninstall or the Disconnect, with every copy it keeps (the parcels' towns and ZIPs, carriers' messages, label files). When Shopify sends the store's erasure (48 hours after an uninstall), every order's ship-to goes at once. The orders themselves stay, as your own records.

Your WooCommerce store's data

A Disconnect (or deleting the plugin, or the store moving to another Ordryx) forgets the store's key. Orders still waiting to ship lose their ship-to, name and email at once, and every other order 29 days later, with every copy your Ordryx keeps. After a Disconnect an erasure in WordPress can no longer reach your Ordryx. The orders themselves stay, as your own records.

Your account

When you delete your account, its sign-in, recovery codes, passkeys, sign-in history and support conversations are deleted. A blank record with its number stays, so numbers aren't used twice. Removed installs' records and approved link requests are kept 90 days; our dashboard's (Fleet's) customer record is erased when the account is deleted, keeping only its number, dates, which shops were yours, the names and entitlements of your installs and the record of notices sent; Fleet's activity records are kept 1 year; the account's log files 30 days. The privacy policy lists each.

Backups

Data deleted from a shop stays in backups made before, until those backups are pruned. Our account's and dashboard's records stay in our own nightly backups until they age out: 7 on our server, the last 30 on our backup server (Annex B). We keep nothing longer than these rules say, unless the law makes us, and then only what it requires.

30. Audits and evidence

We'll answer your reasonable written questions about how we protect your customers' data, and show you what we can, Annex A included. Shopify may ask us for the same in its data protection reviews. We have no outside audit report, such as SOC 2, today.

Once a year, on reasonable notice and at your cost, you may audit how we handle your customers' data, or have an independent auditor do it for you. An auditor sees nothing of other shops' data.

31. Your part

As the controller, you:

• make sure you may collect your customers' data and use it in Ordryx, and tell them how you use it, in your own privacy policy;
• decide who in your shop sees it. Only the roles given See customers' addresses see where an order ships to; it starts on for the roles that ship, and the orders list shows no address. Your activity log's Address views say who was shown one, and when. We recommend you review them each month: a recommendation, not a duty;
• keep what you print or download safe: labels, packing slips and customs forms carry names and addresses, a customer's data file (Sales › Customers' data) carries everything about that customer, and the tax-time summary carries contractors' legal names, addresses and tax IDs;
• know that some things Ordryx makes are meant for others: a contractor's payment receipt carries a code that opens a public page showing the payee's name, the item, the amount and the date to anyone who has the receipt;
• on a self-hosted Ordryx, secure it (section 4).

What to tell your customers

A sentence you can use in your own privacy policy:

If we host your shop, you may add: "Ordryx LLC keeps our records on its servers in the United States, for us and on our instructions."

Annex A: Security measures

This annex is part of these terms. Our security incident response policy and data protection policy go into more detail; they aren't published, and we give them to you, and to Shopify, on request. If a breach affects your shop, we tell you within 24 hours of knowing it (section 27).

In place now: every shop

• Two-step sign-in for everyone on the shop's staff: a password of at least 10 characters and a code, or a passkey. Contractors in the portal may choose it.
• Roles decide who sees and does what. Nobody can give someone more access than they have, and only owners touch owners.
• An activity log of who did what, with each sign-in's and failed sign-in's network address.
• Saved keys to other services, authenticator keys, W-9s and tax IDs, and every order's ship-to (name, company, address and phone), are encrypted (Fernet: AES-128 with HMAC-SHA256), with a key that isn't in local backups.
• Every backup is checked after it's made. Off-site copies are sealed (AES-256-GCM, with a key from the shop's passphrase) before they leave, then fetched back and restored as a test. Local backups are sealed too if the shop turns on Lock them (Settings › Backups › On this server; recommended, and needed to read a Shopify store's orders).
• Customers' addresses never go into reports' downloads, AI answers or the diagnostics file. The one file that carries them is a customer's own data (Sales › Customers' data), for people given See customers' addresses, each download recorded in Address views. Shopify's ship-to is read only for orders waiting to ship, and cleared 90 days after the order is done, or sooner (section 21).
• Only people given See customers' addresses see where an order ships to; the orders list shows no address. Each time an address is shown, printed or downloaded, the activity log records who, when and which order, never the address.
• When a store order's address is cleared, its other copies go too: the store's mark of it, carriers' messages, the parcel's towns and ZIPs, the label's file and customs form. The database overwrites what's cleared (SQLite's secure_delete).
• A label's file and customs form are kept only until the carrier has the parcel (a day after the first scan; 14 days unscanned; none past 16 days), and never go into a backup or an off-site copy. Backups are built afresh, so nothing cleared before is left in their free space.
• A shipping account's Test key never gets a customer's name, street, company or phone: its rates and labels go to a sample recipient.
• An install can be marked as a copy of a shop (a staging copy, say) and scrubbed of customers' names, emails, addresses, phones, order notes and label files. A copy never sends off-site copies, links to the account, sends feedback or pauses a printer. Our rule is that any copy we make is scrubbed before anyone opens it.
• Log files keep no visitor's network address and no values from database errors.
• Everything that crosses the internet uses HTTPS, except a shop's own email if its owner sets the mail connection's security to None. None works only for a mail server on the shop's own network; anywhere else is refused (since Ordryx 0.0.225). Printers and Spoolman, which carry no customer data, are reached over plain HTTP at the address the shop gives (meant for its own network).
• On a self-hosted shop's own network, once it's linked and the owner's test passes, browsers are sent on to HTTPS; the owner can turn on Require HTTPS, which then refuses sign-ins over plain HTTP (since Ordryx 0.0.217).
• A self-hosted install's safety copy before an update is sealed like its backups and removed a week after it's made (since Ordryx 0.0.217).
• Ordryx reads a Shopify store's orders only while the shop's own backups are locked (Settings › Backups › On this server › Lock them), hosted and self-hosted alike, except to send back a tracking number (since Ordryx 0.0.225).
• For an incident, the shop's owner can sign everyone out at once: every other session and device link ends (the owner's current sign-in stays; the command keeps none), remembered devices and push notifications are forgotten, unused invites and temporary passwords stop working, and AI connections end. On the computer Ordryx runs on, a command does the same when the owner's own sign-in is in doubt (since Ordryx 0.0.225).

In place now: hosted shops and our servers

• Everything we keep on our server (each hosted shop, the account and our dashboard) is in an encrypted vault (LUKS2), opened by a passphrase only Ordryx LLC's owner holds. After any restart nothing runs until it's unlocked. DigitalOcean doesn't back the server up (since 13 November 2026).
• Each shop in its own container with its own database. It can't reach another shop, our dashboard or our private network. Containers run without extra privileges, with limits on memory, processor and processes.
• Each update starts with a verified backup, and rolls back if the new version isn't healthy.
• Our dashboard (Fleet) is reachable only on our private network (Tailscale), only for listed sign-ins, with a password and an authenticator code. It never shows a shop's keys, and has no screen to read a shop's database or download its backups. Everything done in it is recorded.
• Root sign-in to our servers by SSH key only, never a password, with repeated failures blocked. Security updates install themselves.
• Health checks every five minutes, with alerts to us. They run on the same server: nothing checks it from outside.
• A hosted shop's backup downloads from the account only after a password and a code, or a passkey. Each download is emailed to the merchant's account address and recorded, and downloads are limited each day.
• Automated tests use made-up data in temporary databases.

Annex B: Subprocessors

The companies that hold or can see your data for us, for hosted shops and the account: our subprocessors. Updated 13 November 2026. Shopify, WooCommerce, your shipping accounts, Stripe, your mail provider and your AI assistant aren't listed: they're your own services (section 8).

No AI assistant reads anything from a hosted shop or our servers. If one ever did, its company would join this list first.

Our backup server

Ordryx off-site's copies (hosted shops' nightly backups and key bundles, sealed with the shop owner's passphrase before they leave the shop) and Fleet's own nightly backups (a bundle of Fleet's and the account's records, our hosting customers' names, emails, phones and mailing addresses among them, sealed with our own passphrase) are kept on a server in Colorado, USA, under Ordryx LLC's control, on encrypted storage. No other company runs it, so it isn't a subprocessor.

Services that hold none of your customers' data