Privacy policy
Last updated: 1 October 2026
Online for Orders (“we”, “the app”) is operated by Kristaps Šteins, Latvia, reachable at [email protected] (“we”). It checks, at regular intervals, whether customers can still buy from your online store and alerts you when they can't. This policy explains what data the app processes when you install it on your store.
What we collect
- Store information: store name, domain, the store's platform ID and the store owner's email address (to create your account and send alerts).
- Access credentials: the access token your platform issues to the app, and, only if you enter it, your storefront password. Both are stored encrypted.
- Product catalogue (read-only): public product data (title, price, availability) needed to pick a product for the test purchase flow.
- Monitoring results: check timings, HTTP status codes, error messages, the steps a real browser took on your storefront (with a screenshot when a step fails, and when you run a checkout test or publish a theme) and incident history for your store, plus any custom endpoint URL you add.
- Order counts (plans with the "orders stopped" alert): how many orders your store received per time window. On WooCommerce also the number of failed payments and the names of webhooks WooCommerce switched off. Counts only, never order contents or customer details.
- Store changes: short descriptions of changes that can break buying, e.g. "Theme “Dawn” was published" or "Updated plugin “WooCommerce Stripe Gateway” 9.2.0".
- Billing (WooCommerce plugin): your trial end date, your Stripe customer ID and your subscription status. Invoices and payments are kept by Stripe; we never see or store card or bank details.
- Settings: alert email address, a webhook address if you add one (stored encrypted at rest), check frequency and report preferences.
What we don't collect
The app does not access or store your customers' personal data, order contents or payment information.
Shopify: checks stop when the checkout page opens. No order is ever placed and no payment is ever made.
WooCommerce: full checks place a test order through your checkout with a test payment method that charges nothing. The test order uses your store's own address and a online-for-orders-test@ email address, sends no emails, doesn't change stock, isn't sent to your webhooks, and is deleted right after the check. You can switch test orders off.
How we use the data
- To run the checks and show results in the app.
- To send you alerts and recovery notices (by email, and to your webhook if you add one) and, if enabled, a weekly report.
- To operate, secure and troubleshoot the service.
We don't sell your data or use it for advertising. The legal basis is performance of our contract with you (GDPR Art. 6(1)(b)), our legitimate interest in operating a secure service (Art. 6(1)(f)), and, for billing and accounting records, our legal obligations under accounting and tax law (Art. 6(1)(c)).
Emails about your trial and subscription (for example a reminder that your free trial ends soon) are part of the service, not marketing.
Retention and deletion
- Detailed check results and screenshots are deleted automatically after 7, 30 or 90 days, depending on your plan; incident history is kept while the app is installed.
- When you uninstall the app, we immediately delete its access credentials and stop all checks.
- When the platform asks us to erase your store's data (on Shopify, 48 hours after uninstall), we delete all of the app's data for your store, and your account if nothing else is linked to it.
- WooCommerce has no such request: email us after disconnecting and we delete your store's data. We keep the trial end date so that reconnecting doesn't start a new trial.
- Billing and accounting records (invoices, payments) are kept for as long as accounting and tax law requires, even after the rest of your data is deleted.
Service providers
We use these processors to run the service:
- Hetzner Online GmbH, Germany: servers and database (data centre in Falkenstein, Germany).
- Cloudflare, Inc.: network security, DNS and encrypted delivery of the app's pages.
- Resend: sending alert and report emails (EU region, Ireland).
- Your ecommerce platform (e.g. Shopify): installation and billing.
- Stripe (Stripe Payments Europe, Ltd., Ireland): billing for the WooCommerce plugin. We share your email address and store address; you enter payment details on Stripe's pages, and we never see or store them. For payment processing, fraud prevention and its own legal duties Stripe acts as an independent controller under its privacy policy, and may transfer data outside the EU (for example to Stripe, Inc. in the USA) under the EU-US Data Privacy Framework and Standard Contractual Clauses.
Our servers and database are in the European Union. Data handled by Stripe for billing may leave the EU as described above.
Security
All traffic is encrypted with TLS. Credentials are encrypted at rest. Access is limited to what the service needs.
Your rights
You can access, correct, export or delete your data, and object to processing, by emailing us. You can also complain to your data protection authority.