Privacy Policy

Last updated: October 4, 2026

PickKit is a Shopify app that turns a store's open orders into warehouse pick lists sorted by bin location. This policy explains what data the app processes, why, and how it is protected.

No shopper contact details. PickKit never requests, receives or stores a customer's name, email address, phone number or address.

What we process

• Merchant / store data: the store's myshopify.com domain, an expiring Shopify access token, the subscription plan tier, and the tag the merchant uses for picked orders.
• Store owner's email: the email address on the store owner's Shopify account (as set in Shopify, not the store's public contact email), its admin language, and whether it is a development store — used only to email the store owner: account alerts, a one-time welcome note on upgrading to a paid plan, and a one-time note after uninstalling asking what we could improve.
• Order data, read when a pick list is built: order numbers, dates, tags, payment and fulfillment status, shipping method titles, and line items (title, variant, SKU, quantities, image, and the line item's custom details such as engraving text or a gift note, which the shopper or another app entered at checkout).
• Product data: variant photos, options, SKUs and barcodes, and the bin location and location note PickKit keeps on each variant. Bin locations are stored in the merchant's store itself, not in our database.
• Pick lists: each pick list as it was built (order numbers, items, quantities, bin locations, image links and the line items' custom details), kept for 30 days so it can be reprinted, then deleted.

Why we process it

Solely to provide the app's functionality to the merchant: building, printing and tagging pick lists. The store owner's email is used only for the emails described above. We do not use it for advertising, profiling, or sale.

Sharing

• Shopify — the platform APIs the app is built on, and the image CDN product photos are served from.
• DigitalOcean — hosts the server and database.
• Mailgun — our email provider; delivers our emails to the store owner (sent from support@nerdlabs.us), using the store owner's email above.

We do not sell data or share it for any other purpose.

Retention and deletion

Pick lists are deleted 30 days after they were built. When the app is uninstalled, sessions are removed; roughly 48 hours later Shopify sends a shop/redact request and we delete all data stored for that shop, including the store owner's email. Because a pick list can include a line item's custom details, a customers/redact request deletes every stored pick list that includes one of that customer's orders, and a customers/data_request is answered by sending the merchant the pick-list data we hold for those orders. Bin locations remain on the merchant's own variants after uninstalling.

Security

Data is stored on a DigitalOcean server, on an encrypted storage volume, with SSH-key-only administrative access. Backups are kept on the same encrypted volume for 7 days. All traffic uses HTTPS. App secrets are held only in the server environment.

Changes

We may update this policy; material changes will be reflected here with a new "last updated" date.

Contact

Questions about this policy or your data: support@nerdlabs.us.