This Privacy Policy explains how Hexa Origin LLC (“Orca,” “we,” “us”) collects, uses, and protects information when a merchant installs and uses the Orca application (the “App”) on their Shopify store. We provide the App to help merchants turn vendor purchase-order and packing-slip documents into Shopify products, variants, and inventory. By installing the App, the merchant agrees to this Policy.

1. Information we collect

Store data (via the Shopify Admin API, with the merchant’s authorization). When you install the App you grant it the scopes it requests (currently read/write products, write inventory, and read locations). Using these, the App accesses your store domain and identifiers, product and variant records, inventory levels, and locations, so it can create and update products and sync stock.

Documents you upload. Purchase orders, packing slips, and similar vendor documents you upload (PDFs or images), and the structured data extracted from them (product names, SKUs, barcodes, costs, prices, sizes/variants, quantities, ship-to details).

Account & technical data. Authentication session tokens issued by Shopify, plan/billing status, and operational logs and usage metrics (e.g. timestamps, request outcomes, and aggregate model-usage counts) used to run, secure, and improve the service.

The App is a back-office tool and is not designed to collect your customers’ personal data. If a document you upload happens to contain a person’s name or contact details (e.g. a buyer or receiving contact), that information is processed only to provide the service.

2. How we use information

To extract data from your documents, create and update your Shopify products and inventory, support the receiving workflow, remember your per-vendor formatting preferences so future documents read more accurately, provide support, process billing, and maintain the security and reliability of the App. We do not sell your data, and we do not use it for advertising.

3. Service providers (subprocessors)

We share data with a small set of providers strictly to operate the App:

Each provider is bound by its own terms and data-protection obligations. We may also disclose information if required by law.

4. Data retention & deletion

We retain your data for as long as the App is installed and as needed to provide the service. When you uninstall the App, or when Shopify sends us a shop-redaction request, we delete the store’s data — including uploaded documents and their extracted contents — in line with Shopify’s data-erasure requirements. The App implements Shopify’s mandatory compliance webhooks (customers/redact, customers/data_request, and shop/redact).

5. Security

Data is encrypted in transit (HTTPS/TLS), access to production systems is restricted, and we rely on reputable, security-conscious infrastructure providers. No method of transmission or storage is perfectly secure, but we work to protect your information using commercially reasonable safeguards.

6. International transfers

Our providers process data primarily in the United States. If you access the App from outside the United States, your information may be transferred to and processed there.

7. Your rights

Depending on your location (e.g. under GDPR or CCPA/CPRA), you may have rights to access, correct, export, or delete your data, or to object to or restrict certain processing. You can exercise these rights by uninstalling the App (which triggers deletion) or by contacting us at the address below. We respond to verified requests as required by applicable law.

8. Children

The App is a business tool and is not directed to children, and we do not knowingly collect personal information from children.

9. Changes to this Policy

We may update this Policy from time to time. We will revise the “Effective” date above and, for material changes, provide notice through the App or by other reasonable means.

10. Contact us

Questions or requests about this Policy or your data: privacy@orca1.app (Hexa Origin LLC).