Privacy Policy

Last updated: October 20, 2026

This Privacy Policy describes how DepositDrop ("the app", "we") collects, uses, stores, and protects information when merchants install and use the app on Shopify. It applies to both the merchant using the app and the buyers who interact with it at checkout.

Information we collect through Shopify's APIs

• Your store's domain (e.g. your-store.myshopify.com), used to identify your shop.
• An access token issued through Shopify's standard app authentication (OAuth), used only to make authorized requests to your store's admin on your behalf. This token is never shared with third parties.
• Your subscription/billing status, provided by Shopify's Billing API, used to determine which plan and upload limit currently apply to your store.
• Whether your store is on Shopify Plus (or is a development store), used only to show you the right notice about receipt upload, which requires Shopify Plus. We do not store this in our database.
• The countries your store ships to (from your shipping zones), used only to fill in the country list when you create a payment rule. We do not store this list; we only keep the countries you select in a rule.

Information we collect directly from merchants

• Payment customization rules you create, including: payment method names or partial names to target, the action to apply (hide, rename, or reorder), display rename text and reorder positions, and any conditions you configure (such as countries, discount codes, discount amounts, or cart total ranges). These rules are stored in your store's database and synced to Shopify via the Payment Customization API to take effect at checkout. Rule data is never shared with third parties.

Information we collect from buyers at checkout

• The receipt image a buyer uploads when paying by bank deposit, along with its file name, file type, and size.
• The checkout session's identifier and, once the order completes, the resulting order ID and order confirmation number - used to link the receipt to the correct order automatically.
• Technical identifiers of the payment methods available in your checkout (for example which one is Bank Deposit). These are internal values that Shopify assigns to payment methods, not buyer information, and DepositDrop uses them only to recognize the Bank Deposit payment method so the receipt upload step appears for it.

DepositDrop does not store buyer names, email addresses, phone numbers, or shipping/billing addresses as data fields. However, a receipt image that a buyer uploads (for example a photo or screenshot of a bank transfer slip) may itself show personal details such as the buyer's name or bank account number. We store the image exactly as uploaded and do not read or extract anything from it. Shopify's customer data request and customer redaction requests can include a customer's ID, email, or phone number, but DepositDrop only reads the list of order IDs from them, to find the receipts linked to those orders, and never stores the rest.

How we use this information

• To display the receipt upload step only for your store's Bank Deposit payment method.
• To automatically link an uploaded receipt to the order it belongs to.
• To show you your receipts, plan usage, and setup status in the app's admin dashboard.
• To enforce the monthly receipt upload limit of your current plan.
• To let the "Open checkout" button build a cart link with a product from your store (using read access to your products), so you can open a checkout and confirm your payment methods without adding a product by hand.
• To apply your payment customization rules at checkout using Shopify's Payment Customization API, such as hiding, renaming, or reordering payment methods based on conditions you define (countries, discounts, cart totals).

How long we keep this information

• Receipts and their linked order details are kept for as long as the app remains installed on your store.
• A receipt that never gets linked to a completed order (an abandoned checkout) is automatically deleted after 24 hours.
• If you uninstall the app, all of your store's data - receipts, plan/subscription records, and settings - is automatically deleted, typically within 48 hours, in line with Shopify's mandatory data-erasure webhook.

Data security

We take reasonable administrative and technical measures to protect the information stored by DepositDrop from unauthorized access, alteration, disclosure, or destruction.

Where this information is stored

App data is securely stored on cloud infrastructure hosted by Railway. Access to that data is restricted to authorized application processes and authenticated requests from your store's checkout and admin.

Cookies

DepositDrop does not use cookies to track buyers at checkout.

Third parties

We share information only with Shopify, as required to operate as a Shopify app (for authentication and billing), and with our hosting provider, Railway, which stores the app's data on our behalf. We do not sell or share data with any other third party.

Your rights

Shopify requires every app to support data requests, data erasure, and shop-data erasure on behalf of merchants and their customers. DepositDrop implements all three. When a customer erasure request is received, we delete the receipts linked to the orders listed in that request. When a customer data request is received, the receipts linked to the listed orders are available to the merchant in the Receipts page of the app. A full erasure of your shop's own data runs automatically once Shopify's shop-redaction webhook is received after you uninstall the app.

Where applicable, DepositDrop processes personal information in accordance with applicable privacy laws, including GDPR and similar regulations.

Changes to this policy

If this policy changes, the "Last updated" date above will change accordingly.

Contact

If you have any questions about this policy, please contact us at support@depositdrop.online.