Privacy Policy — Docket

Last updated: 24 July 2026

Docket (“the App”) is a Shopify app that helps merchants create purchase orders, send them to suppliers, and receive stock into their Shopify inventory. This policy explains what the App stores, why, and for how long.

The App is provided by Younes Alaoui Lachgar, Jesionowa 66/7, 50-504 Wrocław, Poland (“we”, “us”).

1. What we do not collect

The App does not collect, store, or process any personal data belonging to your customers.

We do not request access to customer records, orders, checkout data, or marketing information. The App’s Shopify permissions cover products, inventory, and locations only. If you review the App’s access scopes in your Shopify admin, you will see no customer or order permissions listed.

2. What we store

2.1 Data you enter

Data	Purpose
Supplier name, email, phone, postal address	Addressing and sending purchase orders
Supplier currency and document language	Generating purchase order documents
Supplier notes	Your own reference; visible only to you
Supplier product codes, prices, lead times, reorder points	Pricing purchase orders correctly per supplier, and flagging low stock
Purchase orders, line items, quantities, costs, expected delivery dates	The core function of the App
Receiving records and delivery notes	Tracking what physically arrived

Supplier contact details are business contact information for companies you buy from. If a supplier is a sole trader, this information may constitute personal data under the GDPR, and is processed on the basis of our legitimate interest in providing the service you have asked for.

2.2 Data from Shopify

To function, the App reads the following from your store and stores copies where noted:

Product and variant details (title, description, SKU, barcode, cost, image) — copied onto purchase order lines so that an order remains an accurate record even if a product is later renamed or deleted in Shopify.
Location names and IDs — to record where stock should be received.
Inventory quantities — read at the moment of receiving and when checking for low stock, and written back to reflect stock you have received.

2.3 Technical data

Your store’s .myshopify.com domain and Shopify access token, so the App can connect to your store.
Standard server logs, which may include IP addresses and timestamps, retained for security and troubleshooting for 30 days.

3. Your role and ours

For the data described above, you are the data controller and we act as a data processor on your behalf. We process this data only to provide the App’s functionality and only on your instructions.

We do not sell your data. We do not share it for advertising. We do not use it to train machine learning models.

We use the following service providers, who process data solely to host and run the App:

Provider	Purpose	Location
Render Services, Inc.	Application hosting and database	Frankfurt, Germany (EU)
Shopify Inc.	Platform and API	Global

We may disclose data if legally required to do so.

5. International transfers

Application data is stored and processed within the European Union (Frankfurt, Germany).

Shopify Inc. is headquartered in Canada and operates globally. Your relationship with Shopify, and any transfers arising from it, are governed by Shopify’s own terms and privacy policy, which you accepted when opening your store.

6. Retention and deletion

Data is retained for as long as the App is installed on your store.
When you uninstall the App, Shopify sends us a shop data erasure request approximately 48 hours later. On receiving it, we delete all suppliers, supplier catalogues, purchase orders, receiving records, and session data associated with your store.
You can request deletion at any time by emailing alaoui.youness@gmail.com.

You can export all of your purchase order data to CSV at any time, on every plan, including the free plan. This is a deliberate design decision: your records should never be locked inside our app.

7. Privacy law compliance requests

As required of all Shopify apps, we respond to the mandatory data request, customer redaction, and shop redaction webhooks. Because the App holds no customer data, customer data requests and customer redaction requests return no records. Shop redaction erases everything associated with your store as described above.

8. Your rights

Depending on your jurisdiction, you may have the right to access, correct, export, delete, or restrict processing of your data, and to lodge a complaint with a supervisory authority. In Poland, the supervisory authority is the Personal Data Protection Office (Urząd Ochrony Danych Osobowych).

To exercise any of these rights, contact alaoui.youness@gmail.com and we will respond within 30 days.

9. Security

Data is transmitted over encrypted connections (HTTPS/TLS) and stored on access-controlled infrastructure. Shopify access tokens are stored server-side and never exposed to the browser. No security measure is absolute, and we cannot guarantee absolute security.

10. Changes

We may update this policy. Material changes will be reflected in the “Last updated” date above, and where the change is significant we will notify merchants through the App or by email.

11. Contact

Younes Alaoui Lachgar Jesionowa 66/7 50-504 Wrocław Poland Email: alaoui.youness@gmail.com