SAME BOX PRIVACY POLICY
Last updated October 24, 2026
This policy explains what Same Box, a Shopify app made by Opclera Systems LLC ("we", "us"), does with data from the Shopify stores that install it. It adds to our main Privacy Policy. For your customers' personal data, we act as your processor under our Data Processing Agreement.
1. IN SHORT
- Same Box reads your orders from Shopify to find the ones going to the same customer at the same address.
- It stores Shopify order IDs only, never a customer's name, email address or shipping address.
- It never sells, shares or uses your data for anything but running the app, and it has no ads or tracking.
- When you uninstall, everything it stored about your store is deleted.
2. THE SHOPIFY PERMISSIONS IT ASKS FOR
| Permission | Why |
|---|---|
| Read and change orders | To find orders that ship together, tag them, buy one label for the group, add its tracking number to each order and refund the extra shipping. |
| Read customers | To tell whether two orders come from the same customer. |
| Read products | To show product photos and add up weights for the combined parcel. |
| Manage fulfillment orders | To mark every order in the group as shipped with the same tracking number, and to hold orders when a plan includes holds. |
3. WHAT IT READS
Each time it checks your store, Same Box reads your unfulfilled and recently shipped orders from Shopify: order numbers and status, items, weights and product photos, shipping charges, tracking numbers, and the customer's name, email address and shipping address. It uses them to match orders and show them to you, then lets them go. Customer details are not saved by the app.
4. WHAT IT STORES, AND FOR HOW LONG
| Data | Kept until |
|---|---|
| Your store's Shopify sign-in (the access token Shopify issues to the app) | You uninstall. |
| Your settings, such as your box sizes | 48 hours after you uninstall. |
| Shopify order IDs of the groups you shipped together, held or dismissed | 48 hours after you uninstall, or sooner if the order is deleted or the customer asks for erasure. |
| A private log of what the app did and any errors, with store domains and order IDs. Email addresses and phone numbers are masked; names and addresses are never written to it. | 180 days. |
Database backups are kept for 30 days, so deleted data leaves them within a further 30 days.
5. WHAT IT WRITES TO YOUR STORE
Only what you'd expect from the app's job: tags on orders that ship together, holds with a note naming the order they ship with, the shipping label you buy in the app, the tracking number on each order of the group, and the shipping refund with a note. It never merges, edits the items of, or cancels an order. The tracking number is added without sending your customer extra emails.
6. WHERE IT'S KEPT, AND WHO ELSE SEES IT
The app and its data are hosted on Cloudflare, which encrypts data at rest; all traffic uses HTTPS. We are in the United States and process data there and on Cloudflare's network. If you contact support, your message is handled in Zoho Desk and Google Workspace, and we may use Anthropic's AI to help draft replies. The full list of subprocessors is in Annex III of our Data Processing Agreement. Shipping labels are bought through Shopify, under Shopify's own terms.
7. CUSTOMER REQUESTS AND UNINSTALLING
Same Box answers Shopify's three privacy requests:
- A customer asks for their data (
customers/data_request): the app holds no customer details, only order IDs, which Shopify already has. - A customer asks to be erased (
customers/redact): the order IDs of that customer's orders are deleted. - You uninstall: the sign-in is deleted at once, and 48 hours later Shopify sends
shop/redactand everything else stored for your store is deleted.
8. CHANGES AND CONTACT
If Same Box starts to store more data or uses a new service, we'll update this page and the Data Processing Agreement first. Questions about this policy: opclera.com/contact or hello@opclera.com.