Effective October 20, 2026 · Last updated October 20, 2026

Privacy Policy

The short version

• We use your purchase orders, catalog, invoices and Shopify data only to run Orderseam for you: reading orders, building draft orders and invoices, and emailing your buyers when you tell us to.
• We don't sell your data or your buyers' data, we don't share it for advertising, and we don't combine it with other brands' data.
• An AI model reads your order documents. Its provider, Anthropic, isn't allowed to train on them, and neither do we.
• We use a short list of service providers to run Orderseam, and section 7 names every one of them and what it does.
• We delete your data within 30 days after you leave, or sooner if you ask.

1. Who we are and what this covers

Orderseam is a service of 369 Delivery LLC, a Texas limited liability company, doing business as Orderseam. In this policy "we" and "us" mean 369 Delivery LLC, "you" means the business that uses Orderseam (a "brand") and the people who use it for that business, and "buyers" means the stores and people who send a brand wholesale purchase orders (POs).

This policy covers the orderseam.com website, the Orderseam service (including the Orderseam app for Shopify), our emails, and messages you send us. Orderseam is a business tool. It isn't offered to consumers for personal or household use.

To reach us about privacy, use our contact form and choose or mention "privacy". We answer from a real person on our team.

2. Your data and your buyers' data

Data protection laws give different jobs to the business that decides why data is used (a "controller", or a "business" under California law) and the business that handles it only on someone else's instructions (a "processor" or "service provider").

• Your buyers' details and your order data. When we read POs, match them to your catalog, create draft orders and send invoices, we act as your processor and service provider. You decide what we handle and why; we follow your instructions and this policy. You remain responsible for telling your buyers how you use their details, for example in your own privacy notice.
• Your account and billing details, our website, and our own emails. For these we're the controller, and this policy is our notice to you.

If your law requires a written data processing agreement with us, ask us and we'll sign one with you. Our terms of service already commit us to use your data only to provide Orderseam to you.

3. What we collect

Data you or your buyers give us to process

• Purchase orders you forward to your Orderseam address, upload, or send us during setup, in any format (PDF, spreadsheet, Word file, email, scan or photo), and the original file. POs usually contain your buyers' business name, contact name, email, phone number, ship-to and bill-to addresses, PO number, dates, items, quantities and prices.
• Your catalog: products and their options (such as scent, flavor, weight, color, case pack or size), SKUs, stock levels, prices, kits and lot or best-by details.
• Buyer shorthand we learn when you or our team correct a reading, such as "buyer X writes 'LAV' for Lavender 8 oz", kept per buyer so the next PO from that buyer reads correctly.
• Invoices and clients: invoices you create, your client list, payments you record, the email addresses you send invoices to, and your invoice and reminder settings. Orderseam doesn't take payments from your buyers; it records the payments you tell it about.
• Shopify store data, described in section 6.

Data about you

• Account details: your name, brand name, login email, the login codes we send (stored only as a scrambled hash, for 15 minutes), and when you last logged in.
• Billing details: Stripe collects your card or other payment method directly; we never see or store your full card number. Stripe tells us your plan, billing status, billing email, country, any VAT, GST, ABN or business number you give, and your invoices. We count the POs you send in each billing period.
• Messages and forms: what you send through our contact form, pilot form or setup request form (including any files you attach), and emails you send us.

Data collected automatically

• Access log: each time someone opens a brand's POs or invoices, we record who (our team, a brand login, or a Shopify store), which brand, which PO or invoice, and when. It holds no PO contents. Shopify's rules for apps that handle buyer data ask for this log.
• Server logs: our hosting provider, Netlify, records standard technical data for each request, such as IP address, browser type, page requested and time. We use it only to run, secure and fix the service.
• Cookies and browser storage, described in section 16. We don't use analytics tools, advertising pixels, or tracking cookies, and our fonts are served from our own site.

4. How we use it, and our legal reasons

Some laws, such as the UK and EU GDPR, require a legal reason ("lawful basis") for each use. Here is each use and its basis.

• Running Orderseam for you: reading POs, matching lines to your catalog, creating draft orders, making and sending invoices and reminders, the weekly summary, and support. Basis: performing our contract with you. For your buyers' details, we act on your instructions as your processor.
• Service emails: login codes, PO notices, a reminder if you signed up but haven't sent a PO yet, and messages about your plan or these policies. Basis: our contract with you, and our legitimate interest in helping you use what you signed up for. These aren't marketing emails.
• Billing, tax and accounting records. Basis: our contract with you and our legal obligations.
• Security, preventing abuse, and fixing errors, including the access log, rate limits and error logs. Basis: our legitimate interest in keeping the service and your data safe, and legal obligations.
• Improving how Orderseam reads your orders, such as the buyer shorthand above and fixing a reading that went wrong. This happens inside your own account. We don't pool brands' data together.
• Writing to businesses about Orderseam (section 15). Basis: our legitimate interest in telling businesses about a product relevant to their work, with an easy way to say no.
• Legal reasons: complying with law, responding to lawful requests, and protecting our rights. Basis: legal obligation or legitimate interest.

We don't use your data for advertising, we don't build profiles of your buyers, and Orderseam makes no decisions about any person that have legal or similar effects on them.

5. AI processing

Orderseam uses Claude, an AI model made by Anthropic, to read the text, tables and handwriting in your order documents. The document is sent to Anthropic over an encrypted connection under Anthropic's Commercial Terms of Service, which don't allow Anthropic to train its models on our customers' content. Under Anthropic's published policy, it deletes these inputs and outputs from its systems within 30 days, except where it has to keep them longer to enforce its usage policy or to comply with the law.

We don't use your orders, catalog or buyers' details to train any AI model, ours or anyone else's. The AI reading is then checked against your catalog by Orderseam's own matching code. Any line Orderseam isn't sure about, such as an unknown size or variant or an unreadable line, is held for a person to check instead of being guessed.

6. Shopify

When you connect your Shopify store, Orderseam asks only for the permissions it needs: to read your products, stock levels and customers (so it can match buyers on POs to customers in your store), and to create draft orders. It doesn't confirm orders, charge anyone, change your products or change stock. Draft orders we create live in your own Shopify store, under your control and Shopify's privacy policy.

If you use the Orderseam app from the Shopify App Store, we also answer Shopify's privacy requests:

• When a buyer asks a store for their data (Shopify's "customer data request"), we send the store owner what Orderseam holds about that buyer, within 30 days.
• When a store asks us to delete a buyer's data ("customer redact"), we remove that buyer's details from the POs and records we keep for that store.
• When you uninstall the app, we stop using your store's access token at once and delete it. Shopify then sends a "shop redact" request 48 hours later, and we delete all of that store's data: POs and files, drafts, invoices, clients, settings, catalog and learned shorthand.

If you installed Orderseam from the Shopify App Store, Shopify bills you for it and handles that payment data under its own terms.

7. Service providers

These companies process data on our behalf, only to provide their service to us, under contracts that require them to protect it. This is the full list of providers that handle your order or account data:

• Anthropic, PBC (United States): reads order documents (section 5).
• Netlify, Inc. (United States): hosts the website and the Orderseam app, runs our code, stores your POs, files, drafts, invoices and settings (encrypted at rest), and receives our website forms.
• Postmark, run by ActiveCampaign, LLC (United States): receives the PO emails you forward to your Orderseam address, and sends Orderseam's emails, such as login codes, PO notices, buyer confirmations, invoices and reminders.
• Stripe, Inc. (United States): subscriptions, invoices and card payments for Orderseam plans. Stripe also uses some data as its own controller, for example to prevent fraud and meet financial rules, under the Stripe Privacy Policy.
• Shopify Inc. (Canada, with data processed in other countries): holds your store data and the draft orders we create, and bills App Store installs.
• Namecheap, Inc. (United States): hosts our team's mailbox, which receives messages from our contact form and replies to our emails.

We use social media scheduling and design tools to publish Orderseam's own posts. They receive no customer or buyer data. Our code is stored on GitHub without customer data.

We may also disclose data if the law requires it (for example, a valid court order), to protect someone's safety or our legal rights, or to a buyer of our business if it is sold or merged, in which case this policy, or one at least as protective, will continue to apply. Before we add or replace a provider that handles your order data, we'll update this list and email active brands first, so you can object or leave.

8. No selling, no sharing for ads

We don't sell personal data, and we don't "share" it for cross-context behavioral advertising, as those terms are defined in California law. We haven't done either in the past 12 months. We don't use your data or your buyers' data for our own marketing, and we don't combine it with data from other brands or other sources.

9. Where data is processed

We're based in the United States, and our providers process data mainly in the United States. If you're outside the US, your data, including your buyers' details, is transferred to and processed in the US, where it may be accessible to US courts and authorities under US law. For transfers from the UK, the EU or Switzerland, we rely on the safeguards the law allows, such as the European Commission's Standard Contractual Clauses and the UK's International Data Transfer Addendum, in the data processing agreement we sign with you on request, together with our providers' own transfer safeguards.

10. How long we keep it

• Your POs, files, catalog, drafts, invoices, clients and learned shorthand: while you use Orderseam. When your trial, pilot or plan ends, we disconnect from your store and delete them within 30 days, unless you ask us in writing to keep them so you can come back. You can ask us to delete them sooner at any time.
• Shopify App Store installs: deleted when Shopify sends the shop redact request, 48 hours after you uninstall.
• Your account: deleted with your other data, as above.
• Billing and tax records (invoices, payments, tax numbers): kept as long as tax and accounting law requires, usually up to 7 years. Stripe keeps its own records under its policy.
• Access log: 365 days, then deleted automatically.
• Login codes: 15 minutes.
• Server logs and email delivery records held by Netlify and Postmark: for the limited time set by those providers.
• Messages to our team: as long as the conversation is useful, and deleted on request unless we have to keep them for a legal reason.

Draft orders already in your Shopify store stay there, under your control. Copies in our providers' backups are removed on their normal backup schedules.

11. Security and breaches

We protect data with encrypted connections (HTTPS/TLS), encryption at rest in our storage, Shopify access tokens kept encrypted, verified signatures on every incoming webhook, and separate access for each brand. Only the people who run Orderseam can see brand data, and only to provide and support the service, and every look at a brand's POs is written to the access log.

No system is perfectly secure. If we learn of a breach that affects your data, we'll tell you without undue delay, and aim to do so within 72 hours of confirming it, with what happened, what data was involved and what we're doing, so you can tell your buyers if needed. We'll also notify regulators and Shopify where the law or Shopify's rules require.

12. Your rights

Wherever you are, you can ask us to:

• tell you what personal data we hold about you, and give you a copy, including an export of your POs, drafts and invoices;
• correct data that's wrong;
• delete your data;
• stop writing to you about Orderseam; and
• object to, or ask us to limit, a particular use.

Send requests through our contact form. We'll confirm the request comes from you (usually by writing to your account email), and answer within 30 days. Some laws let us take longer for complex requests; if so, we'll tell you why. We won't charge you, and we won't treat you differently for using your rights. If we can't do what you ask, we'll explain why, and you can ask us to reconsider by replying to our answer; we'll respond to that appeal within 60 days.

If you're a buyer whose details are on a brand's PO, the brand decides how your details are used, so please contact the brand first. If you contact us, we'll pass your request to the brand and help it answer.

13. US state privacy notice

Some US states, including California and Texas, have consumer privacy laws. Many of their duties apply only to larger businesses, and to people acting in a personal rather than a business role, but we give everyone the same choices. In the past 12 months we have collected these categories of personal information, from the sources and for the purposes in sections 3 and 4:

• identifiers, such as name, business email, phone number and IP address;
• commercial information, such as POs, invoices, plans and payments;
• professional information, such as the business someone works for and their role in an order; and
• internet activity, such as logins and server logs.

We disclosed these only to the service providers in section 7, for the business purposes described there. We don't collect sensitive personal information to infer anything about anyone, and we don't sell or share personal information, so there's nothing to opt out of. We also respect Global Privacy Control signals from your browser. As a service provider to brands, we process buyers' details only for the brand's business purposes, don't keep, use or disclose them outside our direct relationship with that brand, and don't combine them with personal information from other sources, except as the law allows.

You or someone you authorize can use the rights in section 12. If we don't resolve your concern, you can contact the Attorney General in your state, such as the Texas Attorney General, or the California Privacy Protection Agency.

14. UK, EU, Canada, Australia and New Zealand

If you're in one of these places, the data protection law where you are gives you rights over your personal data, including the rights in section 12 and, under the UK and EU GDPR, the rights to data portability and to withdraw consent where we rely on consent. 369 Delivery LLC is the controller for your account data and your processor for your buyers' details (section 2). We're established in the US and don't have an office in these countries. Section 9 explains transfers to the US, and Australian brands should note that we disclose data to the US providers in section 7.

Please contact us first so we can try to fix any concern. You also have the right to complain to your regulator: the Information Commissioner's Office (UK), your national data protection authority (EU), the Office of the Privacy Commissioner of Canada, the Office of the Australian Information Commissioner, or the Office of the Privacy Commissioner (New Zealand).

15. Brands we write to

We sometimes email a business at an address it publishes on its own website, or send a message through its contact form, to tell it about Orderseam. For this we keep only the business name, that address, public details from its website and any reply, and use them only for that conversation. Reply "no thanks" or contact us and we'll stop, keeping only a note not to write to that address again.

16. Cookies and browser storage

• os_session: keeps you logged in to your Orderseam account for up to 30 days, or until you log out.
• os_trial: lets a new account that's waiting for setup send our team a few sample POs, for up to 14 days. It isn't a login and opens nothing else.
• Browser storage: remembers that you're signed in (to show the right button on our home page) and which guided tours you've already seen. It stays on your device.

These are all strictly necessary for the features you use, so we don't ask for cookie consent. We use no analytics, advertising or third-party tracking cookies. Inside Shopify's admin, Shopify's own tools also run, under Shopify's policies.

17. Children

Orderseam is for businesses and isn't meant for anyone under 18. We don't knowingly collect data from children. If you think we have, contact us and we'll delete it.

18. Changes and contact

If we change this policy, we'll update the dates at the top. If a change materially affects how we handle your data, we'll email active brands at least 30 days before it takes effect, unless the law requires a faster change. Questions or requests go to our team through our contact form.

369 Delivery LLC, doing business as Orderseam, Texas, USA.