Privacy Policy
Effective Date: September 29, 2026 | Last Updated: September 29, 2026
1. Overview & Commitment to Privacy
Koss: Reorder & PDF Invoices ("the App", "we", "us", or "our") is developed by KossLabs to provide Shopify merchants and their buyers with seamless 1-click reordering and self-service downloadable PDF invoices.
We believe privacy is a fundamental human right. Our architecture is engineered around a Stateless Edge Processing model. We do not maintain a permanent database of buyer personal data, purchase histories, physical addresses, or financial details.
2. Data We Process and Why
A. Merchant Store Information (Stored in Secure Cloudflare D1)
- Shop Domain: e.g.,
your-store.myshopify.com, to associate app settings and subscription tiers. - Offline Access Token: Stored securely to authenticate administrative GraphQL requests with Shopify APIs.
- Invoice Customization Settings: Business legal name, VAT/Tax ID, registered address, logo image URL, invoice notes, and reorder button label text.
- Aggregated Performance Metrics: Counters for total completed reorders and generated invoice counts. No buyer personal identifiable information (PII) is included in these metrics.
B. Buyer & Order Information (Processed Ephemerally in Memory)
- PDF Invoice Generation: When a buyer or merchant requests a PDF invoice, order details (buyer name, line items, pricing, tax, billing/shipping address) are retrieved directly from Shopify's API, assembled into a PDF stream in memory, and transmitted directly to the client. No copy of this data or generated PDF is ever saved to persistent disk or database.
- 1-Click Reorder Flow: When a customer clicks 1-Click Reorder in their Customer Account order history, the order line items are queried to build a direct Shopify Cart permalink. The user is redirected to checkout without storing their order or personal information.
3. Third-Party Infrastructure & Security
The App runs on Cloudflare Workers and Cloudflare D1. All communication between Shopify, our edge workers, and clients is encrypted in transit via industry-standard TLS 1.3. Cloudflare complies with ISO 27001, SOC 2 Type II, and PCI-DSS requirements.
We do not share, sell, rent, monetize, or disclose any merchant or customer personal data to third-party advertisers, data aggregators, or brokers.
4. Shopify Mandatory Compliance & Webhooks (GDPR / CCPA)
In full compliance with Shopify's Partner program and international data protection laws (including the EU GDPR, UK GDPR, and California CPRA):
- Customer Data Request (
customers/data_request): Because we store zero customer personal data in any database, any request yields a confirmation of no stored data. - Customer Data Redact (
customers/redact): As zero customer records are persisted, no customer PII requires manual deletion. - Shop Data Redact (
shop/redact) & App Uninstalled (app/uninstalled): When an uninstallation or redaction webhook is received from Shopify, all corresponding merchant settings, tokens, and aggregated metrics are permanently and irrecoverably erased from our database.
5. Merchant and Buyer Rights
Under applicable privacy regulations, merchants and consumers retain rights to:
- Access information processed by the App.
- Request immediate deletion or modification of merchant settings.
- Revoke authorization at any time by uninstalling the App from Shopify Admin.
6. Contact Information
If you have any questions, inquiries, or requests regarding this Privacy Policy or our security practices, please contact us:
Developer / Organization: KossLabs
Support Email: support@theaikoss.com
App Website: https://koss-order-hub-worker.theaikoss.workers.dev