Privacy Policy

Last updated: October 4, 2026

LateKit is a Shopify app that watches a store's orders and alerts the merchant's staff when an order is late to ship, stuck in transit, past its delivery date or hit by a carrier exception. This policy explains what data the app processes, why, and how it is protected.

No shopper personal data. LateKit reads order and shipping data only: it never requests, receives or stores a customer's name, email address, phone number or address.

What we process

• Merchant / store data: the store's myshopify.com domain, name and time zone, an expiring Shopify access token, and the subscription plan tier.
• Store owner's email: the email address on the store owner's Shopify account (as set in Shopify, not the store's public contact email), its admin language, and whether it is a development store — used only to email the store owner: account alerts, a one-time welcome note on upgrading to a paid plan, and a one-time note after uninstalling asking what we could improve.
• App settings: the configuration the merchant enters in the app, including the staff email addresses alerts go to (by default the store's own contact email) and, optionally, a Slack webhook URL.
• Order and shipping data: for each order, its number, when it was placed, its fulfillment and payment status, fulfill-by date, shipping method and delivery method type, and each shipment's status, dates, estimated delivery, carrier, tracking number and tracking link. Order data is deleted 100 days after the order was placed.
• Alert log: which alerts were sent, when, by which channel and for how many orders, kept for 30 days.

Why we process it

Solely to provide the app's functionality to the merchant. The store owner's email is used only for the emails described above. We do not use it for advertising, profiling, or sale.

Sharing

• Shopify — the platform APIs the app is built on.
• DigitalOcean — hosts the server and database.
• Mailgun — our email provider; delivers alert emails to the merchant's staff and our emails to the store owner (using the store owner's email above), sent from support@nerdlabs.us.
• Slack — only if the merchant connects a Slack webhook.

We do not sell data or share it for any other purpose.

Retention and deletion

Order data is deleted 100 days after the order was placed and the alert log after 30 days. When the app is uninstalled, sessions are removed and alerts stop. Roughly 48 hours later Shopify sends a shop/redact request and we delete all data stored for that shop, including the store owner's email. If that request never arrives, we delete it anyway 30 days after the uninstall. Because we hold no customer personal data, the customers/redact and customers/data_request webhooks have nothing to act on and are acknowledged.

Security

Data is stored on a DigitalOcean server, on an encrypted storage volume, with SSH-key-only administrative access. Backups are kept on the same encrypted volume for 7 days. All traffic uses HTTPS. App secrets are held only in the server environment.

Changes

We may update this policy; material changes will be reflected here with a new "last updated" date.

Contact

Questions about this policy or your data: support@nerdlabs.us.