ORI PRIVACY POLICY Last Updated: October 15, 2026 Ori (listed on the Shopify App Store as "Ori Order Printer: PDF Invoice") is provided by B2B Gold, Ho Chi Minh City, Vietnam ("we," "us," or "our"). Ori issues business documents for Shopify stores - invoices, receipts, delivery slips, quotes and purchase orders - as PDFs, and keeps them in an archive. This Privacy Policy explains what the app processes, why, how long it is kept, and who it is shared with. By installing or using the app, you agree to this policy. 1. THE TWO ROLES - Order and customer data belongs to you, the merchant. We process it on your instructions, as your processor (service provider). You remain the controller and are responsible for telling your own customers about it. - Merchant account and contact data - your store details, your settings, and the store owner's email address - we process as the controller, to run the app and support you. 2. WHAT THE APP PROCESSES 2.1 Merchant data - Your Shopify store domain, plan, installed status, and the store details Shopify shares with the app (store name, contact email, the store owner's name and email, billing address, currency, tax display). - When the app is installed, the IP address and country of the browser that installed it, sent once to our team's internal notice (section 5). - The business details you enter so they can print on your documents: company name, address, phone, email, representative, website, invoice registration number or tax identifier, legal details and social account handles. The app does not collect bank account, card or other payment details. - Images you upload: company seal, logo and page background. - Your designs, document numbering, automation rules and email templates. - Support requests you send from the app, and the files you attach to them. 2.2 Order and customer data When you issue a document - by hand, in bulk, or through an automation rule you set up - the app reads that order from Shopify and prints what the document needs: order number and dates, line items, prices, taxes, discounts, shipping, payment and fulfillment status, and the customer's name, company, billing and shipping address, email address, phone number and, where present, tax number and customer number. The issued PDF and a record of it (number, date, addressee, amounts, tax breakdown) are stored in your archive. If you send a document by email, the app sends it to the customer's email address on the order, from our sending address, with the reply-to address you set in the app. If you turn on customer self-issue, a customer on the order status or thank-you page can issue a receipt or invoice for their own order. The app receives the order from Shopify's signed session, and the addressee name and description the customer types - nothing else about them. The app does not track storefront visitors, does not set cookies on your storefront, and runs no analytics or session recording in its admin pages. 2.3 AI Template Import (optional) If you upload a sample document so the app can build a design from it - or attach one to a template-import support request, which the app reads the same way - the file is sent to our AI analysis provider (section 5). To check the design it builds, the app also renders trial PDFs of that design and sends them to the same provider. Besides what the sample shows, these trial PDFs carry the business details from your settings that the design prints - for example your company seal, logo, invoice registration number or tax identifier, representative and website. The uploaded file is stored privately. It is deleted when you save, discard or cancel the import, or when the app declines or cannot read the file. The file of an import you never finish is deleted by an automatic expiry rule for files older than one day, which our storage provider usually carries out within a further day. A sample may show other people's details (for example a customer's name on an old invoice). The content the app reads from it - its number, dates, parties and line items - is shown only on the review screen. It is deleted when you save or discard the import, or otherwise by a daily clean-up once 24 hours have passed since the upload. The import's record keeps the design, the file's name, the seller details the app read and the results of its invoice check, whose notes can briefly quote the sample. The saved design keeps the sample's layout and fixed wording, not the content read from it. The provider does not use what the app sends it - the sample or the trial PDFs - to train its models. 3. WHY WE PROCESS IT - To issue, number, store, print, email and let customers download the documents you ask for, and to show them in your admin. - To keep the archive your tax law asks of you (section 4). - To run automation rules you create, and to log what they did. - To answer your support requests. - To diagnose problems and keep the service working (server logs). We do not sell your data, use it for advertising, or build profiles of your customers. 4. RETENTION - Issued documents and their records: kept for the retention period you choose in Settings (7 or 10 years), because tax law in Japan - the Consumption Tax Act and the Electronic Books Preservation Act - and in many other countries requires the issuer to keep them unaltered. Every version of a reissued document is kept. They stay retrievable after you uninstall: when you uninstall, the app prepares an export of your archive, which we send you on request. Documents are deleted after the retention period ends, or earlier at your written request (section 8) - an early deletion means we can no longer provide them to you. - Settings, designs and images: kept while the app is installed and, after an uninstall, alongside your archive so that a reinstall restores them; deleted with the archive, or earlier at your request. - AI Template Import uploads: deleted when you save, discard or cancel the import, or when the app declines or cannot read the file; otherwise by an expiry rule for files older than one day, usually carried out within a further day. The content read from them: deleted when you save or discard the import, otherwise by a daily clean-up after 24 hours. The import's record (section 2.3): kept with your designs. - Automation run logs: 90 days. - Support requests: files attached but never sent are deleted after one day; closed requests and their files one year after closing; all of them as soon as Shopify notifies us that your shop's data must be erased. 5. SHARING AND SUB-PROCESSORS We do not sell your data and do not share it for advertising. Besides Shopify, the platform the app runs on, we use a small number of service providers, each bound to process data only on our instructions and to keep it secure: - Infrastructure providers - hosting, storage, background processing and email delivery. - An AI analysis provider - only for AI Template Import: the files you upload for it, and the trial PDFs the app renders to check its design, which carry your business details (section 2.3). - An internal messaging provider - notices to our team when you install the app, when you send a support request, and when the app hits an error. These carry your store's details (domain, website, plan, owner's name and email, country), the IP address and country of the browser that installed the app, a support request's subject, or the app page, browser type and error - never order or customer details. The names of these providers are available on request (section 8). We also disclose information where the law requires it, or to protect the rights and safety of merchants, their customers, or us. 6. PRIVACY REQUESTS We support Shopify's mandatory privacy webhooks: - customers/data_request - every document that names a customer can be found in your archive by the customer's name and exported from there; the app keeps no other profile of your customers. - customers/redact - documents that name the customer are tax records you are required to keep, so they are retained, unaltered, until the retention period ends, and used for nothing else. Your reply to the customer should say so. - shop/redact - support requests and their files are deleted; the archive is kept for its retention period on your behalf unless you ask us to delete it. You can also contact us at the address in section 8 to access, correct, export or delete data, or to object to processing. 7. SECURITY, TRANSFERS AND OTHER INFORMATION - Security: data is encrypted in transit with TLS and encrypted at rest by our infrastructure provider. Each archived PDF is stored with its SHA-256 hash so its integrity can be verified. Staff access is limited to authorized personnel, authenticated with hardware-backed passkeys, and every sign-in to a store's data is recorded. - International transfers: data may be processed in Japan, the United States, the European Union, Vietnam and other countries where our processors operate, under standard contractual clauses and equivalent safeguards. - Merchant responsibilities: you are responsible for describing this processing in your own store's privacy policy, and for the legal content of the documents you issue. - Children's privacy: the app is not intended for children under 13. - Policy updates: material changes will be announced in the app. 8. CONTACT US - Email: privacy@afixer.app - Support: b2bgold.dev@gmail.com - Listing: https://apps.shopify.com/ori-order-printer-pdf-invoice END OF PRIVACY POLICY