Privacy policy
Gifting is unusual: your customer gives us personal data about other people. This page explains exactly what we hold, why, for how long, and what you and they can ask us to do about it.
Draft — needs legal review before launch
Written against how Cadora actually handles data, but not legal advice. Have counsel review it, confirm the subprocessor list and retention periods against your real infrastructure, and replace every [bracketed] item.
1. Who is responsible for what
Cadora is an application installed by merchants on their Shopify stores. Who controls the data depends on whose data it is:
| Data | Our role |
|---|---|
| Shopper & gift recipient data flowing through a merchant's store | Processor. The merchant is the controller. We process it on their instructions to provide the gifting service. |
| Merchant & staff account data, billing records, support correspondence | Controller. We decide how this is used to run and support our business. |
| Website visitors on cadora.app | Controller. |
If you are a shopper or a gift recipient and want your data changed or deleted, the fastest route is the merchant's store you ordered from. We will help them, and you can also contact us directly.
2. What we collect
From merchants
- Store identity: Shopify store domain, store name, plan, and the app permissions you grant.
- Staff contact details for the people who administer Cadora.
- Configuration you set: order structure rules, shipping and tax settings, email templates, export field mapping, branding.
- Billing records: subscription and usage charges assessed through Shopify.
- Support correspondence and, if you send them, brand assets.
From shoppers using the gifting flow
- Sender details: name, email, and where provided company and phone.
- Cart and order contents, per-line prices, and the resulting order references.
- Saved gift carts and the short code used to resume them.
- For B2B flows, purchase order references and terms information the merchant has configured.
Technical data
- Application logs, error reports, IP address, browser and device information, and timestamps.
- Aggregated usage metrics about how features are used.
3. Gift recipients — the unusual part
The point of Cadora is that one person sends gifts to many others. That means the shopper enters personal data about third parties who are not present. We hold, on the merchant's behalf:
- Recipient name, shipping address, and where provided email address and phone number.
- The gift message intended for that recipient.
- The requested arrival date and any delivery preferences.
- Optional attributes the merchant has enabled, which may include dietary or allergy flags.
- Shipment and delivery status per recipient.
Two consequences worth stating clearly. First, dietary and allergy information can be sensitive data in some jurisdictions; merchants should only enable those fields where they have a lawful basis, and we treat them with the same protections as the rest of the record. Second, recipients did not give us their data directly — the merchant is responsible for having a lawful basis and for the notice their privacy law requires. We support recipient requests as described in section 11.
Where a merchant enables recipient-facing features, such as asking a recipient to supply or confirm their own address, we process the recipient's response for that purpose only.
4. Why we use it
| Purpose | Basis (where GDPR applies) |
|---|---|
| Providing the gifting flow, creating orders, and sending transactional email | Performance of contract; processor acting on controller instructions |
| Saving and resuming gift carts | Performance of contract / legitimate interests |
| Support, troubleshooting, and service communication | Legitimate interests |
| Billing, tax, and financial records | Contract and legal obligation |
| Security, fraud prevention, and abuse monitoring | Legitimate interests |
| Improving and securing the service using aggregated, de-identified data | Legitimate interests |
We do not sell personal data, and we do not use recipient data for our own marketing. We do not use merchant or recipient data to train third-party generative AI models.
5. Payments & card data
Shoppers pay on the merchant's Shopify checkout. Cadora never receives, stores, or transmits cardholder data. Payment processing is handled by Shopify and its payment providers under their own terms. Our own fees are billed through the Shopify Billing API, so we do not hold merchant payment card details either.
6. Who we share it with
- Shopify — as the platform of record for orders, customers, fulfilment, and billing.
- The merchant whose store the order was placed on.
- Subprocessors that host and operate the service, listed below.
- Systems the merchant directs — for example an ERP or OMS the merchant exports gift orders into. The merchant chooses these and controls the mapping.
- Professional advisers, and authorities where we are legally required, or to protect rights and safety.
- An acquirer, in connection with a merger, acquisition, or sale of assets, subject to this policy.
7. Subprocessors
We use a small number of vendors to run the service. [Confirm and complete this list against your real infrastructure before launch.]
| Vendor | Purpose & region |
|---|---|
| [Cloud hosting provider] | Application hosting and database storage — [region] |
| [Transactional email provider] | Sending lifecycle and pay-link emails — [region] |
| [Error & log monitoring] | Diagnostics and uptime monitoring — [region] |
| [Address validation provider] | Optional address verification, where the merchant enables it — [region] |
| Shopify | Platform, orders, and billing |
Each subprocessor is bound by a written agreement with confidentiality and security obligations. We will give merchants reasonable notice before adding a subprocessor that processes recipient data.
8. How long we keep it
| Data | Retention |
|---|---|
| Saved / abandoned gift carts | 30 days from last activity, then deleted or de-identified |
| Completed gift orders and recipient records | While the merchant's account is active, and then [90] days after uninstall |
| Merchant account & configuration | [90] days after uninstall |
| Billing and tax records | As required by law, typically [7] years |
| Application and security logs | [90] days |
| Support correspondence | [24] months |
Merchants can request earlier deletion. Orders that exist in Shopify are governed by the merchant's own Shopify retention settings, not ours. Merchants should export anything they need before uninstalling.
9. International transfers
We are based in [Canada] and use vendors that may process data in [Canada, the United States, and the European Union]. Where personal data moves out of the UK, EEA, or another restricted region, we rely on an approved transfer mechanism such as the Standard Contractual Clauses, the UK Addendum, or an adequacy decision, together with additional safeguards where needed.
10. Security
- Encryption in transit (TLS) and at rest.
- Access limited to staff who need it, under least-privilege controls and multi-factor authentication.
- Authentication and store permissions delegated to Shopify — we do not hold your Shopify password.
- Logging, monitoring, and alerting on suspicious activity.
- Regular backups, with restore testing.
- Vendor review before a subprocessor handles personal data.
No system is perfectly secure. If a breach affects personal data we hold, we will notify affected merchants without undue delay and, where we are the processor, support their own notification obligations. [Confirm your notification window and any certifications — e.g. SOC 2 — before launch.]
11. Your rights
Depending on where you live, you may have the right to access, correct, delete, port, or restrict processing of your personal data, to object to processing based on legitimate interests, and to withdraw consent. You also have the right not to be discriminated against for exercising these rights.
If you are a shopper or gift recipient: contact the merchant whose store the gift came from — they are the controller and can action your request directly. You may also write to privacy@cadora.app and we will route your request to them and assist.
If you are a merchant: email privacy@cadora.app. We respond within [30] days, or sooner where the law requires. We may need to verify your identity first.
If you are in the UK or EEA you may complain to your local supervisory authority; in Canada, to the Office of the Privacy Commissioner.
12. Notes for merchants
Because you are the controller of shopper and recipient data, a few responsibilities sit with you:
- Make sure your own privacy notice explains that customers can submit personal data about third-party recipients, and what happens to it.
- Only enable optional sensitive fields, such as dietary or allergy flags, where you have a lawful basis.
- Configure your ERP or OMS export deliberately — you control which fields leave Cadora and where they go.
- Handle shopper and recipient rights requests for data held in your store, with our support.
- If you need a data processing addendum, contact us and we will put one in place.
13. Cookies & local storage
In the gifting flow we use strictly necessary cookies and browser storage to keep a session, hold worksheet progress, and let a shopper resume a saved cart. These are functional, not advertising.
On our marketing website we use strictly necessary cookies and, where permitted, [privacy-friendly, aggregated analytics]. We do not run third-party advertising trackers. [Confirm your analytics vendor and add a consent banner if you adopt anything non-essential.]
14. Children
Cadora is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under [16]. If you believe a child's data has reached us, contact us and we will delete it.
15. Changes
We may update this policy. If a change is material we will give merchants reasonable notice by email or in-app before it takes effect. The "last updated" date above always reflects the current version.
16. Contact
Privacy questions and rights requests: privacy@cadora.app, or write to Cadora Inc., 202-2149 Yonge St, Suite 1006, Toronto, ON M4S 0C5, Canada.
We have not appointed an EU or UK representative under Article 27, and we do not have a designated Data Protection Officer. Privacy enquiries are handled by the team at the address above.
See also our terms of use.