QuickMerge — Privacy Policy

Last updated: October 12, 2026

QuickMerge ("the app") is a Shopify app that combines multiple orders from the same customer into one order. This policy explains what data the app processes and why.

Data we access

• Orders: order numbers, line items, prices, shipping lines, taxes, discounts, payment status, fulfillment status, tags and notes — needed to decide whether orders can be merged and to create the combined order.
• Customer details on orders: name, email address, phone number and shipping/billing address — needed to match orders from the same customer and to create the combined order with the correct delivery address.
• Shop details: shop name, currency and timezone.

Data we store

• An index of recent orders (order number, customer id, email, a normalised form of the shipping address, totals, status) so merge opportunities can be found quickly. Rows older than 90 days are deleted automatically.
• Merge history: which orders were combined, when, the resulting order and a log of the steps performed.
• Your settings and the shop's Shopify access token.

We do not sell data, use it for advertising, or share it with third parties other than the hosting provider that runs the app (Railway) and Shopify itself.

Data deletion

• When you uninstall the app, the order index, merge history and access tokens for your shop are deleted immediately. Your settings are kept for 48 hours so a reinstall restores them, and are deleted when Shopify sends the shop/redact request.
• One record is kept indefinitely: a one-way hash of your store domain together with the number of merges ever made, so the Free plan's allowance cannot be reset by reinstalling. It contains no personal data and cannot be traced back to your store from the outside.
• Customer deletion requests (customers/redact) remove customer identifiers from our order index.
• Customer data requests (customers/data_request) can be fulfilled from your merge history inside the app; contact us for an export.

Security

All traffic is encrypted (TLS). Access tokens are stored encrypted at rest by the hosting provider and are never exposed to browsers or third parties.

Contact

Questions about privacy? Email pillgates.dev@gmail.com.