Privacy Policy: Cratebird: Reorder & POs
Last updated: 3 November 2026
Cratebird ("the app") is a Shopify app published by Dixon App Studio LLC ("we", "us"). It suggests what to reorder from a store's sales, keeps the store's suppliers, creates purchase orders and adds received stock to Shopify inventory. This policy explains what the app collects when a merchant installs it, why, how long it is kept, and how to have it deleted.
What we collect and why
| Data | Why | Kept |
|---|---|---|
| Your store's myshopify domain, store name, currency and the Shopify access token issued at install | To read your products, stock and sales, and to update inventory when you receive a purchase order | Until you uninstall. The token is deleted at uninstall; everything else when Shopify sends shop/redact (48 hours later). |
| Suppliers you add (company name, order email address, lead time, currency, notes), your product-to-supplier mapping (supplier SKU, cost, minimum order, case pack) and your purchase orders and receipts | The app's core features: reorder suggestions, purchase orders, receiving | Until you delete them or uninstall (deleted at shop/redact) |
| Order line quantities: order ID, order date, product variant ID and quantity sold | To calculate sales velocity (units sold per day) for reorder suggestions | 100 days, then deleted automatically |
| Settings (reorder formula, alert thresholds, digest email address) and daily digest summaries | To apply your settings and show the daily digest | Settings until uninstall; digests 100 days |
No customer data. The app reads orders only for the products and quantities sold. It never requests customer names, email addresses, phone numbers, shipping or billing addresses, or any other shopper information, and it stores none. Supplier email addresses are business contacts you enter; they are used only to address purchase orders you choose to send.
We do not use cookies or tracking pixels, and the app adds nothing to your storefront.
Emails
By default the app sends no email itself: a purchase order opens in your own email app, addressed to the supplier. Each purchase order email contains a private link to that order's PDF; the link is signed, expires after 90 days and stops working if the order is cancelled. If email delivery from the app is turned on, supplier emails and your daily digest are delivered through our email provider (Resend), which processes only the message itself.
Where the data is stored
On Cloudflare (Workers and D1), which encrypts data at rest and in transit. All traffic between the app, Shopify and your browser uses HTTPS. Requests are authenticated with Shopify session tokens and webhooks with HMAC signatures; each store can only reach its own data.
Sharing
We do not sell, rent or share store data. Our processors are Shopify (the platform), Cloudflare (hosting) and, only when email delivery is on, Resend (email). Payments for paid plans are handled by Shopify's billing; we never see card details.
Your rights and deletion
Uninstalling the app deletes its access token immediately and every other record for your store when Shopify sends shop/redact.
To have data deleted sooner, or to ask what is held, email support@dixonappstudio.com; we answer within 30 days.
Shopify's mandatory privacy webhooks (customers/data_request, customers/redact, shop/redact) are handled automatically.
Data Processing Addendum
For personal data your store processes through Cratebird, you (the merchant) are the controller and Dixon App Studio is the processor. The Shopify Apps Data Processing Addendum (purposes, sub-processors, retention, security, breach notice, Standard Contractual Clauses) forms part of our Terms of Service; you accept it by installing or using Cratebird.
Contact
Dixon App Studio LLC · support@dixonappstudio.com · dixonappstudio.com