This Privacy Policy explains how Hexa Origin LLC (“Orca,” “we,” “us”) collects, uses, and protects information when a merchant installs and uses the Orca application (the “App”) on their Shopify store. We provide the App to help merchants turn vendor purchase-order and packing-slip documents into Shopify products, variants, and inventory. By installing the App, the merchant agrees to this Policy.
1. Information we collect
Store data (via the Shopify Admin API, with the merchant’s authorization). When you install the App you grant it the scopes it requests (currently read/write products, write inventory, and read locations). Using these, the App accesses your store domain and identifiers, product and variant records, inventory levels, and locations, so it can create and update products and sync stock.
Documents you upload. Purchase orders, packing slips, and similar vendor documents you upload (PDFs or images), and the structured data extracted from them (product names, SKUs, barcodes, costs, prices, sizes/variants, quantities, ship-to details). You can upload inside the App or through a secure, single-use link you open on your phone to photograph a document.
Vendor details you enter. Information you add about your vendors — a vendor's business name, addresses, payment terms, and contact details (contact name, title, and email) — which the App uses to organize your orders and to pre-fill vendor communications it drafts for you.
Account & technical data. Authentication session tokens issued by Shopify, the name and email of the Shopify staff who install or use the App (provided by Shopify), plan and billing status, any feedback you submit through the App, and operational logs and usage metrics (e.g. timestamps, request outcomes, and aggregate model-usage counts) used to run, secure, and improve the service.
The App is a back-office tool and is not designed to collect your customers’ personal data. If a document you upload happens to contain a person’s name or contact details (e.g. a buyer or receiving contact), that information is processed only to provide the service.
2. How we use information
To extract data from your documents, create and update your Shopify products and inventory, support the receiving workflow, remember your per-vendor formatting preferences so future documents read more accurately, draft vendor communications (such as emails you can review and send yourself), provide support, process billing, and maintain the security and reliability of the App. We do not sell your data, and we do not use it for advertising.
3. Service providers (subprocessors)
We share data with a small set of providers strictly to operate the App:
- Anthropic — document content and relevant order and vendor details are sent to Anthropic’s Claude API to extract your data and to draft the vendor communications you request. This is processing to deliver the service; under Anthropic’s commercial API terms, this content is not used to train their models.
- Shopify — the platform your store and the App run on.
- Fly.io — application hosting (United States).
- Neon — managed PostgreSQL database.
- Upstash — managed Redis used for background job processing.
- Cloudflare R2 / Fly.io Tigris — S3-compatible object storage where your uploaded documents (purchase orders, packing slips, and photos) are kept.
Each provider is bound by its own terms and data-protection obligations. Our web pages also load typefaces from Google Fonts; when they do, Google receives your browser’s IP address, but we do not share your store data with Google. We may also disclose information if required by law.
4. Data retention & deletion
We retain your data for as long as the App is installed and as needed to provide the service. When you
uninstall the App we end your session and stop processing; deletion of the store’s data — including uploaded
documents and their extracted contents — is triggered when Shopify sends us a shop-redaction request, which
follows uninstallation, in line with Shopify’s data-erasure requirements. We may also delete older uploaded
documents, extracted job data, and operational logs on a rolling basis as part of routine data minimization.
The App implements Shopify’s mandatory compliance webhooks (customers/redact,
customers/data_request, and shop/redact).
5. Security
Data is encrypted in transit (HTTPS/TLS), access to production systems is restricted, and we rely on reputable, security-conscious infrastructure providers. No method of transmission or storage is perfectly secure, but we work to protect your information using commercially reasonable safeguards.
6. International transfers
Our providers process data primarily in the United States. Some providers — such as our object-storage and content-delivery networks — operate globally distributed infrastructure and may process or cache data in other regions. If you access the App from outside the United States, your information may be transferred to and processed in the United States.
7. Your rights
Depending on your location (e.g. under GDPR or CCPA/CPRA), you may have rights to access, correct, export, or delete your data, or to object to or restrict certain processing. You can exercise these rights by uninstalling the App (which triggers deletion) or by contacting us at the address below. We respond to verified requests as required by applicable law.
8. Children
The App is a business tool and is not directed to children, and we do not knowingly collect personal information from children.
9. Changes to this Policy
We may update this Policy from time to time. We will revise the “Effective” date above and, for material changes, provide notice through the App or by other reasonable means.
10. Contact us
Questions or requests about this Policy or your data: privacy@orca1.app (Hexa Origin LLC).