Privacy policy

Who this covers

SplitRoute is a Shopify app operated by Lareys. It splits, routes and holds orders in a merchant's Shopify store according to rules the merchant writes.

This policy describes what the app does with data belonging to the merchant who installs it and to that merchant’s customers. The merchant remains the controller of their customers’ data. SplitRoute processes it on the merchant’s instructions, which are the rules they configure.

What SplitRoute reads from a store

When an order arrives, or when a merchant runs a rule by hand, the app reads from the Shopify Admin API:

• Order contents: line item titles, SKUs, quantities, prices, weights, product tags, product types, vendors, custom attributes and metafields.
• Where the order is going: country, province, city, postal code and coordinates.
• Fulfillment orders, their assigned locations, and inventory levels at the store’s locations.
• The customer’s tags and the customer’s Shopify id, in one query that runs only when a rule needs one of them: tags when a rule has a condition that reads them, the id when a rule splits items into an order of their own. A rule set that does neither never runs that query.
• Whether the order was placed on behalf of a company, and if so the company, location and contact identifiers, nothing about the company itself. Read for the same rules as the customer id, and for the same reason: a split that creates an order has to know whose it is.
• When a rule splits items into an order of their own, what that order has to carry: the original’s shipping address (recipient name, company, street lines, city, province, postal code, country and phone), its order note, its tax lines, the name of its shipping method, whether it was paid, and, for an unpaid business order, its payment terms.
• The store’s timezone, so dates render in the merchant’s own time.

The app reads what a rule needs and no more. A read that costs a separate API call is bought only when a rule asks a question that requires it.

What SplitRoute does not read

No query in the app requests a customer’s email address, billing address or saved addresses. A name, street address and phone number are read only as part of the shipping address above, and only for a split that creates an order.

Shopify’s order webhooks deliver the whole order to the app, customer details included. The app takes the fields listed above from them and stores none of the rest.

The orders SplitRoute creates

When a rule splits items into an order of their own, the app creates that order in the merchant’s store:

• It copies the original’s shipping address onto the new order, so the items can be shipped. The address is not stored by the app.
• It links the new order to the original: the tag split-from-1369 for order #1369, a name that extends the original’s (#1369-S), an order attribute that reads “Split from #1369”, and the original’s order note.
• It attaches the new order to whoever the original belonged to, because an order attached to nobody is missing from that buyer’s order history, order count and lifetime value. A consumer order is attached to the same customer. A business order is attached to the same company and location, so it stays the company’s order rather than one attributed to the contact, who is not the buyer.
• The customer’s saved addresses are not changed. The address is set on the new order only, after the order exists.
• The app sends the customer no receipt or confirmation for the new order.
• When the original was paid, the new order records a payment for what the moved items cost, under a name the merchant chooses (“Split order payment” unless they change it). No money is taken from the customer again.

Shopify lists every order an app creates under that app’s sales channel, so these orders appear under SplitRoute’s own sales channel rather than the channel the original was placed through.

What SplitRoute stores, and where

The app keeps a database on Cloudflare D1, held in one location that Cloudflare fixes when the database is created. It holds:

• The rules and settings the merchant wrote, and the store’s timezone.
• A decision record for every order the app acted on: the order’s id and number, which rule matched, what the app did, whether it succeeded, and why it declined when it declined.
• For a split, the lines that moved: their titles, quantities and the per-unit price the customer paid. This is purchase detail about an identifiable person, and it is the most sensitive thing the app stores.
• Orders queued for a delayed run.
• Whether the app is paused for the store, when it was paused, and whether the merchant paused it or an uninstall did.
• A plan-usage record for each order the app acted on, one row per order holding the order’s id and the billing month, which is what the plan’s order limit counts.
• The Shopify OAuth session for the store, including the access token.

No name, address or phone number is stored. Nothing else is stored anywhere. The app has no analytics service, no error-reporting service and no third-party logging.

How long it is kept

Decision records are deleted 90 days after they are written. The period is the same for every store and cannot be changed. A scheduled job deletes expired records.

Two kinds of record outlive that period, because deleting them would break the app while it is installed: the marker that identifies an order SplitRoute itself created, and the record of a fulfillment hold that has not been released. Without the first, the app could split its own split. Without the second, it could not find the hold to release.

Plan-usage records are kept for the current billing month and the one before it, which the app’s home page compares, and the scheduled job deletes older ones.

Sessions and queued runs are deleted as soon as Shopify reports the uninstall. Everything else, those two kinds of record included, is deleted 48 hours after the store uninstalls, when Shopify sends the store erasure request.

Privacy requests from a merchant’s customers

Shopify sends SplitRoute the three mandatory privacy webhooks, and the app answers all three.

• Request for data: the merchant can see everything the app holds about an order on that order’s page inside the app, under Orders. The app assembles no separate export.
• Request for erasure: the app deletes its records of the named orders. Where a record is still needed, as described above, the purchase detail is stripped out and only Shopify identifiers remain. The plan-usage record, an order id and a month, is left for the scheduled job to delete with the rest of its month.
• Store erasure: every row belonging to that store is deleted, across all eight tables. Shopify sends it 48 hours after the store uninstalls.

A merchant who needs something these three do not cover can write to support@lareys.dev.

Who else sees the data

Two companies, and no others:

• Shopify, which is where the data comes from and where the app writes back to.
• Cloudflare, which runs the app’s code, stores its database and captures its request logs.

The request logs record the store’s domain, the identifiers of orders, fulfillment orders, rules and privacy requests, reason codes, and error messages returned by Shopify. They contain no customer identifiers, names, email addresses or postal addresses.

SplitRoute sends nothing to any other service. It does not sell data, and it does not use a merchant’s data or their customers’ data to train anything.

The Shopify Flow connection

If a merchant connects SplitRoute to Shopify Flow, the app sends Flow two values after it acts on an order: the order’s numeric id, and one word naming what it did. No customer data crosses that boundary.

Security

Traffic to the app is served over TLS and carries HTTP Strict Transport Security. Requests from Shopify are verified: webhooks by their signature, admin pages by a session token. The landing page and the sign-in pages are rate limited by source address.

Access tokens are stored in the app’s database and are never written to logs.

Changes

This policy was last updated on 24 September 2026. If what the app does with data changes, this page changes with it, and the date above moves.

Questions go to support@lareys.dev.