ISSUE by DISORDER privacy policy
Last updated: 28 September 2026
ISSUE by DISORDER ("the app") lets a Shopify merchant publish a wholesale linesheet and take orders from their stockists. This policy describes exactly what the app stores, what it does not, and who else is involved.
Who we are
DISORDER operates the app. For questions about this policy or any request concerning your data, write to support@disorder.world.
What the app stores
When a merchant installs the app, we store, in a Postgres database hosted in the EU by Neon:
| What | Why |
|---|---|
Your .myshopify.com domain and an access token | To call the Shopify API on your behalf |
| Linesheet settings: name, collection, default wholesale rate, background | So your linesheets persist between visits |
| Book page records: a Shopify file ID, its CDN URL and pixel dimensions | To lay out the book |
| Stockist records: a name you type, an optional contact email, a rate, a link token | So each stockist has their own link and prices |
| Price rules: a tag or product type, and a percentage or amount | To work out wholesale prices |
| Your order email, brand name, fonts and colours | Settings you chose |
| A cached logo and favicon URL read from your storefront | So a new install looks like your brand without setup |
What the app does not store
- Your products, prices, inventory or orders. These are read from the Shopify API when a page loads and are never copied into our database.
- Your book's images. They are uploaded to your own Shopify Files and served from Shopify's CDN. We keep only the file ID and URL. If you uninstall, the images remain yours.
- Buyers' personal data. When a stockist submits an order, the email address they type is passed straight to Shopify to create the draft order and send their confirmation. It is not written to our database.
- Payment details. The app never sees them. Subscription billing is handled entirely by Shopify.
Who else is involved
| Processor | Role | What reaches them |
|---|---|---|
| Shopify | The platform | Everything the app reads and writes on your store |
| Vercel | Hosting | Requests to issue.disorder.world, including standard server logs |
| Neon | Database (EU) | The records listed above |
| Cloudflare (cdnjs) | Serves the spreadsheet, PDF and barcode libraries used to build a picking sheet | The merchant's browser IP, in the Shopify admin only |
| Frankfurter | Daily exchange rates for the currency selector | Nothing about you or your buyers, only a currency code |
| Google Fonts | Only if you set a Google font in Settings | Your buyers' IP addresses, when they open a linesheet |
A note on Google Fonts. If you choose a Google font, your stockists' browsers fetch it from Google, which means their IP address reaches Google. Some regulators, particularly in Germany, treat that as a transfer requiring consent. If that matters to you, upload your own licensed webfont in Settings instead. It is served from your own Shopify Files and nothing reaches Google.
Stockist links
Each stockist link contains a 128-bit random token. That token is the only thing granting access to your wholesale prices, so treat a link like a password. Links carry no stockist name, and the pages are marked noindex and send no referrer, so the token is not passed to any third party or search engine. You can revoke any link at any time without affecting the others.
How long we keep it
- While you are installed, for as long as you use the app.
- When you uninstall, Shopify sends a
shop/redactrequest 48 hours later. On receiving it we delete every record belonging to your shop in a single transaction: settings, linesheets, book pages, stockist links and price rules. Nothing is retained. - Customer erasure requests (
customers/redact) are honoured on receipt. Because the app holds no shopper records, in almost every case there is nothing to erase; where a contact address you typed against a stockist matches the request, it is cleared.
Your rights
Under UK GDPR and GDPR you may ask for a copy of your data, ask us to correct or erase it, or object to our processing. Write to support@disorder.world and we will respond within 30 days. You may also complain to the ICO (ico.org.uk) or your local supervisory authority.
Changes
If this policy changes materially we will update the date above and notify merchants in the app before the change takes effect.