Actorly records what changed in your store. Here is what it keeps, where it runs, who else handles data, what it asks Shopify for and what happens to it when you leave.
For every field Actorly tracks, it keeps the old value, the new value, the time of the change and, when Shopify reports who made it, that name or app name together with how sure Actorly is. Unknown is a permanent and valid answer.
What is tracked is listed on the coverage page. Actorly cannot show changes made before it was installed or changes Shopify does not make available to apps.
Recording a change and working out who made it are done by fixed rules, not by artificial intelligence.
Shopify has approved Actorly for all four protected customer-data fields, so this page says what it holds. When a customer, an order or a draft order appears in a change Actorly records, it stores these personal details.
Actorly does not use customer data to contact customers or for marketing, does not sell it, and does not share it for advertising.
Actorly asks for 25 permissions: 20 read and 5 write. None is optional. Writes are only restores: every write to a store is one of the allowlisted restore fields, and the five write permissions map to those and to nothing else. A permission nothing uses is removed.
| Permission | What it lets Actorly do, and why |
|---|---|
| read_products | Products, variants and collections, so their changes are recorded and shown. |
| write_products | Put one product, variant or collection field back, only during a restore you confirmed. |
| read_inventory | Inventory levels, so stock changes are recorded. |
| read_locations | Locations, so changes to them are recorded. |
| write_locations | Put a location's name back during a confirmed restore. |
| read_markets | Markets, so changes to them are recorded. |
| write_markets | Put a market's name back during a confirmed restore. |
| read_discounts | Discounts, so changes to them are recorded. |
| read_files | The Files library, so file changes are recorded. |
| write_files | Put a file's alt text back during a confirmed restore. |
| read_content | Blogs, articles and pages. |
| read_online_store_navigation | Navigation menus and URL redirects. |
| read_themes | Theme names and which theme is published. |
| read_legal_policies | The store's refund, privacy, terms and shipping policies. |
| read_locales | The languages a store offers. |
| read_shipping | Shipping and delivery settings: profiles, zones and rates. |
| write_shipping | Put a shipping profile's name back during a confirmed restore. |
| read_publications | Which sales channels a product is published to. |
| read_orders | Orders: status, totals, tags, notes, shipping and billing addresses. |
| read_draft_orders | Draft orders. |
| read_customers | Customers: name, address, notes, tags, marketing consent. |
| read_customer_merge | Notices that two customers were merged. |
| read_fulfillments | Fulfillments: status, quantity, carrier name. Shopify splits fulfillment access across this and the next two permissions. |
| read_merchant_managed_fulfillment_orders | Fulfillment orders that the merchant manages. |
| read_third_party_fulfillment_orders | Fulfillment orders handled by third parties. |
ONDUTYOPS LLC is based in the United States. Cloudflare operates a global network and Actorly does not restrict its data to a country or region. Transfers from the EEA, the UK and Switzerland rely on the Standard Contractual Clauses in the data processing agreement.
Each store's change history is kept in its own separate database, one Cloudflare Durable Object per store. No query can reach another store's data, because there is no shared table to reach across. Account records, such as shop details and plan, are in a shared database and are always read by store.
Three companies handle data for Actorly. The same list is in the data processing agreement and the privacy policy.
Shopify is the platform Actorly runs inside and the source of the data. A webhook address you choose for alerts is yours.
A request from Shopify to erase a customer is carried out automatically. A request for a customer's data is not automatic: Actorly shows it to the store owner under Settings, Privacy in the app, who downloads what Actorly holds about that customer and replies within the 30 days Shopify allows. A request to erase a store's data arrives 48 hours after an uninstall.
Two things have a written rule but no recorded proof yet, so we do not claim them: a live customer erasure exercised end to end, and that no customer value survives in any saved snapshot.
Actorly runs on Cloudflare: the app runs on Workers and keeps its records in Durable Objects, D1 and Workers KV, and this website runs on Pages. The certifications below are Cloudflare's, stated by Cloudflare on the pages linked, and each applies as Cloudflare scopes it. Actorly itself holds no certification of its own; the infrastructure it runs on is Cloudflare's, certified as listed here. Cloudflare's reports and certificates are available from Cloudflare (its dashboard compliance documents, or its account team), not from Actorly.
Actorly holds no certification of its own; the infrastructure it runs on is Cloudflare's, certified as set out in the section above. We do not describe Actorly itself as certified or compliant with a standard. We do not describe the website as certified either.
The legal entity is ONDUTYOPS LLC, a Delaware limited liability company, Coastal Highway, Lewes, Delaware 19958, United States.
Email [email protected] with what you found and how to reproduce it. Please give us a reasonable time to fix it before sharing it publicly. We will confirm that we received it and keep you informed. We will not take legal action over good-faith research that stays within these limits: it does not reach another person's data beyond what shows the problem, it does not disrupt the service, and it stays private until we have fixed it.