Privacy policy

Privacy policy

Last updated: 26 May 2026 · Version 0.1

1. Who we are

“Unified Orders”, “we”, “us”, “our” refers to Unified Orders, an unincorporated trading name operating from the United Kingdom. We intend to incorporate as a UK limited company; this policy will be updated with the company number and registered address once that happens.

For privacy and data protection enquiries, email privacy@unifiedorders.com.

We intend to register with the UK Information Commissioner’s Office (ICO) under the Data Protection Act 2018 before general public launch. Once registered our ICO registration number will appear here.

2. Scope — what this policy covers

This policy covers personal data we handle in three roles:

• As a data controller for visitors to our website, prospective customers, and the staff of our paying customers who sign in to the platform. We decide what data we collect from these people and why.
• As a data processor for the buyer information our customers’ sales channels (Amazon, eBay, Shopify, etc.) send into our platform. The customer is the controller of their buyers’ data; we process it on their instructions under our Data Processing Agreement.
• As a data controller for limited operational logs — audit trails, security events, billing — even where those records relate to actions performed on buyer data.

3. Data we collect about platform users (your staff)

3.1 Account & profile

• Name, work email address, job title, optional phone number, optional profile photo.
• A bcrypt hash of your password (we never see or store the password itself).
• If you enable multi-factor authentication: an encrypted TOTP secret and bcrypt hashes of single-use backup codes.
• Your role within the tenant (owner, admin, member) and any per-feature permission overrides.
• Your UI preferences and saved view settings.

3.2 Sessions & security

• For each active session: a refresh token, a hashed device fingerprint (browser + IP), the parsed device/browser name, the IP address you connected from, and last-active and expiry timestamps.
• If you enable security alerts, we keep a record of the country a login came from (looked up locally from your IP using an offline geolocation database) to detect unusual logins.
• Audit trail of state-changing actions you perform inside the platform — what changed, when, and from which IP.
• Short-retention HTTP request logs (method, path, status, duration, IP, user-agent) kept for 7–30 days for operational debugging.

3.3 Billing

• If your organisation is a paying customer: invoices, billing periods, and operational metrics that determine the bill (e.g. picks performed, storage consumed). We do not store payment card numbers — card details are handled by our payment processor.

4. Data that flows through from sales channels (end buyers)

When you connect a channel (Amazon, eBay, Shopify, WooCommerce, BigCommerce, Magento, TikTok Shop, or others we support), that channel sends us order data so we can present, fulfil, and sync it. For each buyer associated with an order we may receive and store:

• Name, email, phone, username (where the channel exposes one).
• Shipping and billing addresses, including full names, company, street, city, region, postcode, country, phone.
• The order itself: items, quantities, prices, tracking numbers, refunds.
• Messages between you and the buyer that the channel relays into our unified inbox — subject, body, attachments, message IDs.
• Derived signals from those messages such as classifier sentiment and intent scores (see section 7).
• An aggregated view: how many orders/messages each buyer has had with you, total spend, first-seen and last-active timestamps.

We are a processor for this category of data. Our customer (the seller using the platform) is the controller. We process this data only on their instructions and under the terms of our Data Processing Agreement.

5. Legal bases for processing

Under UK GDPR / EU GDPR we need a lawful basis to process personal data. The bases we rely on are:

• Performance of a contract — processing data about your staff accounts to deliver the service you’re paying for; processing buyer order data as instructed by our customer under the DPA.
• Legitimate interests — security logging, anomaly detection, audit trails, fraud prevention, and the operational logs needed to keep the platform running. We balance these interests against your privacy rights and limit collection to what we genuinely need.
• Legal obligation — retaining records required by tax law, accounting standards, or law enforcement requests where applicable.
• Consent — for any optional features that go beyond the above (e.g. marketing emails). You can withdraw consent at any time.

6. How we use personal data

• To authenticate you and keep you signed in.
• To present orders, inventory, messages, and warehouse operations to authorised users within your tenant.
• To push order updates, tracking numbers, and inventory levels back to your connected channels.
• To deliver buyer messages on your behalf via email, channel APIs, or other configured providers.
• To detect unusual logins and notify account owners.
• To produce billing invoices based on platform usage.
• To investigate security incidents and respond to support enquiries.
• To improve the platform — we may look at aggregated, anonymised usage patterns.

7. AI processing of personal data

Some features of the platform use large language models (LLMs) to summarise buyer messages, suggest replies, classify sentiment and intent, generate listing copy, recommend categories, and assist with admin tasks. To do this, content you provide — including buyer messages and order details — may be transmitted to a third-party AI provider.

By default we route AI requests through OpenRouter, which in turn may forward requests to various downstream model providers including those located outside the UK and EEA (such as the United States and, depending on the chosen model, jurisdictions including China). Tenants can opt to nominate a specific provider in their settings (for example, Anthropic Claude or Google Gemini directly).

We do not allow AI providers to use your data to train their models where the provider offers an opt-out, and we record cost-tracking metadata about each AI call (model, token count, latency) but do not retain a persistent copy of the prompt content beyond the operational activity log.

8. Who we share data with

We share personal data only with the third-party services required to deliver the platform. The complete current list, including the type of data and the country each service operates from, is published at /sub-processors and is updated as sub-processors change.

Categories include:

• Hosting & storage — Railway (application + database), Cloudflare (edge, R2 object storage, marketing site).
• Sales channels — Amazon SP-API, eBay, Shopify, WooCommerce, BigCommerce, Magento, TikTok Shop (data flows both ways).
• Email & messaging — Postmark, Google (Gmail / Workspace), Microsoft (Outlook / Microsoft 365), Meta WhatsApp Cloud API.
• AI providers — OpenRouter and downstream model providers; or a specific provider the customer nominates.
• Optional integrations — e.g. Firebase Realtime Database for eBay webhook bridging if configured.

We do not sell personal data to anyone. We do not share it with advertising networks. We will disclose data to law enforcement only where compelled by valid legal process.

9. International transfers

Because our hosting (Railway) and several sub-processors operate primarily from the United States, and because AI processing may reach providers in other jurisdictions, personal data is routinely transferred outside the UK and EEA. We rely on the following safeguards:

• UK-US and EU-US Data Privacy Framework where the recipient is certified.
• Standard Contractual Clauses (SCCs) with the UK Addendum where required.
• The provider’s own GDPR-compliant terms and Data Processing Addendums.

Where a transfer reaches a jurisdiction without an adequacy decision (for example certain AI providers reached via OpenRouter), the customer is responsible for ensuring their own obligations are met — we surface this in section 7 above and via tenant-level AI provider settings.

10. Retention & deletion

• Buyer personal data is automatically scrubbed 30 days after order dispatch. Names, emails, phone numbers, full addresses (the outward half of the postcode is retained for shipping analytics), and message contents are nulled out. The order shell remains for seller accounting purposes but contains no buyer-identifying detail.
• Activity log entries (audit trail of state-changing actions) are retained for the life of the tenant account or as required by law.
• HTTP request logs are retained for 7–30 days for operational debugging.
• Sessions are deleted automatically once they expire or are revoked, and cleaned up by a daily background job.
• Channel API call logs are retained for approximately 30 days.
• User accounts are retained for as long as your organisation is a customer. When a customer ends service we delete or anonymise account data within 90 days, except where retention is legally required (e.g. tax records for 6 years).

11. Security

We implement the following security controls:

• Passwords stored as bcrypt hashes (cost factor 12).
• Multi-factor authentication available to all users; TOTP secrets and backup codes encrypted at rest with AES-256-GCM.
• Channel OAuth tokens and API credentials encrypted at rest with AES-256-GCM.
• JWT-based authentication with short-lived access tokens (15 minutes) and rotating refresh tokens.
• Per-session device fingerprinting and IP recording; logins from new countries trigger optional security alerts.
• Activity log of state-changing actions and a separate log of accesses to buyer personal data.
• Tenant-scoped database isolation enforced at the application layer.
• TLS in transit; data centre security inherited from Railway and Cloudflare.

No system is perfectly secure. If you believe your account has been compromised, email privacy@unifiedorders.com.

12. Your rights

Under UK GDPR and EU GDPR you have the right to:

• Be informed about how your data is used (this policy).
• Access the personal data we hold about you.
• Have inaccurate data corrected.
• Have your data erased (subject to legal retention requirements).
• Restrict or object to certain processing.
• Receive a copy of your data in a portable format.
• Withdraw consent for processing based on consent.
• Lodge a complaint with the UK Information Commissioner’s Office at ico.org.uk.

Email privacy@unifiedorders.com to exercise any of these rights. We’ll respond within 30 days.

If you are an end buyer (i.e. you bought something from a seller who uses Unified Orders), contact the seller directly first — they are the data controller for your information and we can only act on their instructions. We’re happy to forward your request to the seller if you can’t reach them.

13. Cookies

We use a small number of cookies and similar technologies. See our cookie policy for details.

14. Children

Unified Orders is a B2B platform not intended for use by anyone under 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data relating to a child, email privacy@unifiedorders.com and we will delete it.

15. Changes to this policy

We will update this policy as the platform evolves, sub-processors change, or the law changes. Material changes will be announced by email to account owners at least 30 days before they take effect.

16. How to contact us

Data protection enquiries: privacy@unifiedorders.com
General enquiries: hello@unifiedorders.com

A registered postal address will be added here once we incorporate.