Privacy Policy

Effective 12 October 2026

1. Who we are

Orkestr Recovery is a Shopify app operated by Ludovic Lolli, acting in an individual capacity, based in Italy ("we", "us"). You can contact us about privacy at orkestr.recovery@gmail.com.

2. Our role

Orkestr Recovery helps Shopify merchants identify inactive customers, prepare recovery campaigns and measure recovered sales.

• For the personal data of a merchant's customers, the merchant is the controller and we act as a processor on the merchant's behalf, under our Data Processing Agreement.
• For limited technical data about merchants and their store staff (section 7), we act as the controller.

If you are a customer of a Shopify store, please contact that store first: it decides how your data is used and can forward your request to us.

3. Customer data we access from Shopify

When a merchant opens the app, we read from the merchant's Shopify store, with the merchant's permission:

• customer ID and name;
• email address and email marketing consent status;
• total number of orders and total amount spent;
• order IDs, order dates, order totals and discount codes used, to calculate purchase frequency and attribute recovered orders;
• the store's currency and primary language.

We do not read customer addresses, phone numbers or the products purchased. Inactivity, purchase frequency and priority scores are calculated when the app is used and are not stored.

4. Customer data we store

We store customer data only when the merchant creates a recovery campaign for a specific customer. For each campaign we store: the store domain, the customer ID, name and email address, the campaign status and priority, the incentive, the message text, the discount code and its Shopify ID, the creation, sending and recovery dates and, if an order is attributed to the campaign, the order ID and amount.

5. Data sent to OpenAI

Only when the merchant clicks "Generate with AI", we send OpenAI the minimum information needed to draft a message: the customer's first name, days since the last order, average days between orders, number of orders, rounded spending indicators, the priority score, the suggested incentive and the store language.

We do not send OpenAI the customer's last name, email address, postal address, phone number, order list or purchased products. OpenAI states that data sent through its API is not used to train its models by default, and that it may retain API data for up to 30 days for abuse monitoring, unless a longer retention is required by law. The app limits AI generation to 30 requests per store per day.

6. Why we use customer data

We use customer data only to provide the app's features:

• identifying and prioritizing inactive customers;
• drafting recovery messages;
• creating single-use discount codes reserved for one customer, valid for 14 days;
• attributing later orders that use those codes;
• showing campaign history and recovery results to the merchant.

Orkestr Recovery does not send emails or other messages to customers. The merchant decides whether to contact a customer and sends any message from their own tools. Campaigns can be created only for customers subscribed to email marketing. We do not sell personal data, we do not use it for advertising, and the app makes no decisions with legal or similarly significant effects on customers: scores only help the merchant prioritize.

Discount codes are random and do not contain customer names (for example "OR15-7K2QXM").

7. Data about merchants and store staff

We also process, as controller:

• the store domain and the authentication session data required by Shopify to run the app;
• an access log of operations on customer data, with the store, the type of operation, the technical Shopify user ID of the staff member who performed it, the result and the time, without customer names or email addresses;
• daily counters of AI generations per store;
• emails you send us for support.

We use this data to provide the service under our Terms of Service, to keep it secure and prevent misuse (our legitimate interest), and to comply with legal obligations.

8. Service providers

• Render: application hosting and database, located in Frankfurt, Germany (EU).
• OpenAI: generation of message drafts, as described in section 5. OpenAI may process data in the United States.

Where a provider may process data outside the European Economic Area, the transfer relies on the safeguards in that provider's data processing agreement, such as the European Commission's Standard Contractual Clauses. Shopify is the platform on which the app runs and is governed by its own privacy policy.

9. How long we keep data

• Campaign data is kept for up to 12 months from the campaign's creation. After that, personal data in the campaign is irreversibly anonymized; only the status, dates, incentive and recovered amount remain, for aggregate statistics.
• When Shopify sends a customer deletion request (customers/redact), that customer's campaigns are irreversibly anonymized.
• When a merchant uninstalls the app, Shopify sends a shop deletion request (shop/redact), normally 48 hours later. We then delete all data about that store: campaigns, sessions, AI usage counters and access logs.
• Access logs are kept for up to 12 months, unless earlier deletion is required following shop deletion or applicable privacy requirements.

10. Security

Data is encrypted in transit (HTTPS) and at rest by our hosting provider. Requests from Shopify are verified, administrative accounts use multi-factor authentication, access to customer data is logged and reviewed monthly, and development uses a separate environment with test data only. We follow a documented security incident response policy and inform affected merchants without undue delay.

11. Your rights

Under the GDPR and similar laws, people have the right to access, correct, delete or restrict the use of their personal data, to object to its use and to data portability. Customers of a store should contact the merchant, who can submit requests through Shopify; we handle them through Shopify's customer data request and deletion processes. Merchants and store staff can contact us at orkestr.recovery@gmail.com. You also have the right to complain to a data protection authority, in Italy the Garante per la protezione dei dati personali.

12. Changes

We may update this policy. We will change the effective date above and, for material changes, inform merchants who have installed the app.

13. Contact

Ludovic Lolli, operator of Orkestr Recovery: orkestr.recovery@gmail.com