Privacy policy

Daybook turns purchase orders your buyers email you into Shopify draft orders. Those emails contain other people's business details, so this page states exactly what we touch and — more importantly — what we deliberately do not keep.

What we read from your store

After you install the app we hold access tokens for your shop, encrypted at rest with AES-GCM. We use them to:

• look up product variants by SKU, barcode or name, so order lines can be matched to your catalogue;
• look up a customer by the exact sender address of the order email, so the draft can be attached to the right account;
• create a draft order when you press the button. Its note carries the email subject line and the attachment file name so you can trace it back to the message.

We never complete an order, charge a card, or change inventory. The app has no code path that does any of those things.

What happens to an order email

Mail sent to your intake address at cardiworkshop.com is read once, in memory, and then discarded. We do not store the original email or its attachments. What we keep is the order table we extracted from it:

• the sender address, subject line and attachment file name;
• for each order line: the SKU, barcode, description, quantity and unit price as written in the document, plus which column each came from;
• the pass/fail verdicts (SPF, DKIM, DMARC) that our mail provider attached to the message, when it attaches them;
• any correction you make in the review screen;
• the id of the draft order created from it, if you created one.

Anything else in the document — addresses, contact names, contract terms, logos, other sheets — is never written to storage.

What we store about you

• Your shop domain and your encrypted Shopify tokens.
• The notification email address you enter, if you enter one.
• Anonymous monthly counters of how the app is used (settings saved, documents received, parsed, failed, drafts created). These contain no shop identifier and no document content.

When a purchase order arrives we also keep a short-lived fingerprint of it — a hash of the sender, subject, file name and order lines, plus the id of the earlier document — so we can tell you when the same order appears twice. It holds no readable content, it is deleted with the rest of your data when you uninstall or when a buyer asks us to erase theirs, and it expires on its own after 5 days.

Who else sees it

• Cloudflare — Email Routing receives the mail; Workers and KV run the app and store everything listed above.
• Shopify — the Admin API calls described above.
• Resend — email delivery. For the "an order arrived" notification, if you turn it on, Resend receives your notification address, the sender address, the subject line and attachment file name, how many order lines we read, and a link containing the document id. Resend also delivers our internal alert when one of your buyers files a data request; that message carries Shopify's request id and a document count, never their address. It never receives the order lines themselves.
• Google (Gmail) — our support inbox at cardi.workshop@gmail.com receives the data-request alert described above and anything you write to us.

We do not sell, rent or share your data with anyone else, we do not use it for advertising, and we do not use it to train models.

Retention and deletion

Extracted documents are deleted automatically 90 days after they arrive — measured from when the message arrived, not from when you last edited it. Your inbox holds the 200 most recent, and up to 100 more can sit in the held-back list described below; anything pushed out of either list moves to a third list the app shows you, and is deleted within 7 days of landing there. When you uninstall, Shopify sends an app/uninstalled webhook and we delete your tokens, settings and every stored document. You can also request deletion at any time at cardi.workshop@gmail.com.

One thing we keep, and we would rather say it plainly than let you find out at the checkout screen: a record that this shop has used part of its free trial. It holds your .myshopify.com domain, a number of days, a date, and the ids of the subscriptions already counted — no order data, no addresses, nothing about your buyers. It survives uninstall on purpose, because otherwise uninstalling and reinstalling would hand out a fresh free trial every time, and it deletes itself 180 days after the trial that created it. If you want it removed sooner, write to cardi.workshop@gmail.com and we will delete it.

If one of your buyers exercises their rights

The personal data we hold about a buyer is the email address they sent the order from, together with the order table extracted from that email. We implement Shopify's mandatory compliance webhooks and act on them:

• customers/redact — we delete every document that person sent, in full. We do not merely blank the address: the subject line and the cells we read from their document could carry a name or a reference, and we cannot tell cell by cell. Any draft order you already created from it stays in your Shopify admin, under your control.
• customers/data_request — we email our own support inbox so a person acts on it, write down which documents we hold for that address and when they arrived, and answer through you within the 30 days Shopify allows. Neither the email nor the record contains the requester's address or the document contents. Both do contain Shopify's request id, because we cannot answer a request without knowing which request it is — and Shopify can match that id back to the person, so this is a step we take deliberately rather than a claim that the record is anonymous. The stored record is given the lifetime of the shortest-lived document it names, so it does not outlast them, and at most 30 days when it names none. One exception we would rather state than hide: if a document it names is pushed out of your lists after the record was written, that document expires on the shorter clock while the record keeps the lifetime it was given, and can briefly outlive it. If that buyer later asks to be erased, we delete the records naming their documents. The support email is not in that sweep; it sits in our mail system until we clear it.
• shop/redact — everything listed above for your shop is deleted, with the one exception named earlier on this page: the record that this shop has already used part of its free trial. It holds no buyer data and deletes itself on its own clock.

A second limitation, in the same spirit: if we held nothing for that buyer when the access request arrived, the record of that request names no documents, so an erasure request has nothing to match it against and it stays until it expires. It says only that a request was made and when — nothing about who made it — but Shopify can still tie the request id back to them.

One honest limitation: we identify a buyer by the address their email came from, while Shopify's request identifies them by the email on their customer record. If those differ, or if the person never became a customer in your shop, the request will not reach us. Tell us at cardi.workshop@gmail.com and we will erase by the sending address directly.

Contact

Questions about this policy, or about data we hold: cardi.workshop@gmail.com.

Last updated 2026-08-21 · Home · Support · Privacy · Terms