Otodoke Privacy Policy

Otodoke Privacy Policy

Craftify Inc. ("we") sets out below how the Shopify app "Otodoke" ("the app") handles personal information and user information.

1. Information we collect

For each store that installs the app, we collect and store only the following.

  • The store's domain (for example, example.myshopify.com)
  • The access token issued by Shopify (including the refresh token)
  • The granted permissions (scopes) and their expiry

Delivery date settings (preparation days, closed days, time slots, and so on) are stored on Shopify as the store's data. They are not stored on our servers.

2. Information we do not collect

The app does not collect or store the following.

  • Customers' names, addresses, email addresses, phone numbers, or other personal information
  • Order contents or payment information
  • The store's customer list
  • Names or email addresses of the store's staff

The delivery date and time slot a customer chooses in the cart are stored on Shopify as part of the cart and the order. They are not sent to our servers, and we do not store them.

Validation at checkout runs inside Shopify (Shopify Functions). It refers only to the delivery date and time chosen in the cart, information about the products in the cart, and the name of the selected shipping method. It does not refer to customers' names, addresses, or contact details. This information is not sent to our servers, and we do not store it.

The app does not store cookies in customers' browsers and does not use tracking technologies (such as tracking scripts or advertising tags).

The only permission the app requests is creating and managing checkout validations (write_validations). It does not request permission to read orders or customers.

3. How we use it

We use the information only so that the app can do the following through Shopify's APIs.

  • Save and load delivery date settings
  • Create, enable, and disable validation at checkout

We do not use it for any other purpose, such as advertising, providing it to third parties for analysis, or selling it.

4. Where and how long we store it

Information is stored on servers in Japan (Tokyo region).

  • Application and database: Fly.io (Tokyo)

Stored information is deleted when the app is uninstalled from the store. We delete it on receiving Shopify's webhooks (app/uninstalled, shop/redact).

To respond to incidents and prevent misuse, the app's server keeps access records (date and time, requested page, and response result) for a short period. These records do not contain customers' personal information.

5. Third parties

We do not sell, rent, or provide the information to third parties. We use the following providers to store and process it as described above.

  • Shopify Inc. (app platform)
  • Fly.io, Inc. (application hosting and database storage)

5-2. Providers outside Japan

We are established in Japan and have no establishment in the European Economic Area (EEA) or the United Kingdom. Information is stored on servers in Japan (Tokyo region). However, Shopify Inc. (Canada) and Fly.io, Inc. (United States) are providers outside Japan, and they may handle the information from outside Japan to operate and maintain their services. We use these services under the terms of service and data protection terms set by those providers.

6. Information we receive through enquiries

If you contact us by email about the app, we receive the sender's name, email address, store name, and the content of the enquiry. We use these only to reply and to support the app, and we do not provide them to third parties. We keep them for as long as needed to handle the enquiry and delete them when they are no longer needed.

7. Security measures

To prevent leakage, loss, or damage of the information, we take the following measures.

  • Encrypt all communication with the app (HTTPS)
  • Limit database access to our staff in charge and the app itself
  • Not use access tokens for any purpose other than operating the app

8. Requests from customers

Because the app does not hold customers' personal information, when we receive a data request (customers/data_request) or a deletion request (customers/redact) from Shopify, we record that there is no data to disclose or delete. If you are a customer and have a request about your order or your chosen delivery date, please contact the store you purchased from first.

8-2. Your requests and rights

For personal information we hold about you (information about the store that installed the app, and information received through enquiries), you may request notification of the purpose of use, disclosure, correction, addition or deletion, suspension of use or erasure, and suspension of provision to third parties. Contact us at the address below. We will respond without delay in accordance with the law after confirming your identity.

If you live in the European Economic Area (EEA) or the United Kingdom, under applicable law you have the right to request access to, rectification of, erasure of, and restriction of processing of your personal data, to object to processing, and to data portability, and the right to lodge a complaint with a supervisory authority. Our legal bases for handling personal data are the performance of the contract for providing the app, and our legitimate interest in operating the app securely.

9. Contact

For enquiries and complaints about this policy and the handling of personal information:

Craftify Inc.
Email: support@crafti-fy.jp

We will provide our address and the name of our representative without delay on request.

10. Changes

We may revise this policy as needed. We will announce significant changes on this page.

Established: October 9, 2026