Order Approval is operated by add-ons.org.
The app stores the merchant's approval rules and texts, the email templates and, the merchant's email provider settings: an SMTP server, or a Resend or SendGrid API key (passwords and keys encrypted). It reads the shop's name, email, currency and timezone, the tags and collections of products in submitted carts and orders, and the tags of logged-in customers. It writes the published settings to an app metafield so the storefront can show the approval button, registers a checkout validation function that refuses checkout for carts that need approval, and reads the published theme's settings to tell whether the app embed is switched on.
When a customer submits a cart for approval, the app stores the name, email address, phone number and note they typed, the items in the cart, and the approver's email address if one was given. The request is kept by the app only; nothing is created in the merchant's Shopify store until the customer pays through Shopify's checkout from the link sent on approval. When a paid order matches an approval rule, the app receives the order from Shopify and stores the customer's name, email, phone, note and the ordered items, and places a fulfillment hold on the order. This data is shown to the merchant in the app and used to email the customer about the request, to email the merchant and the approver, and to render the customer's status page. Emails are sent through the email provider the merchant chose: their own SMTP server, Resend or SendGrid. The app does not use any other email service.
A customer's request to erase their data received from Shopify (customers/redact) anonymises their approval requests. A shop's data erasure request (shop/redact, 48 hours after uninstall) deletes everything stored for that shop.
Paid plans are billed by Shopify through the merchant's Shopify invoice. The app never sees payment details.
Data is exchanged with Shopify and, if the merchant configures one, the merchant's email provider (their SMTP server, Resend or SendGrid), which receives the emails' recipients and content. No other service receives store or customer data.
Settings and requests remain until the merchant deletes them, or until the app is uninstalled and Shopify requests shop data erasure, at which point everything for that shop is deleted. Authentication sessions are deleted on uninstall.
For privacy questions, use the contact form.