Privacy policy

Bahader Order Editing · last updated 7 November 2026

Bahader Order Editing ("the app") is a Shopify app made by Bahader Labs, a brand of Shahid Bahader IT Services ("we"). It lets a merchant's customers change their own order for a short time after checkout: the delivery address, the items, or cancelling the order. This policy explains what data the app handles, why, and how long it is kept.

Data from merchants

• the shop's myshopify.com address and the access token Shopify gives the app;
• for staff who open the app: their Shopify user ID, name, email, locale and account-owner flag, as provided by Shopify for the session;
• the merchant's settings (change window, allowed changes, email address and texts).

Data from the merchant's customers

When a customer opens the change page in their customer account, the app reads that order from Shopify (items, prices, delivery address, payment status) to show what can be changed, and checks with Shopify that the logged-in customer owns the order. Nothing is stored for that. When the customer makes a change, the app stores a record of it: the order number, the customer's Shopify ID, what changed and the amounts. For address changes the record includes the old and new delivery address (name, company, address, phone). The app does not store payment details; payments and refunds are handled by Shopify.

How the data is used

• to apply the customer's changes to the order in Shopify;
• to show the merchant requests to approve and a history of changes;
• to email the merchant about requests, and the customer about the merchant's decision;
• to count changed orders for the merchant's plan.

We do not sell data, use it for advertising, or share it with third parties, except our hosting provider, OVHcloud (which runs the server and database in its data centre in Canada, a country with an EU adequacy decision), and our email provider, Spacemail (which delivers the emails). The merchant is the controller of their customers' data; we process it on the merchant's behalf under the data processing terms in our terms of service.

Retention and deletion

• Change records are kept while the app is installed, so the merchant can see an order's history.
• When Shopify passes on a customer's request to be forgotten, we delete that customer's change records. When a customer asks for their data, the merchant is emailed the list of their changes.
• When a merchant uninstalls the app, we delete the shop's access details straight away, and all of the shop's data when Shopify asks us to (48 hours after uninstalling).
• Records of staff access to change details are kept for 180 days.

Security

Data is sent over HTTPS and stored in a private database on our server. Change details (which can contain an address) and the app's access tokens are encrypted in the database (AES-256-GCM), so backups hold them only in encrypted form. Requests from Shopify and from the customer account are checked against Shopify's signatures. Only the merchant's staff, through Shopify, can see a shop's data in the app, and the app records when staff open requests.

Your rights

If you are a customer of a store that uses the app, contact the store first: they control your data. You can also contact us at the address below, and we will help.

Contact

Bahader Labs (Shahid Bahader IT Services)
Email: support@bahaderlabs.com

We will update this page if the way the app handles data changes. The date at the top shows the latest version.