Jump to section
OrderJay runs a merchant’s wholesale order desk. It reads the email conversations in the mailbox the merchant connects, matches each retailer request to the merchant’s own system of record — Shopify B2B, Zoho Inventory + Books or Unleashed — and prepares or performs the order-desk work (quotes, availability answers, purchase orders, order-status answers) under a policy the merchant has ratified. To do that it stores the business contact details of the merchant’s retail buyers and the text of their emails. This page says exactly which data, why, for how long, and who else can see it.
1. Who we are
OrderJay (the “app”) is built and operated by Orumio (“we”, “us”).
| Operator | Orumio |
| Representative | Masanori Iwata |
| Address | Mitsuhashi Building 3F, 1-3-3 Kita-Aoyama, Minato-ku, Tokyo 107-0061, Japan |
| Contact | support@orderjay.com |
| Telephone | Disclosed without delay in writing or by email upon request to the contact address above. |
When you connect your system of record and your mailbox you are the controller of the personal data in them; we act as your processor and process it only to provide the app to you, on your instructions. The terms of that relationship are set out in our Data Processing Agreement, which forms part of your agreement with us (for a workspace whose system of record is not a Shopify store, that agreement is our Terms of Service).
2. What personal data the app processes
2.1 Stored by the app
Scroll sideways to see all columns →
| Data | Personal data? | Why it exists | Source |
|---|---|---|---|
| Company (retailer) names, external ids | No — business identifiers | To know which retailer wrote | Shopify B2B, the Zoho Books contact, or the Unleashed customer |
| Company location names, shipping and billing addresses, payment terms, currency | Address fields can identify a person at a small business | To lock a purchase order to the retailer’s recorded ship-to and terms — the app never ships anywhere else | Shopify B2B, the Zoho Books contact’s addresses, or the Unleashed customer’s delivery addresses, payment term and currency |
| Company contacts: name, business email, business phone, job title, role per location | Yes | To verify that the sender of an email is a buyer who may order for that retailer and location | Shopify B2B, the Zoho Books contact persons, or the Unleashed customer’s email and contacts |
| Product variants or items (SKU, title, status) | No | To match ordered lines to the merchant’s products | Shopify, Zoho Inventory, or Unleashed |
| Orders and draft orders (PO number, lines, prices, status, fulfilment and tracking) | Order lines can be linked to a buyer | To answer status questions and to record what the app prepared. On Zoho and Unleashed these are read for each question and never copied into our database | Shopify |
| Email messages in the connected mailbox: sender, recipients, headers, subject, text, attachments | Yes | To interpret order-desk requests and to write the reply in the same thread | The merchant’s Gmail or forwarding address |
| Attachment files: the documents attached to those messages, kept as the files they arrived as | Whatever the document carries — a purchase order names its buyer | To read order lines. A document with readable text is read by the app and only that text goes further; an image or a scanned PDF has no text to read, so the file itself is sent to our interpretation provider to be transcribed (§4) | The merchant’s Gmail or forwarding address |
| The name of your store or organisation, or else of your workspace | No — a business identifier | Shown as the sender’s name on replies that leave from our mail domain (§4), so your retailer sees who is answering | Shopify, or Zoho; otherwise the name you gave the workspace |
| The connected mailbox’s sending setup: its address and whether you confirmed it, the domain you asked to send from with the DNS token that proves it is yours, and whether a reply bounced or was reported | The mailbox address can be a person’s | To decide which address a reply leaves from, to send your retailers’ answers back to your own mailbox once you have confirmed it, and to tell you when replies are not arriving | The merchant, in Connections; our mail provider’s delivery reports |
| Receipts, exceptions, audit and job events | Reference a contact or message by id | The merchant-visible record of what was done and why | The app |
| The merchant’s staff accounts (name, email) | Yes — the merchant’s own staff | To run the workspace and record who did what | Sign-up |
| Shopify subscription facts and the charges Shopify reports for it | Business identifiers and billing facts | To administer the merchant’s subscription and maintain its billing record, and to know which merchants have become paying ones | Shopify |
| Where the workspace’s sign-up started: one tag from a fixed list — the Shopify App Store, or the page of this website a sign-up link was on, when the link names it | No | To see which pages and channels bring merchants who go on to use the app (§8) | The sign-up link, recorded once when the workspace is created. No cookie |
| The Zoho contact and item records as read, kept verbatim | Yes — the contact record contains its people, their emails and its addresses | So a field can be re-derived without a second call against the organisation’s daily API budget. It is the same data as the three rows above, in the shape Zoho returned it | Zoho Books and Zoho Inventory |
| The Unleashed customer and product records as read: each customer’s code, name, email, currency, payment term and whether it is on credit stop or obsolete, its contacts’ names and email addresses, and its delivery addresses; each product’s code, description, unit, minimum sale quantity and whether it can be sold | Yes — a customer’s contacts are people, with their email addresses | So the app can recognise who is writing and match ordered lines without calling Unleashed for every message, within the organisation’s API allowance | Unleashed |
| System-of-record and mailbox access tokens, and the Unleashed API ID and key | No — credentials | To read records and send replies while nobody is signed in. Encrypted (§5) | OAuth; for Unleashed, the organisation’s account owner’s API ID and key, pasted when connecting |
| Partner referral: the random visitor id from the referral cookie, the partner’s code, and a pseudonymous workspace reference | The visitor id is an online identifier; we never link it to a name | To credit the partner whose link brought the merchant — once, on the first paid subscription. Only for a visitor who pressed Allow on this website (§8) | The referral cookies this website set with the visitor’s consent, read once when the workspace is created |
2.2 Read live, not stored
Prices are calculated by the merchant’s own system of record for the retailer’s purchasing entity at the moment of each quote or order and copied into the receipt; inventory is read live and never mirrored as an authority. On Shopify that calculation is a read. On Zoho there is no such read, so the app creates a draft Estimate or Sales Order in the merchant’s organisation to obtain the authoritative total, and deletes it again on every path that does not go on to place the order — proving it gone by reading for it. The merchant is told this before they connect, and accepts it: the visible consequence is a consumed document number and an entry in the organisation’s activity log. Nothing is emailed by Zoho at any point.
On Unleashed the app states no price at all: Unleashed keeps the prices it is given and has no calculation for a retailer the app could read, so a quote or an order is shown with its lines and stock, and the price is left to the merchant in Unleashed. Stock is read live. Nothing is written to Unleashed.
3. Why we process it
One purpose: to run the merchant’s order desk — the customer-service and store-management purposes we declared to Shopify when we requested access to protected customer data, and the same purposes on Zoho and Unleashed. The app makes no decision with a legal or similarly significant effect on any person: it prepares orders and answers a merchant has authorised per class, starts every class in “Watch” (nothing is sent; on Shopify and Unleashed nothing is written; on Zoho a draft is created to read the total and deleted again — and on Unleashed only stock and order-status answers can be put in Run; quotes and orders stay in Watch), holds each action for a cancel window before it runs, and turns anything it cannot verify into an exception for a human. A retailer can always reach a person: replying to any message puts it in front of the merchant’s staff.
We do not, and the app has no mechanism to:
- use personal data for marketing, advertising or profiling;
- sell or share personal data with anyone, or transfer it to a data broker;
- use personal data to train machine-learning models (our interpretation provider’s terms state that API inputs and outputs are not used to train models);
- build analytics or audience products out of your data.
4. Who else processes it (sub-processors)
Below, by what they do. The providers we engage are named, with their locations, in the Data Processing Agreement, Annex III; before we add or replace one we tell merchants by email 30 days in advance (its §6).
Scroll sideways to see all columns →
| Service | Role | Personal data it can see |
|---|---|---|
| Shopify | The platform your store runs on, when Shopify B2B is your system of record | All store data — Shopify is the source of truth and its own privacy terms govern it |
| Zoho (the data centre your organisation is in) | The platform your records run on, when Zoho Inventory + Books is your system of record | Your organisation’s own data — Zoho is the source of truth and its own privacy terms govern it. Your organisation stays in the data centre it is already in; we call only the regional host that answered your authorisation |
| Unleashed | The platform your records run on, when Unleashed is your system of record | Your organisation’s own data — Unleashed is the source of truth and its own privacy terms govern it. The app only reads from it, with the API ID and key your account owner gives it, and writes nothing |
| Our hosting provider (United States, primarily) | Runs the app: application hosting, the database, attachment files, and runtime logs | Everything in §2.1, at rest and in transit while a request is served; attachment files; runtime logs |
| Our interpretation provider (United States) | Interpretation of message text into structured claims; transcription of an attached image or scanned PDF into text | The new text of a message, its quoted parts, subject, attachment text and filenames — and the attached document itself when it is an image or a scanned PDF, sent one file at a time to be transcribed, and only once the sender has been recognised as a contact of one of your retailers; a stranger’s file is never sent. No customer-facing text is generated; its terms state that inputs are not used for training |
| Your mailbox provider, when you connect a Gmail mailbox | Reading the mailbox you connect and writing replies in it | The mailbox you connect, under your own account’s terms |
| Our email delivery provider (United States; mail on our own mail domain is handled in Japan) | Forwarding intake; delivering the replies to your retailers; notification and confirmation email | Messages forwarded to your intake address. The replies sent to your retailers — recipient, subject and text — and whether each was delivered: from your own domain once you have verified it and shown it is yours, and until then from our mail domain (the intake address of your mailbox, with the name of your store or organisation — or else of your workspace — as the sender’s name), only to a sender whose address authenticated in that conversation. The notification and confirmation emails we send you |
| Our background job service (United States) | Running background jobs | Record ids only — never message content |
| Our sign-in provider (United States) | Sign-in for the merchant’s staff | Your staff’s names and email addresses — and, for a visitor who arrived through a partner link and pressed Allow, the two referral cookies (§8), because the sign-in host is a subdomain of this site |
| Our partner-referral service (Slovakia) | Crediting the partner whose link brought a merchant here | Only for a visitor who arrived through a partner link and pressed Allow (§8): a random visitor id, the partner’s code, the address and referrer of the page they landed on, and the IP address and browser identification it records with that click; once that visitor’s workspace connects a store, a pseudonymous merchant reference; and, if the merchant is later charged, the amount of the first subscription charge. Never a name, a person’s email address, or any store, retailer or message data |
Our database and file store are placed in the United States (a location hint to our hosting provider, not a guarantee), and the application runs on its global network, so a request may be served from a location near you. If you are in the European Economic Area or the United Kingdom this means your data is transferred outside that region; the safeguards are in the Data Processing Agreement (§12).
5. How it is protected
- Encryption in transit. The app is served only over HTTPS; every connection to your system of record, the database and the mailbox providers uses TLS.
- Encryption at rest. The database and its backups are encrypted by the provider (AES-256). System-of-record and mailbox tokens, and the Unleashed API ID and key, are additionally encrypted with AES-256-GCM under a key held only in the hosting secret store and bound to their own row, so a token copied elsewhere cannot be opened.
- Structure, not confidence. The part of the app that reads untrusted email text can neither act nor write; the parts that act see only typed, verified facts. Every reply goes to the authenticated sender, never to a “reply-to” address; every order ships only to the retailer’s recorded address.
- Separate environments. Production runs on its own database project; development and tests never touch it.
- Access. Production access is limited to the operator with multi-factor authentication; every critical change is written to an audit log the merchant can see.
- Incidents. A written incident response policy: contain within one hour, assess within a day, notify affected merchants within 72 hours of confirming a personal data breach.
6. How long we keep it
| Data | Retention |
|---|---|
| Shopify-sourced records (companies, locations, contacts, variants, orders) | While the app is installed. Refreshed from Shopify continuously; a contact removed in Shopify is revoked at once. Deleted within 30 days of uninstall or of a redaction request from Shopify |
| Zoho-sourced records (contacts, their people and addresses, items) | While the organisation is connected. Refreshed hourly; a contact removed in Zoho is marked deleted and its identity revoked at once. Zoho sends no uninstall or redaction signal, so there is no automatic deletion: disconnecting revokes our access and erases the tokens, and we erase the records within 10 business days of the merchant asking |
| Unleashed-sourced records (customers, their contacts and delivery addresses, products) | While the organisation is connected. Refreshed hourly and read in full once a day; a customer or product removed in Unleashed is marked deleted, and its people are no longer recognised, at the next full read. Disconnecting erases the API ID and key and these records at once. Unleashed sends no uninstall or redaction signal, so the retailers, contacts and addresses the app derived from them are erased within 10 business days of the merchant asking |
| Email message text and extracted attachment text | 180 days after the message arrived. The message header (who wrote, when, subject) and the receipt built on it stay, so the merchant keeps the record of what was done |
| Attachment files (the documents themselves) | 180 days after the message arrived, erased by the same hourly sweep as the text. Erased at once on a redaction request from Shopify — the contact’s files on customers/redact, every file of the store on shop/redact — and by the 30-day uninstall backstop |
| The mailbox’s sending setup (§2.1) | While the mailbox is connected. A confirmation code expires after 30 minutes and is kept only as a hash. The domain-ownership token and former intake addresses are erased with the store’s data on shop/redact and by the 30-day uninstall backstop |
| Receipts and exceptions | While the app is installed or the system of record is connected; on a Zoho or Unleashed workspace, after a disconnect until the merchant asks us to erase them (§7) — they are the merchant’s record of work done |
| Audit events | 90 days |
| Job event logs | 180 days |
| Shopify subscription facts and the charges Shopify reports | While the merchant uses the app |
| Where the workspace’s sign-up started | As long as the workspace |
| Partner referral: the two cookies on the visitor’s device; the attribution record | The cookies expire 60 days after they were set (a later landing through a different partner’s link sets them again). The record (visitor id, partner code, pseudonymous reference, what was reported and when) lives as long as the workspace — it survives a store redaction, because the workspace does — and is erased with the workspace or on request (§7). What the partner-referral service holds is erased on request through it |
| Database history / backups | Provider-managed, encrypted, 1 day of point-in-time history |
We honour Shopify’s mandatory compliance webhooks: customers/data_request (we provide the merchant with what we hold about the contact), customers/redact (we delete or anonymise it — including the address of any location for which that contact is the only buyer; a location another buyer still orders for keeps its address, because it is the merchant’s business address and their orders need it) and shop/redact (we delete the merchant’s tenant). A redaction erases our copy: the merchant’s store keeps its own record, and if it still holds the data, a later read of that record brings back what it holds. Zoho and Unleashed have no equivalent — neither sends anything when a merchant stops using it — so for a Zoho or Unleashed workspace the same three outcomes are reached by asking us, and we answer within 10 business days (§7). We say so here rather than describe an automatic deletion that does not exist.
7. Your rights
Merchants can export, correct or delete their data by writing to us; uninstalling the Shopify app deletes Shopify-sourced data as above, disconnecting a Zoho organisation revokes our access to it, and disconnecting an Unleashed organisation erases the API ID and key and the app’s copy of the records read from it; the retailers, contacts and addresses derived from them are erased on request (§6). Retail buyers’ data is held on behalf of the merchant they deal with: requests for access, correction, deletion or objection can be made to that merchant or to us, and we answer within 10 business days. Residents of the EEA and the United Kingdom have the rights under the GDPR; residents of Japan those under the APPI; residents of US states with privacy laws those set out in the Data Processing Agreement, Annex IV.
8. This website
This site (orderjay.com) has no advertising tag or audience tracker and loads no third-party script. It counts visits without cookies, and the one thing it stores on a device is for partner referrals, and only with your consent:
- Counting visits. When you arrive from another site (or from none), and when you press a link to sign up or to the Shopify App Store, your browser sends this site one count: the page, which of the two it was, and where the visit came from, reduced to one short word — a campaign name carried in the link, “partner” for a partner link (never the partner’s code), the name of a chat assistant or a search engine whose page linked here, “other”, or “none” (a press after moving between this site’s pages is counted under “site”). The site adds one to that day’s total and keeps nothing else: no cookie, nothing in your browser’s storage, no identifier, and neither your IP address nor your browser identification is stored. Your IP address is used only to limit how many counts one address can send in a minute: our hosting provider’s limiter holds it for that minute, and the site never stores it. A move between this site’s pages is not counted again. The totals contain no personal data.
- If you sign up through a link on this site that names the page it is on, the workspace you create records that page — or “App Store” for an install that came from the Shopify App Store — as one tag from a fixed list (§2.1). No cookie is involved.
- If you arrive through a partner’s link (a
?ref=code in the address), a bar asks whether to allow cookies so that partner is credited if you subscribe. Until you press Allow, nothing is stored and nothing is sent. No thanks stores nothing either — not even the refusal. If you allowed this before and both cookies are still on your device, a later link from a different partner is handled under that consent without asking again: the same visitor id, the new partner’s code, and your browser sends another click event for it. - If you press Allow, this site sets two first-party cookies for up to 60 days — a random visitor id and the partner’s code — and your browser sends one click event to our partner-referral service (§4) with that id, the code, the address and referrer of the page you landed on. The service records the IP address and browser identification of that request.
- If that browser then creates a workspace, the two values are read once and kept with the workspace (§2.1). When the store connects, the service is told that the visitor became a merchant, under a pseudonymous reference (
<workspace id>@merchant.orderjay.com, or<workspace id>@merchant.trade-counter.orumio.comfor a referral recorded before 28 October 2026) rather than any person’s email address; a workspace that never connects a store is never mentioned to it. If the merchant is later charged for a subscription, the amount of that first charge is sent to it once, for the partner’s commission. Renewals, upgrades and later charges are never reported. - Every other visitor — no partner link, or No thanks — gets no cookie; the visit is counted as described above, and nothing about it is sent to anyone else.
For the referral cookies and what is sent to the partner-referral service, Orumio acts for its own purpose (crediting its partners) and is the controller; the legal basis is your consent. You withdraw it by deleting the two cookies from your browser, after which nothing further is sent, and the record described in §6 is erased on request (§7).
The only third-party code that runs in the signed-in browser is our sign-in provider’s (§4), which signs staff in. The app host is app.orderjay.com. Once you have signed in, our sign-in provider keeps a cookie that holds only a timestamp of the sign-in state on the domain this site and the app share, so your browser also sends it to this site; the site does not read or store it.
9. If we wrote to you first
We write to some US brands that sell wholesale to retailers, at the business address their own website publishes for orders or enquiries (such as wholesale@ or orders@), to ask whether OrderJay would be useful to them. For that we keep the business’s name and website, the address as it is published, the page and sentence that say how wholesale orders reach it, its US state and city, what it sells, which mail service its domain uses, our notes, and the emails between us. We do not buy lists, we write only to an address a business publishes for being contacted, and we keep no one’s name unless they write to us with it.
For this, Orumio acts for its own purpose and is the controller; the legal basis is our legitimate interest in asking the businesses OrderJay is made for whether it is useful to them. We use it only to write to that address about OrderJay and to keep track of what you answer. Answer “no” to any of our emails and we stop the same day.
Scroll sideways to see all columns →
| Who | Role | What it can see |
|---|---|---|
| Our email service (United States) | Our mailbox: sends our emails and receives your answers | The address we write to, the emails we send it and what you write back |
| Our hosting provider (its Asia-Pacific region) | Runs the program that sends these emails from our mailbox | The address we write to and the emails we send it, until they are deleted (below); for the emails that were sent, which ones were answered or bounced — never the text of an answer |
| AI assistants (United States) | Help us find businesses whose own website says they take wholesale orders by email, check their published address, draft our emails, and keep the private page on which we review them | What a business’s own website shows: its name, website, published address, state and city, what it sells, and the sentence about its wholesale ordering; the replies we ask them to help us answer; our notes on the conversations — never a person’s name |
Kept for 90 days after our last email if you did not answer, then deleted; if you answer “no”, deleted the same day except the address itself, which stays on a list of addresses we never write to again. If we are talking, it is kept while we are, then as above. You may ask us to delete it at any time (§7).
10. Changes and contact
We announce material changes to merchants by email 30 days before they take effect. Questions and requests: support@orderjay.com.
Shopify, Zoho and Unleashed are trademarks of their owners. Naming them describes the systems the App works with; it does not imply their endorsement.