Privacy Policy

Last updated: 2026-10-25

Tacey (“Tacey”, “we”, “us”, “our”) is operated by ONDUTYOPS LLC, with a registered address at Coastal Highway, Lewes, Delaware 19958, United States.

1. Who we are, and how to contact us

Tacey is a software application distributed through the Shopify App Store that provides order-address validation, self-service order editing for shoppers, and post-purchase upsell tools for merchants running stores on the Shopify platform (the “Service”).

This Privacy Policy explains what personal data Tacey collects, why, how long we keep it, who we share it with, and the rights available to the people the data is about. It applies to:

• Merchants who install Tacey from the Shopify App Store and use it to manage their store;
• Shoppers, the merchant’s own customers, whose orders and shipping addresses Tacey processes on the merchant’s behalf; and
• Visitors to our marketing website.

Questions about this policy, or about how your data is handled, go to Section 24.

2. Two roles: controller and processor

Tacey handles two categorically different kinds of personal data, under two different legal roles. This distinction governs everything else in this policy.

2.1, Where we are the controller: merchant data

When a merchant installs Tacey, creates an account, contacts support, or receives marketing communications from us, we act as the data controller for that merchant’s own personal data, their account information, their billing relationship (which runs through Shopify, see Section 5), their support correspondence, and their communication preferences. We decide why and how that data is processed, within the limits of this policy.

2.2, Where we are the processor: shopper data

When Tacey validates a shipping address, lets a shopper edit their own order, or emails a shopper about a flagged address, we act as a data processor (or “service provider” under US state privacy law) on behalf of the merchant, who is the data controller for their own customers. We process shopper data only:

• to perform the Service the merchant has installed and configured;
• under the merchant’s instructions, as expressed through their use of Tacey’s settings and features; and
• under the terms of the Shopify Merchant Agreement and, where a Data Processing Agreement is in place with a merchant, under that agreement’s terms.

We do not use shopper data for our own purposes. We do not use it for our own marketing, we do not build cross-merchant profiles from it, and we do not sell it. A merchant’s own privacy policy that references apps installed on their store should direct their shoppers to the explanation in this section and in Section 4 and Section 15.

3. What we collect from merchants

When you (a merchant, or someone acting on a merchant’s behalf) install and use Tacey, we collect:

Account and store information, received from Shopify when you install the app and on every subsequent authentication: your shop’s domain, the Shopify shop ID, your shop’s name, the store owner’s name and email address (where Shopify provides it), your store’s country, city and business phone number, your store’s currency and time zone, your store’s detected locale, and your Shopify plan tier.

Language and settings choices you make inside Tacey, your chosen admin language (distinct from the language Shopify detects for your store), your validation region settings, your edit-window configuration, and which optional tools you have switched on.

Billing information, limited to your selected Tacey plan and your order usage against that plan’s cap. Tacey does not collect or store payment card details at any point, see Section 5.

Support and communication data, anything you send us when you contact support, plus your email preferences, including whether you have unsubscribed from our weekly product update email.

Product update emails. When you install Tacey, Shopify gives us your store’s contact email address. We use it to send you a short weekly email, “What shipped in Tacey”, that lists what changed in the app that week. We send it because you use Tacey and these changes affect the app you use; our lawful basis is legitimate interest (see Section 7). Every email has a one-click unsubscribe link, and unsubscribing stops them at once without affecting your use of the app. You can also object at any time using the contact in Section 24. We do not send these emails to your customers, and we do not share your address with anyone to send them.

Usage data, collected through our product analytics tools, which pages of the app you visit, which features you use, and coarse technical information such as browser type and approximate location derived from IP address.

4. What we process on behalf of merchants: shopper data

To perform the Service, Tacey processes personal data belonging to the merchant’s own shoppers. This data is provided to us by Shopify, at the merchant’s instruction, because the merchant has installed Tacey and granted it access to their store’s order data. We hold it as a processor, strictly to perform the following functions:

Order and shipping information, the shipping address on an order (name, street address, city, state/province, postal code, country, phone number where provided), the order number and line items, and order status, received via Shopify webhooks and the Shopify Admin API, to run address validation and to let the shopper view and edit their own order.

Shopper contact information, the shopper’s email address, used solely to send the shopper transactional communications about their own order: a notice that their address may need attention, a link to review or edit their order, and a reminder before the edit window closes. We do not use shopper email addresses for our own marketing, and we do not add shoppers to any mailing list of ours.

Validation results, the outcome of checking a shipping address against our address-validation providers: whether it was found deliverable, a confidence classification, and any corrected or standardized version of the address suggested to the shopper.

Edit history, a record of any change made to an order through Tacey: what was changed, when, by whom (the shopper or the merchant), and, where the change involved money, what happened to the money, this is the reconciliation ledger described in Section 8.

We hold no other shopper category of data. We do not process shoppers’ browsing history on the merchant’s storefront, their purchase history beyond the order being validated or edited, or any data not described above.

5. Payment data: we never see it

Tacey never collects, transmits, processes, or stores payment card numbers, bank details, or any other payment credential, for merchants or for shoppers. Payment for a merchant’s Tacey subscription runs entirely through Shopify’s own billing system (Shopify’s AppSubscription API); we receive only the plan the merchant selected and confirmation of billing events from Shopify, never a card number. Payment for a shopper’s original order runs entirely through Shopify’s own checkout and whatever payment processor the merchant has configured; Tacey never touches that flow. Where a shopper’s order edit results in an additional charge or a refund, the money movement itself is performed by Shopify’s own payment rails, Tacey initiates the request through Shopify’s APIs but never handles or stores the underlying payment instrument.

This is a significant, deliberate reduction in the scope of what we hold: Tacey is fully out of scope for PCI-DSS because it never comes into contact with cardholder data in any form.

6. Cookies and website analytics

6.1, Our marketing website

Our marketing website uses cookies and similar technologies for the purposes described below.

We do not use third-party advertising cookies, and we do not run retargeting pixels.

6.2, Inside the Shopify-embedded admin app

The merchant-facing part of Tacey runs embedded inside Shopify’s own admin, inside an iframe, under Shopify’s session model. It uses a session cookie required for the app to function inside that embedded context (compliant with Shopify’s App Bridge and embedded-app requirements) and sends product-analytics events to help us understand how the app is used and to improve it.

6.3, Managing cookies

You can control or delete cookies through your browser settings. Blocking strictly necessary cookies may prevent parts of our website or the embedded app from working correctly.

6.4, Consent records

When you make a cookie choice on this website, in the banner, the preferences modal, an opt-out, or through a Global Privacy Control signal, we keep a server-side record of that decision. This exists so that if someone disputes what they were shown or what they agreed to, we can produce the actual record rather than relying on memory.

Each record holds: which categories you allowed, the region and country we detected, whether your browser sent a Global Privacy Control signal, how the choice was made, the version of the cookie banner you were shown, a coarse device, operating system and browser description parsed from your browser’s user-agent string, which trackers were actually enabled as a result of your choice, the page you were on, the page that referred you, your browser’s language setting, your device’s time zone where your browser provides it, and your IP address.

We keep the IP address specifically so we can show, if ever asked, that a given decision came from a given visitor at a given time. We do not use it to build a profile of you, to identify you for any other purpose, or to combine it with the shopper or merchant data described elsewhere in this policy. See Section 12 for how long we keep these records.

6.5, Free tools and Ask Tacey

Our free tools at tacey.app/tools work without installing Tacey. They include the agentic readiness audit and the Ask Tacey chat that appears under some results. This section covers what happens to what you type into them. For these tools we are the controller of that data, and it is separate from the merchant and shopper data described in Sections 3 and 4.

What goes to AI providers. The answers in Ask Tacey and the AI summary in the audit are written by AI language models that other companies run. When you send a message in Ask Tacey, we pass on the question you typed, up to six of your earlier questions from the same chat, and the result on your screen, cut to its first 3,000 characters. When you run the audit, we pass on the audited store’s name or domain and the audit’s findings, which can quote text from that store’s public pages. We send this to one provider at a time: Google (Vertex AI) first, then Anthropic, then OpenRouter, then DeepInfra. A later provider receives your text only if the one before it could not answer. All four are listed in Section 10 and on our Subprocessors page.

We do not ask for personal data, and these tools do not need any. Please do not type your own or anyone else’s personal data into the chat. If you do, it goes to the provider together with the rest of your message.

Nothing from the Tacey app is sent. These providers never receive a merchant’s account data, or a shopper’s name, email address or shipping address.

What each provider says it does with it. These are the providers’ own statements. We do not control them, and each provider’s own terms apply:

• Google (Vertex AI): Google states that it does not train its models on this data without our permission. It may hold a request in memory for up to 24 hours and may log prompts to detect abuse, under the Google Cloud terms. We use its United States region.
• Anthropic: Anthropic states that by default it does not use inputs and outputs from its commercial products to train its models, and that it deletes them from its systems within 30 days. Content that its safety systems flag as a possible policy violation can be kept for up to two years.
• OpenRouter: OpenRouter states that it does not use inputs or outputs to train models, but that it may store inputs, and that it passes your text to the company that runs the model, which may keep and use it for its own purposes under its own terms. For the model we use, that company is Google.
• DeepInfra: DeepInfra states that it holds requests in memory only while it answers them, does not store them or log their content, and does not use them to train models, except that for models made by Google or Anthropic the model maker’s own training policy applies. Some of the models we may use there are made by Google.

What we keep. We do not keep your questions, the answers, or the text we sent to the providers. The chat lives in your browser tab and is gone when you close it. Our server logs record that a provider call failed and its status code, never your text. To enforce a daily limit we keep a counter against a salted one-way hash of your IP address. The counter stops applying at the end of the day (UTC), and a clean-up that runs early the next day (UTC) deletes it, or within a few days if an unusual flood of requests leaves more than one run can clear. The database’s point-in-time recovery may keep a deleted copy for up to 30 days. If you have allowed analytics cookies, we also record that a tool was used and its score, never what you typed.

If you ask a tool to email you its report, join a waiting list, or enter your email to see a result, we keep that email address (and your name if you gave it), which tool it came from, and whether you agreed to updates. We keep it until you ask us to delete it, using tacey.app/privacy-request. The report email is sent through Cloudflare (Section 10).

7. Lawful bases for processing

Where the UK GDPR or EU GDPR applies, we rely on the following lawful bases:

For shopper data specifically, because we act as a processor, the underlying lawful basis for processing a shopper’s personal data is the merchant’s own basis for running their store and fulfilling that shopper’s order.

8. How we use the data we hold

We use the data described in Sections 3 and 4 to:

• Validate shipping addresses against our validation providers (Geocodio for US and Canada addresses, Google Address Validation and Google Geocoding for Mexico and international addresses), and surface the result to the merchant and, where relevant, to the shopper.
• Let a shopper view and, where the merchant has enabled it, edit their own order on Shopify’s own order-status page, correcting a flagged address, or making other edits the merchant has configured as available.
• Record every edit to the reconciliation ledger: what changed, before and after values, whether money moved and how much, who initiated the change, and whether the change was confirmed downstream. This ledger exists on every plan, without exception, so a merchant can trust and audit every edit made through Tacey.
• Send transactional emails to shoppers about their own order, an address that needs review, a link to fix it, and a reminder before an edit window closes.
• Enforce the plan a merchant has subscribed to, counting orders against the applicable cap over the correct rolling window (see the Terms of Service for how that window works).
• Operate, maintain, and secure the Service, including detecting abuse, debugging, and monitoring performance.
• Improve the Service using aggregated or pseudonymized usage data.
• Communicate with merchants about their account and changes to the Service, including the weekly product update email described in Section 3, and (with consent) any other marketing.
• Meet legal, tax, and compliance obligations, including responding to Shopify’s mandatory privacy webhooks (see Section 15).

We do not sell personal data. We do not use shopper data to build advertising profiles, and we do not share shopper data with any party outside the subprocessors listed in Section 10 and the merchant themselves.

9. Who we share data with, and why

We share personal data only in the following circumstances:

• With Shopify, because the Service operates as a Shopify app and every order, address and shop record we process originates from, and is written back to, Shopify’s platform.
• With our subprocessors (see Section 10), each of whom processes data only to provide a specific function of the Service to us, under a contract that restricts their use of the data.
• With the AI providers behind our free tools (see Section 6.5 and Section 10), only for what you type into Ask Tacey and the audit summary, so that an answer can be written.
• With the merchant themselves, since a merchant using Tacey can see their own shoppers’ order and validation data inside the app, this is the same data the merchant already holds in their own Shopify admin.
• To comply with the law, such as a valid subpoena, court order, or regulatory request, or to protect the rights, property, or safety of Tacey, our merchants, their shoppers, or the public.
• In connection with a corporate transaction, a merger, acquisition, financing, or sale of assets, in which case we require the successor entity to honor the commitments in this policy.

We do not share personal data with any party for that party’s own marketing purposes.

10. Subprocessors

The following subprocessors have access to the categories of personal data listed, strictly to perform the function described. This table is public and we update it as our subprocessor list changes; a merchant performing a security review can request our full subprocessor detail using the contact in Section 24.

Cloudflare, Google, Geocodio, and Mixpanel process data as part of running the core Service for every merchant. Intercom and Customer.io process merchant account data specifically to track and message merchants about their own account lifecycle (installs, plan changes) and never receive shopper order or address data. Google (Vertex AI), Anthropic, OpenRouter and DeepInfra serve only the free tools on this website, and never receive a merchant’s account data or any shopper data. Vendors that serve only our website, such as analytics and session replay, are listed on our Subprocessors page rather than in this table.

11. International data transfers

Our subprocessors are located in, or transfer data to, the United States. Where personal data originating in the UK, EEA, Switzerland, or another jurisdiction with data-transfer restrictions is transferred to the United States or another third country, we and our subprocessors rely on the following safeguards:

We enter into a Data Processing Agreement, incorporating these transfer safeguards, with any merchant who requests one, see Section 24.

12. Data retention

We retain personal data only for as long as necessary for the purposes described in this policy:

On deletion of raw order payloads specifically

When a merchant uninstalls Tacey, Shopify sends a mandatory shop/redact webhook (48 hours after uninstall) instructing us to erase that merchant’s data. On receiving it, we delete the merchant’s database records and sweep raw order payloads from our object storage.

In the overwhelming majority of cases this erasure completes in the same operation. Our system is built to report this honestly: if the component responsible for sweeping object storage cannot be reached at the moment of erasure, our system records that the sweep could not be confirmed rather than reporting it as successful, and the event is logged for investigation and remediation. We never report an unconfirmed sweep as a confirmed one. A merchant with a specific concern about their erasure can contact us for the current status of their request.

Individual shopper erasure

A shopper (or a merchant on a shopper’s behalf) can request erasure of that shopper’s individual data through Shopify’s customers/redact mechanism, which we honor by deleting that shopper’s individually-identifiable validation and order-edit records tied to their Shopify customer ID.

13. Security measures

We apply the following measures to protect personal data:

• Encryption in transit, every connection to and within the Service uses TLS.
• Encryption at rest, data stored in our infrastructure provider’s database and object storage is encrypted at rest by that provider’s default infrastructure controls.
• Least-privilege API access, Tacey requests only the Shopify API scopes required for its features, each of which is disclosed to the merchant and enforced by Shopify at install time.
• Webhook authenticity verification, every inbound Shopify webhook is verified against its HMAC signature before being processed, and requests that fail verification are rejected.
• Access controls, internal access to production systems and data is restricted to personnel who need it to operate the Service.
• Offline-token handling, because customer-triggered order edits run without an active merchant session, the access token used for that purpose is refreshed and stored securely rather than persisted indefinitely in a static form.
• No storage of payment credentials, see Section 5.

We do not currently hold third-party security certifications such as SOC 2, ISO 27001/27017, or PCI-DSS (the last of which does not apply given Section 5). No accredited body issues a general-purpose “GDPR certification”, our privacy program is built to meet GDPR obligations, and we describe it in those terms rather than as a certification we hold.

No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

14. Your rights, and how to exercise them

Depending on where you are located, you may have some or all of the following rights over your personal data:

• Access, to obtain a copy of the personal data we hold about you.
• Rectification, to have inaccurate data corrected.
• Erasure (“right to be forgotten”), to have your data deleted, subject to legal retention requirements.
• Restriction of processing, to limit how we use your data in certain circumstances.
• Data portability, to receive your data in a structured, commonly-used, machine-readable format.
• Objection, to object to processing based on legitimate interest, including for direct marketing.
• Withdraw consent, where processing is based on consent, at any time, without affecting the lawfulness of processing before withdrawal.
• Lodge a complaint, with a supervisory authority (see Section 22).

These rights apply directly to merchants with respect to their own account data, and to website visitors with respect to the website and marketing data described in Section 6. To exercise them, submit a request at tacey.app/privacy-request, or contact us using the details in Section 24. We confirm the email address a request came from before acting on it.

For shopper data, see Section 15, the mechanism is different because we act as a processor, not a controller, for that data.

15. Shopper rights specifically, and the merchant’s role

Because Tacey processes shopper data as a processor acting on a merchant’s instructions, a shopper’s primary relationship for exercising their privacy rights is with the merchant they bought from, not with us directly. This mirrors how Shopify itself structures privacy requests across its entire platform.

In practice, this happens automatically through three mechanisms Shopify requires every app to support, and which Tacey implements:

• A shopper asks a merchant what data is held about them (Shopify’s customers/data_request topic). We respond to the merchant’s store with a count and description of what we hold about that shopper so the merchant can fulfill the request, we do not contact the shopper directly, because the merchant is the controller and because Shopify’s API Terms restrict apps from contacting a merchant’s customers outside the merchant’s own instruction.
• A shopper asks to be erased (Shopify’s customers/redact topic). We delete that shopper’s individually-identifiable records.
• A shop itself is erased, 48 hours after uninstalling Tacey (Shopify’s shop/redact topic). We delete the merchant’s full data set, including the shopper data processed on their behalf, subject to the note in Section 12.

All three mechanisms are implemented and active in Tacey’s production system. A shopper who wants to exercise a privacy right about a specific order should contact the merchant they ordered from; a merchant who needs help fulfilling that request, or who wants to confirm what we hold, can contact us directly using Section 24.

16. Children’s data

The Service is not directed to children, and we do not knowingly collect personal data from anyone under the age of 16 (or the relevant age of digital consent in their jurisdiction, if higher). Tacey processes shopper order data only in the ordinary course of a merchant’s own commerce transactions; if we become aware that we have inadvertently processed a child’s data outside that context, we will delete it.

17. Automated decision-making

Tacey uses automated logic to classify a shipping address (for example, as likely deliverable, likely undeliverable, or uncertain) and to suggest a corrected form of an address. This is not automated decision-making with legal or similarly significant effect on a person:

• It never blocks a purchase. If a validation check fails, times out, or cannot reach a provider, the order proceeds exactly as it would have without Tacey, this is a deliberate design principle, not an incidental outcome.
• It is a verdict about an address, not a decision about a person. The output is a data-quality signal shown to the merchant and, where relevant, a suggestion shown to the shopper to accept or reject. It does not determine eligibility, pricing, creditworthiness, or any other outcome that affects a person’s legal rights or access to a service.
• A human, the shopper, always has the final say on whether to accept a suggested address correction or to keep what they entered.

Tacey does not perform automated decision-making that would trigger a right to human review, explanation, or objection under Article 22 of the GDPR or equivalent laws.

18. AI assistants connected to Tacey

A merchant can connect an AI assistant, for example Claude or ChatGPT, to their own Tacey account, so that they can ask questions about their store in plain language. This section covers what such a connection lets the assistant see, what Tacey keeps about it, and how it ends. It applies only to a store that has connected an assistant.

18.1, What the assistant can read

The merchant approves the connection on a screen inside their Shopify admin. Once approved, the assistant can read Tacey’s records for that one store:

• which orders have address problems, and why;
• the order changes Tacey recorded, and the money they moved;
• money waiting on the merchant;
• order merges; and
• the store’s plan and order usage.

It receives order numbers, two-letter country codes, plain-language reasons, dates, amounts and links. It does not receive a customer’s name, email address, phone number or street address. The connection is read-only: it does not let an assistant change, refund, cancel or merge an order.

18.2, What Tacey records, and for how long

Tacey does not receive or store the merchant’s conversation with the assistant. For each request, Tacey records which assistant asked, which tool it used, whether the request succeeded and how many records it returned. We keep this record to operate and secure the connection and to account for what an assistant read, and we keep it for 90 days. If the shop’s data is erased after uninstall (see Section 12 and Section 15), these records are erased with it.

18.3, Ending a connection

A connection ends when the merchant disconnects it, when Tacey is uninstalled, or after 90 days. Access tokens last one hour.

18.4, The assistant provider

The assistant provider (for example Anthropic or OpenAI) handles what the assistant shows it under that provider’s own terms and privacy policy. To ask about anything in this section, use the details in Section 24. Anthropic also appears in Section 10 for a different reason: it is one of the providers behind our free tools. That is separate from a merchant connecting an assistant to their own account.

19. Data breach notification

In the event of a personal data breach that poses a risk to the rights and freedoms of individuals, we notify affected merchants without undue delay and, where legally required, notify the relevant supervisory authority within the timeframe required by applicable law (72 hours under the GDPR, from the time we become aware of the breach). Where a breach affects shopper data we process as a processor, we notify the affected merchant promptly so they can meet their own notification obligations as the controller.

20. Do Not Track and similar signals

Our website does not currently respond differently to browser “Do Not Track” signals. We will update this section if that changes, including in response to legally binding opt-out signals such as the Global Privacy Control where applicable.

21. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, our subprocessors, or applicable law. We post the updated policy on this page with a revised “Last updated” date, and where a change is material, we provide merchants with additional notice (such as an in-app notification or an email) before the change takes effect. Continued use of the Service after a change takes effect constitutes acceptance of the revised policy.

22. Complaints and supervisory authorities

If you believe we have not handled your personal data in accordance with this policy or applicable law, contact us first so we can try to resolve your concern (see Section 24). You also have the right to lodge a complaint with a data protection supervisory authority in your country of residence, place of work, or the place of the alleged infringement, for example, the Information Commissioner’s Office in the United Kingdom (ico.org.uk), or your national data protection authority in the European Union.

23. California and other US state privacy rights

Depending on your state of residence, you may have rights under laws such as the California Consumer Privacy Act (as amended by the CPRA), the Colorado Privacy Act, the Connecticut Data Privacy Act, the Virginia Consumer Data Protection Act, and similar state laws, including the right to know what personal information we collect, the right to delete it, the right to correct it, and the right to opt out of the sale or “sharing” of personal information for cross-context behavioral advertising.

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising, as those terms are defined under applicable state law. To exercise a state privacy right, contact us using the details in Section 24.

24. Contact

For any question about this Privacy Policy, or to exercise a right described above, contact us at:

Data-subject request form: tacey.app/privacy-request

Email: hello@taceysupport.app

Postal address: Coastal Highway, Lewes, Delaware 19958, United States