What Actorly collects when you install it, where it comes from, why it is used, who handles it, how long it is kept, and how to have it deleted or to use your rights.
Effective 2026-10-13. This policy replaces any earlier version.
1.1Actorly is made by ONDUTYOPS LLC, a Delaware limited liability company with its registered address at Coastal Highway, Lewes, Delaware 19958, United States. This policy explains how Actorly handles personal data. Questions, requests and complaints go to [email protected], where the company's privacy contact reads them.
1.2This policy covers three groups of people. Merchants, meaning the people and businesses that install Actorly in a Shopify store. Customers of those stores, whose personal details appear in a change Actorly records. And visitors to the Actorly website at actorly.app.
1.3It does not cover Shopify, Cloudflare or any other company's own handling of data. Their policies apply to what they do.
Back to contents2.1For the personal data of merchants, such as the store owner's name and email address, Actorly decides why and how it is used. In privacy-law terms we are the controller of that data.
2.2For the personal data of a store's customers, the merchant decides why it is used, and Actorly holds and handles it on the merchant's behalf to run the service for that store. In privacy-law terms the merchant is the controller and we are the processor. The data processing agreement sets out that relationship.
2.3A customer who wants to use a right over data held in a store should contact the store first. We help the merchant answer, and Shopify's own privacy requests, described in section 16, are how most requests reach us.
Back to contents3.1When you install Actorly, and while you use it, Shopify gives us the following information about your store and about you, and we keep it to run the app and to contact you about it.
3.2The website at actorly.app has no account and no contact form. It shows the email address above, and what you send us there is kept as support correspondence.
Back to contents4.1Actorly records the fields it tracks, listed on the coverage page, and their old and new values when they change, with the time of the change and, when Shopify reports who made it, that name or app name.
4.2Most of this is business information such as product titles, prices and settings. Some of it is personal data about your customers. Actorly stores some personal details about your customers when they appear in a change it records, as the next section lists.
4.3Actorly does not read a customer's account email address or account phone number, payment details, card numbers, tracking numbers, or browsing or storefront behaviour. It adds no script, pixel or tracking code to your storefront and shoppers load nothing from Actorly.
Back to contents5.1Shopify has approved Actorly for all four protected customer-data fields, so we say what we hold. These are the personal details Actorly stores about a store's customers, and where they come from.
| Kind of record | Personal details stored |
|---|---|
| Customers | First and last name (or, for a customer with no name, the email address Shopify uses as the name); the customer note; tags; whether the customer agreed to email and text marketing (the state, not the address it applies to); and the default address: name, address lines, city, region, country, postcode and phone. |
| Orders | The order note, which is free text and may contain anything; the shipping address and the billing address on the order: name, lines, city, region, country, postcode and phone. The order's status, totals and tags are not personal. |
| Draft orders | The draft order note. |
| Fulfillments | Status, quantity, the carrier's name and the order number. The tracking number and the delivery address are not stored. |
| Staff and apps | The display name Shopify gives for the staff member or app a change was matched to. |
5.2These values are stored inside the store's own change history. Order notes and addresses are hidden from the merchant's screens and shown as redacted in exports, with the fact and time of the change kept. Customer values are visible to the store owner on their own screens.
5.3Before Actorly saves its evidence copy of a notification from Shopify, it strips a list of personal keys at every depth, including customer, email, phone, billing and shipping address, notes and tokens. This is a list of named keys and not a guarantee that no personal value remains in any saved copy. Actorly never reads the notice's body to decide what changed. It asks Shopify again for the record, and the personal values above come from that second read.
5.4We do not use customer data to contact customers or for marketing.
Back to contents6.1Billing is done by Shopify. Actorly does not take payment, has no billing screen, and does not receive your card number or other payment details. We know which plan a store is on and its billing interval, and nothing about how it pays.
6.2Actorly does not process customers' payment details either. The service does not fetch them.
Back to contents7.1From you: when you install Actorly, approve its permissions, choose a plan, set an alert destination, confirm a restore, or write to us.
7.2From Shopify: store details, the owner's details, the change notifications Shopify sends, the records Actorly asks Shopify to return, Shopify's activity log used to work out who made a change, and Shopify's privacy requests.
7.3From the website: nothing beyond what our web host needs to deliver the pages, as section 19 says.
7.4From our own service: nothing about how you use Actorly is sent to a product analytics service today. If product analytics were switched on, it would be counts and durations only, and we would give notice first.
Back to contents8.1We use the data in this policy for the following purposes, and for no purpose that is not listed.
8.2We do not sell data. We do not share it for advertising. We do not use it to profile your customers.
Back to contents9.1Where the law asks us for a legal basis, we rely on these.
| Purpose | Legal basis |
|---|---|
| Running Actorly for your store, including recording and restoring | Performance of the contract with you |
| Customer data held for a store | Processing on the merchant's instructions, as processor. The merchant's own legal basis is the merchant's to state. |
| Service messages and support | Performance of the contract, and our legitimate interest in answering you |
| Security, fault finding and abuse prevention | Our legitimate interest in keeping the service safe and working |
| Product event counts, if ever switched on | Our legitimate interest in understanding use of the service. None are sent today. |
| Legal duties and claims | Legal obligation, and our legitimate interest in defending claims |
| The sign-in cookie for our own site editors | Our legitimate interest in letting our staff sign in securely. It is a strictly necessary cookie. The website sets no other cookie. |
10.1We share data only as follows.
10.2We do not sell personal data and do not share it for cross-context advertising.
Back to contents11.1Three companies handle data for Actorly. The list is the same in the data processing agreement and the security page.
| Company | What it does for Actorly | What it receives |
|---|---|---|
| Cloudflare, Inc. | Hosts Actorly and stores its data: the app itself, each store's change history, saved copies of what Shopify sent, and Actorly's account records. | Everything described in the data table of the privacy policy. |
| PostHog | Counts product events about Actorly itself, for example that a plan was chosen or a first import finished. Not in use today: used only if product analytics is switched on, with notice first. | Nothing today. If switched on: the store's myshopify.com domain, the plan name, counts and durations. No customer data and no store content. |
| Slack | Delivers operational notices to Actorly's own team workspace, so the team sees when an install or an import needs attention. | The store's myshopify.com domain and a short status. No customer data and no store content. |
11.2Shopify is the platform Actorly runs inside and the source of the data. It is not listed above as a subprocessor.
11.3Actorly does not currently send product analytics to PostHog or to anyone else. PostHog is listed so that the list is complete if that changes: it would be used only if product analytics were switched on, and we would give notice before that happens. If it were switched on, an event would carry only the store's myshopify.com domain, the plan name and billing period, and counts or durations, from a fixed list of events. Anything else is dropped before it is sent.
11.4When we add or replace a subprocessor, we update this list, the data processing agreement and the security page, and tell merchants in advance, in the app, through Shopify or by email to the store owner, before the new subprocessor starts to process data. A merchant with a reasonable data protection objection can write to us before the date in the notice. We will work with the merchant in good faith, which may include not routing its data to that subprocessor, or letting it end the affected part of the service without penalty.
Back to contents12.1ONDUTYOPS LLC is based in the United States, and Actorly's data is stored and processed on Cloudflare's network, which is global. We do not restrict Actorly's data to a country or a region, so it may be handled in more than one country.
12.2Where personal data from the European Economic Area, the United Kingdom or Switzerland is transferred to the United States or another country without an adequacy decision, we rely on the Standard Contractual Clauses, the UK Addendum and the Swiss changes set out in the data processing agreement. Our subprocessors rely on these safeguards.
| Subprocessor | Transfer mechanism |
|---|---|
| Cloudflare | EU Standard Contractual Clauses, incorporated into Cloudflare's own customer-facing addendum |
| PostHog | Not in use today. If switched on: EU Standard Contractual Clauses (Module Two), and the UK Addendum for UK data, in PostHog's data processing addendum |
| Slack | EU Standard Contractual Clauses in Slack's data processing addendum |
12.3You can ask for a copy of the safeguards by writing to [email protected].
Back to contents13.1These are the periods that apply.
| What | How long |
|---|---|
| Change history on Watch | 90 days (about 3 months). Older rows are deleted by a rolling purge. |
| Change history on Restore | Kept for as long as the store stays on Restore and Actorly stays installed. |
| Moving from Restore to Watch | History older than 90 days is deleted after 14 days' notice, once and for all. Moving back to Restore does not bring it back. If the plan cannot be confirmed, nothing is deleted. Saved evidence copies are not purged on a downgrade in this version; they go when the store's data is erased. |
| Uninstall | Shopify tells Actorly at once and sends a store-erasure request 48 hours later. Actorly then erases the store's change history, account records and stored evidence and checks that none is left. Reinstalling within the 48 hours keeps everything. A store that is installed is never erased. |
| A customer erasure request from Shopify | Handled automatically. Actorly removes that customer's personal values and the personal values on the orders the request names. Details on a draft order go when the store is erased. Afterwards Actorly keeps the customer's Shopify ID, the time of the erasure and the numbers of that customer's orders until the store's data is erased, so the details are not stored again. |
| Export files | Deleted 3 days after they are built. |
| Merchant account records | Until the store is erased after uninstall, unless the law requires a record to be kept longer, and then only that record. |
| Support messages | Up to 3 years after your last contact with us. |
| Website records | We keep none of our own about visitors. Our web host, Cloudflare, may log requests to serve and protect the site under its own terms. A site editor's sign-in session lasts 8 hours. |
13.2A merchant who wants earlier deletion can write to [email protected] from the store owner's address and name the store. We confirm the request and carry it out within 30 days.
13.3Two things have a written rule but no recorded proof yet, so we do not state them as proven: that a live end-to-end customer erasure has been exercised on a store, and that no customer value survives in any saved snapshot.
Back to contents14.1Stored data is encrypted at rest by Cloudflare, and calls to Shopify and to a merchant's alert address use HTTPS. We say "Cloudflare encrypts it" because that is Cloudflare's published statement about its storage, and not a separate claim of our own.
14.2Each store's change history is kept in its own separate database, so no query reaches another store's data because there is no shared table to reach across. Account records are in a shared database and are always read by store.
14.3Webhook requests from Shopify are verified before they are used. Alert webhooks that Actorly sends are signed. A webhook signing secret is stored encrypted.
14.4Actorly asks Shopify only for the permissions it uses, and the five write permissions are used only to put back a field during a restore you confirmed. It adds nothing to your storefront.
14.5The app's high-risk code is read by a security review step in our own process. That is an internal practice and not a certification. Actorly holds no certification of its own; the infrastructure it runs on is Cloudflare's, certified as set out in the next section. We do not describe Actorly itself as certified or compliant with any standard.
14.6More is on the security page and in the annex to the data processing agreement.
Back to contents15.1Depending on where you live, you may have the right to: know whether we hold your personal data and receive a copy; correct it; have it erased; restrict or object to how we use it; receive it in a portable format; withdraw consent where we rely on consent; and not be subject to a decision based only on automated processing that has legal or similarly significant effects.
15.2Actorly does not make a decision of that kind. Who made a change is a correlation shown with a confidence, and it is not used to decide anything about a person by itself.
15.3To use a right over data we hold as controller, such as a merchant's account details, write to [email protected] from the address we hold for the store, and say what you want. We may ask you to prove who you are. We respond within 30 days, or sooner where the law sets a shorter time.
15.4We do not charge for a request unless the law lets us, for example where it is repeated and manifestly excessive.
15.5You can refuse or withdraw consent at any time where we rely on consent. Withdrawing does not affect what happened before.
Back to contents16.1If you are a customer of a store that uses Actorly and want to use a right over your data, contact the store first, because the store decides how your data is used. We help the store carry out your request.
16.2Shopify sends Actorly two kinds of privacy request about customers. A request to erase a customer's data is carried out automatically: Actorly removes that customer's personal values, and the personal values on the orders the request names. A request for a customer's data is not automatic. Actorly receives it and shows it to the store owner under Settings, Privacy in the app. The store owner downloads a file of what Actorly holds about that customer and replies to the customer. Shopify allows 30 days, and an overdue banner shows in the app past the deadline.
16.3A third request, to erase a store's data, is sent 48 hours after an uninstall and removes everything for that store.
16.4If you write to us instead, we will pass your request to the store or tell you who to contact. Our address is [email protected].
Back to contents17.1Actorly is for people who run businesses and is not directed at children. We do not knowingly collect personal data from children through the service. If a store's customer data includes a child, that is the store's responsibility. If you think we hold a child's data that we should not, write to [email protected] and we will delete it. We do not knowingly collect personal data from anyone under the age of 16, or under the age of digital consent in their country if that is higher.
Back to contents18.1Recording a change, and working out who made it, are done by fixed rules and not by artificial intelligence. The service does not depend on artificial intelligence to function.
18.2Who made a change is shown as a correlation with a confidence, from a fixed set of words, and Unknown is a permanent answer. It is not a decision about anyone.
Back to contents19.1The Actorly website at actorly.app is a separate thing from the app, and the cookie policy at actorly.app/cookies covers it in full. The website uses no analytics, no advertising cookies and no tracking pixels, and it sets no cookie for visitors.
19.2The only cookie the website ever sets is act_admin_session, for our own site editors after they sign in with an emailed link. It is strictly necessary, it lasts 8 hours, and it is marked HttpOnly, Secure and SameSite=Lax. A visitor who is not signed in as an editor never receives it. Because the website sets nothing else, it shows no cookie banner and keeps no record of cookie choices.
19.3The app inside the Shopify admin runs inside Shopify's own embedded app session, which Shopify provides and manages. Actorly adds no cookie, script or pixel to your storefront. You can control cookies in your browser settings, and blocking the editor's cookie only stops an editor from signing in.
Back to contents20.1If we become aware of a breach of security that leads to the accidental or unlawful destruction, loss, alteration, disclosure of or access to personal data, we will investigate it, tell the affected merchants without undue delay, and tell regulators where the law requires it.
20.2Where the GDPR requires us to notify a supervisory authority of a breach of data we hold as controller, we do so within 72 hours of becoming aware of it. For a breach of customer data we hold as processor, we tell the affected merchant without undue delay, so that the merchant can meet its own 72-hour duty as controller.
20.3Merchants are responsible for telling their own customers where the law requires it, and we will give the information the merchant needs to do so.
Back to contents21.1The website does not track visitors, so there is nothing for a Do Not Track or Global Privacy Control signal to switch off, and it behaves the same whether or not your browser sends one. We will update this section if that changes.
Back to contents22.1European Economic Area. Where the EU General Data Protection Regulation applies, the rights in section 15 apply, and you may complain to your local data protection authority.
22.2United Kingdom. Where the UK GDPR applies, the same rights apply, and you may complain to the Information Commissioner's Office at ico.org.uk.
22.3California and other US states. Where a state privacy law such as the California Consumer Privacy Act as amended by the California Privacy Rights Act applies, you may have the right to know what personal information is collected, to delete it, to correct it, to opt out of sale or sharing, and not to be treated worse for using a right. We do not sell personal information and do not share it for cross-context behavioural advertising, so there is nothing to opt out of.
22.4For the personal information of a store's customers, we act as the merchant's service provider or processor, and we use it only to provide Actorly to that store.
22.5To use a right under any of these laws, write to [email protected]. An authorised agent may write for you if you prove they act for you.
22.6We have not appointed a representative in the European Union or the United Kingdom. Write to us at [email protected] about any matter that a representative would handle.
Back to contents23.1Please contact us first at [email protected] and give us a chance to put it right. You also have the right to complain to a data protection authority, for example in the country where you live or work.
Back to contents24.1We will post changes on this page with a new effective date. For a material change, we will also tell merchants through the app, Shopify or by email to the store owner, a reasonable time before it takes effect.
24.2This policy takes effect on 2026-10-13. If you keep using Actorly after a change takes effect, you accept the revised policy.
Back to contents25.1To be plain about the edges of the service, Actorly does not collect any of the following through the app.
25.2Free-text notes on a customer, an order or a draft order are different: they are whatever a person typed into Shopify, and Actorly stores them when they change. Please do not put special categories of personal data, such as health information, in those notes.
Back to contents26.1Stored personal values are marked as protected inside Actorly. Order notes and addresses are hidden from the merchant's screens and are shown as redacted in exports, while the fact and time of the change are kept, so you can still see that a note or an address changed.
26.2Customer values, such as a name or a default address, are visible to the store owner on their own screens, because the store owner already holds them in Shopify.
26.3Who in your business can open Actorly is decided by Shopify and by you. We do not add or remove people from your store's Actorly.
Back to contents27.1Shopify is the platform Actorly runs inside, the place you install it, the way you are billed, and the source of the data Actorly stores. Shopify has its own privacy policy and its own role as a controller of the data in your store.
27.2Shopify tells Actorly when you install, when you uninstall, when a customer asks for their data or for erasure, and when a store's data must be erased. Actorly acts when each notice arrives and does not promise Shopify's timing beyond what this policy states.
27.3A customer data request that Shopify forwards is shown to the store owner. We do not answer a customer directly unless the store asks us to.
Back to contents28.1If an authority asks us for personal data we hold, we will check that the request is valid, give only what the law requires, and, where the law permits and it concerns a merchant's data, tell the merchant first so that it can object.
28.2We do not currently publish a transparency report.
Back to contents29.1The website and the app may link to Shopify, Cloudflare and other sites. We do not control them and this policy does not cover them. Read their policies before you give them personal data.
Back to contents30.1Actorly runs on Cloudflare: the app runs on Workers and keeps its records in Durable Objects, D1 and Workers KV, and this website runs on Pages. The certifications below are Cloudflare's, stated by Cloudflare on the pages linked, and each applies as Cloudflare scopes it. Actorly itself holds no certification of its own; the infrastructure it runs on is Cloudflare's, certified as listed here. Cloudflare's reports and certificates are available from Cloudflare (its dashboard compliance documents, or its account team), not from Actorly.
31.1ONDUTYOPS LLC. Email: [email protected]. Postal address: Coastal Highway, Lewes, Delaware 19958, United States.
31.2We have not appointed a data protection officer. Questions about this policy go to the company's privacy contact at the address above.
Back to contents