Privacy policy

Pomelo by Vanilla Builds · Last updated 23 October 2026

Pomelo (PO to Draft Order) is a Shopify app made by Vanilla Builds (Pty) Ltd (Cape Town, South Africa). It reads wholesale purchase orders a merchant uploads and turns them into Shopify draft orders. This policy explains what personal data the app processes, why, and for how long. Contact: jordan@vanillabuilds.com.

Our role

For the personal data of a merchant's buyers and customers, the merchant is the controller and Vanilla Builds processes it on the merchant's behalf and instructions. For the merchant's own staff account details, Vanilla Builds is the controller.

What we process and why

• Purchase orders the merchant uploads, which can contain a buyer's name, company, email, phone and addresses. Used only to extract the order and create the draft order. The uploaded file itself is not stored.
• Purchase orders emailed to the merchant's forwarding address: the sender's email address, the subject, and the attachment or email text. The attachment or text and the extracted order are kept until the merchant creates the draft order or dismisses it, and for at most 30 days, so the merchant can compare the two.
• Shopify customer records (name, email, phone, address): looked up by the buyer's email and, if the merchant chooses, created, so the draft order is attached to the right customer.
• B2B company records (company and location names): if the buyer is a contact at a company in the merchant's Shopify B2B setup, its locations are looked up so the merchant can place the draft order for the company. We don't store them.
• Notification emails: when an emailed purchase order is ready or couldn't be read, we email the store's contact address with the email's subject and sender, and a link to the app. Merchants can turn these off on the Inbox page.
• Order history: PO number, buyer company or email, the draft order created and its total, shown on the app's history page.
• Learned item codes: when a merchant matches a buyer's item code to a product, we remember it for that buyer, keyed by the buyer's email or company.
• Merchant account data: the shop domain and Shopify session needed to run the app, and the ID of the staff member using it (for the access log).
• Security and usage records: an access log of who viewed or changed customer data, and which AI models read each PO and what it cost (no PO contents).

We do not sell personal data, use it for advertising, or use it to train AI models.

Who processes it for us (subprocessors)

• Shopify: the platform the app runs in; customer and order records live there.
• Anthropic (Claude API, USA): reads each uploaded PO to extract its contents. Anthropic does not train on this data and keeps API inputs and outputs for up to 30 days.
• Fly.io (USA): hosts the app.
• Neon (AWS us-east-1, USA): hosts the app's database.
• Postmark (ActiveCampaign, USA): receives emails sent to merchants' forwarding addresses and passes them to the app, and sends the app's notification emails to merchants.

Data is therefore processed in the United States. Where the law requires it, transfers rely on the safeguards these providers offer, such as standard contractual clauses.

How long we keep it

• Uploaded PO files: not stored by us; Anthropic keeps them for up to 30 days.
• Emailed purchase orders: the attachment or text and the extracted order until the draft order is created or the item is dismissed, and for at most 30 days.
• Order history and access logs: 365 days.
• Copies of a customer's data prepared for a data request: until sent to the merchant, then 30 days.
• Learned item codes: until the merchant uninstalls or the customer's data is deleted.
• Everything for a shop: deleted 48 hours after the app is uninstalled.

Your rights

Customers of a merchant should contact that merchant to access, correct or delete their data; Shopify passes those requests to us and we act on them within 30 days. Merchants and their staff can contact us directly at the email above. You may also complain to your data protection authority; in South Africa that is the Information Regulator (inforegulator.org.za).

Security

Data is encrypted in transit and at rest, access is limited to the app and its developer and is logged, and we follow a written incident response policy, including notifying affected merchants within 72 hours of confirming a breach.

Changes

We will post changes here and tell merchants about material ones in the app or by email.