In one place: our roles under data protection law, the rights you have, how to use them, how fast we answer, and how a deletion or a data request actually works.
Effective 2026-10-13. This page summarises and points to the privacy policy and the data processing agreement. If they differ from this page, they decide.
1.1Actorly is built and run by ONDUTYOPS LLC, a Delaware limited liability company with its registered address at Coastal Highway, Lewes, Delaware 19958, United States. It records the changes made in a Shopify store and shows who made them.
1.2This page covers three groups: merchants who install Actorly, customers of those merchants whose personal details appear in a change Actorly records, and visitors to the website at actorly.app.
1.3It does not repeat the privacy policy in full. The privacy policy lists what we hold, and the data processing agreement is the contract with the merchant.
Back to contents2.1For merchant account data, such as the store owner's name and email address, we are the controller. We decide why and how it is used, within the privacy policy.
2.2For the personal details of a store's customers, the merchant is the controller and we are the processor. We hold them only to run Actorly for that store, on the merchant's documented instructions, and not for our own purposes. We do not sell them, share them for advertising or use them to contact customers.
2.3Shopify is a separate party with its own role. A merchant that has checked Shopify has not thereby checked Actorly. Each app is its own processor relationship, with its own data, its own subprocessors and its own duties.
Back to contents3.1Under Article 28 of the GDPR we process only on the merchant's instructions, keep our people and subprocessors to confidentiality, apply the security measures in the data processing agreement, use subprocessors only on the merchant's general authorisation with a right to object, help the merchant answer data subject requests and meet its own duties, delete or return the data when the service ends, and give the merchant the information it needs to check us.
3.2The data processing agreement sets these out. A merchant accepts it by installing Actorly, and can ask for a signed copy at [email protected].
Back to contents4.1For customers, Actorly stores some personal details when they appear in a change it records: a name (or the email address Shopify uses as the name), whether the customer agreed to email or text marketing, the default address, the shipping and billing addresses on an order with the phone numbers on them, and the notes on a customer, an order or a draft order.
4.2We do not fetch a customer's account email address or account phone number, payment details, card numbers, tracking numbers, or browsing or storefront behaviour. Billing runs entirely through Shopify, so we never see a card number.
4.3We do not ask for or infer special category data (Article 9) or criminal offence data (Article 10). Free-text notes are whatever a person typed into Shopify, so please do not put such data in them.
Back to contents5.1Merchant account data: performance of the contract with the merchant. Support messages: the contract and our legitimate interest in answering. Security and fault finding: our legitimate interest in keeping the service safe. Product event counts: none are sent today; if they were switched on, our legitimate interest in understanding use of the service. Legal duties and claims: legal obligation and legitimate interest.
5.2Customer data: we are the processor, so the merchant's own lawful basis for running its store applies, and we act on its instructions.
5.3The website sets no cookie for visitors and runs no analytics, so it relies on no consent.
Back to contents6.1Depending on where you live, you may have the right of access, to rectification, to erasure, to restrict processing, to data portability, to object, to withdraw consent, not to be subject to a decision based only on automated processing, and to complain to a supervisory authority.
6.2Actorly makes no automated decision with legal or similarly significant effect on anyone. Recording a change and working out who made it are done by fixed rules, not artificial intelligence. Who made a change is shown as a correlation with a confidence, and Unknown is a permanent answer.
Back to contents7.1Merchants and website visitors: write to [email protected] from the address we hold for the store, and say what you want. We may ask you to prove who you are. We acknowledge the request and respond within 30 days, or sooner where the law sets a shorter time. Where the law allows an extension, we will tell you why before the 30 days end.
7.2Customers of a store: contact the store you bought from first. It is the controller of your data, and we help it carry out your request. If you write to us instead, we pass the request to the store or tell you whom to contact.
7.3We do not charge for a request unless the law lets us, for example where it is repeated and manifestly excessive.
Back to contents8.1Customer erasure request. Automatic. Actorly removes that customer's personal values, and the personal values on the orders the request names, from the change history. Afterwards it keeps the customer's Shopify ID, the time of the erasure and the numbers of that customer's orders until the store's data is erased, so the details are not stored again. Details on a draft order are erased when the store's data is erased.
8.2Customer data request. Not automatic. Actorly receives it and shows it to the store owner under Settings, Privacy in the app. The store owner downloads a file of what Actorly holds about that customer and replies to the customer. Shopify allows 30 days, and an overdue banner shows in the app past the deadline.
8.3Store erasure request. Shopify sends it 48 hours after an uninstall. Actorly then erases the store's change history, its account records and its stored evidence, and lists the stored evidence again to confirm that none is left. Reinstalling within the 48 hours keeps everything.
8.4Two things have a written rule but no recorded proof yet, so we do not claim them: a live customer erasure exercised end to end, and that no customer value survives in any saved snapshot.
Back to contents9.1On Watch, history is kept 90 days. On Restore it is kept for as long as the store stays on Restore and Actorly stays installed. After a move from Restore to Watch, history older than 90 days is deleted after 14 days' notice. Export files are deleted 3 days after they are built. Support messages are kept up to 3 years after your last contact. The privacy policy has the full table.
Back to contents10.1We are based in the United States, and Actorly's data is stored and processed on Cloudflare's global network without a country or region restriction. For personal data from the EEA, the UK or Switzerland we rely on the Standard Contractual Clauses (Module Two), the UK Addendum and the Swiss changes, set out in the data processing agreement. Our subprocessors, listed on the subprocessors page, rely on their own safeguards.
Back to contents11.1Cloudflare encrypts stored data at rest, and calls to Shopify and to alert addresses use HTTPS. Each store's history is in its own separate database. Webhooks from Shopify are verified before use. The security page has the controls.
11.2If we become aware of a personal data breach affecting customer data, we tell the affected merchant without undue delay, so that it can meet its own duty to notify its authority within 72 hours where Article 33 applies. Where the GDPR requires us to notify a supervisory authority of a breach of data we hold as controller, we do so within 72 hours.
11.3Actorly holds no security certification of its own. Cloudflare's certifications are Cloudflare's, as the security page sets out.
Back to contents12.1We have not appointed a data protection officer or a representative in the European Union or the United Kingdom. Write to [email protected] about any matter one of them would handle.
12.2You can complain to a supervisory authority in the country where you live or work or where the alleged infringement happened, without contacting us first. In the United Kingdom that is the Information Commissioner's Office (ico.org.uk). In the European Union it is your national data protection authority, listed at edpb.europa.eu. In Switzerland it is the Federal Data Protection and Information Commissioner.
Back to contents13.1We apply the same care everywhere. Depending on where you live, further rights may apply, for example under the California Consumer Privacy Act as amended, or other US state laws. We do not sell personal information and do not share it for cross-context behavioural advertising, so there is nothing to opt out of. For a store's customers we act as the merchant's service provider.
Back to contents14.1We will update this page as our processing, our subprocessors or the law change, with a new effective date, and tell merchants directly of a material change. This page takes effect on 2026-10-13.
Back to contents15.1ONDUTYOPS LLC. Email: [email protected]. Postal address: Coastal Highway, Lewes, Delaware 19958, United States.
Back to contents