Crate

Privacy Policy

Last updated: 12 August 2026

Crate records an order only when one of your own discount rules applied to it. Every other order in your store is read, found to be none of our business, and discarded without being stored.

What Crate does

Crate adds a group order form to your storefront and applies an automatic quantity-tier discount at checkout. The form is rendered by your own theme. The discount is evaluated by a Shopify Function that runs on Shopify's infrastructure, not ours. When a checkout reaches one of your tiers, we record that order so you can see who placed it and what it saved them.

What we store

Your shop domain and access token. Issued by Shopify when you install, used only to make API calls on your behalf.
Your discount rules and form design. Everything you configure in the app.
Discounted orders. For orders one of your rules applied to: the order number and date, the item quantity, which rule applied, the discount amount and the order total — and the buyer's name, email address and phone number as Shopify sends them.

What we never store

Orders that did not receive one of your Crate discounts
Shipping or billing addresses
Payment details of any kind
Browsing, session or analytics data about your shoppers

Permissions we ask for, and why

read_products — to let you pick which collection or products a rule covers.
read_discounts, write_discounts — to create and update the automatic discounts that run your tiers, so you never set them up by hand.
read_orders, read_customers — protected customer data. Used only to identify orders your rules discounted and to show you who placed them. Requested under Shopify's protected customer data approval.

Deleting your data

Uninstalling removes our access immediately and deletes your data straight away — every recorded order, every discount rule, your order minimums and your form design. We do not wait for the 48-hour compliance window to do it. We also honour Shopify's mandatory compliance webhooks:

customers/data_request — we produce every record we hold about that shopper so you can pass it on.
customers/redact — we erase that shopper's name, email and phone number from our records. The order row itself is kept without any identifying detail, so your own totals do not silently change.
shop/redact — sent 48 hours after uninstall. Your data is already gone by then, so this removes the last thing left: the shop record itself, which uninstalling only marks as deleted so that reinstalling recognises you.

The tier settings written to your shop's metafields belong to your store and remain there until you remove them.

Third parties

None. Crate sends no data to analytics services, advertising networks or data brokers. The only party it communicates with is Shopify.

Contact

Questions about this policy, or a data request, can go to commerano@gmail.com.