Privacy Policy — OrderCancel

Last updated: 18 June 2026

This Privacy Policy explains how OrderCancel (“the App”), provided by Mindthemedia ApS (“we”, “us”), processes personal data when a merchant installs the App on their Shopify store and when that store’s customers use the order‑cancellation form.

1. Our role

The merchant (the Shopify store owner) is the data controller for their customers’ personal data. We act as a data processor on the merchant’s behalf, processing personal data only to provide the App’s functionality and only on the merchant’s instructions.

2. What the App does

The App lets a store’s customers request cancellation or withdrawal of their own order, in line with the EU Consumer Rights Directive (14‑day right of withdrawal). When a customer submits the form, the App looks up the order via the Shopify Admin API, applies the 14‑day rule, and either cancels the order (if not yet shipped) or registers a return request (if already shipped).

3. Personal data we process

Data	Source	Purpose
Customer name, email, order number	Entered by the customer in the form	To identify and verify the order
Order details (order number, email, order/fulfillment dates, fulfillment status, tags, notes)	Shopify Admin API	To verify the order and apply the 14‑day rule

We process the minimum data necessary and use it solely to carry out the customer’s cancellation/withdrawal request.

4. Data we store — and data we do not

We do not store customers’ personal data on our servers. Form submissions are processed in transit and are not persisted by us. We do store, per store:

An OAuth access token for the store (so the App can call the Shopify Admin API).
Store configuration set by the merchant (e.g. return address, contact email, time window).

When a return is registered, the App writes a tag and an order note into the merchant’s Shopify store. That note may include the customer’s name and email. This data resides in the merchant’s own Shopify account and remains under the merchant’s control.

5. Sub‑processors

Provider	Purpose	Location
Shopify	Order data via the Admin API	Per Shopify’s terms
Simply.com (DanDomain A/S)	Hosting of the App backend	EU (Denmark)

6. Retention

We retain the per‑store access token only while the App is installed. When the App is uninstalled, the token and store configuration are deleted within 48 hours (triggered by Shopify’s shop/redact webhook). We do not retain customers’ personal data.

7. Data subject requests (GDPR)

Because we do not store customers’ personal data, we have nothing to disclose or erase for individual customers. We support Shopify’s mandatory compliance webhooks (customers/data_request, customers/redact, shop/redact) and respond to them accordingly. Requests regarding data held in the merchant’s Shopify store should be directed to the merchant as data controller.

8. Security

Data is transmitted over HTTPS/TLS. Requests from Shopify (OAuth and webhooks) are verified using HMAC signatures. Access tokens are stored outside public web access, and administrative access to the App is protected by a hashed password.

9. International transfers

The App backend is hosted in the EU. Where data is processed by Shopify, it is handled under Shopify’s own data processing terms and safeguards.

10. Changes

We may update this Privacy Policy from time to time. The “Last updated” date above reflects the latest version.

11. Contact

Mindthemedia ApS
Jernbanegade 29, 6000 Kolding
CVR: 34466572
Email: jh@mindthemedia.com