Privacy policy

POcatch is a Shopify app made and run by Hossein Karami, an individual developer in Istanbul, Türkiye. POcatch isn’t a company: in this policy, “POcatch”, “we” and “us” mean Hossein Karami. It reads the purchase orders that a wholesale store’s customers send by email, matches them to the store’s products and customers, and prepares draft orders in the store for the store’s staff to check. This policy explains what POcatch collects, why, on what legal basis, who it shares it with, how long it keeps it, and your rights. Questions: support@pocatch.com.

Two roles

• For the store’s own data (the store, its owner’s contact details, its settings and plan), POcatch is the controller: we decide how it’s used, and this policy applies directly.
• For the store’s customers’ data (the buyers whose purchase orders the store sends to POcatch), the store is the controller and POcatch is its processor: POcatch handles that data only to do what the store asks, under the data processing agreement at pocatch.com/dpa. If you’re a store’s customer, the store’s privacy policy is the one that applies to you; this policy tells you what POcatch does on the store’s behalf.

What POcatch collects, and where it comes from

About the store, from Shopify when the store installs POcatch:

• the store’s myshopify address and name, the owner’s email address, the store’s time zone and currency;
• the access token Shopify gives the app. POcatch asks to read products, customers, companies, catalogs and payment terms, and to read and create draft orders. It can’t change products, customers or orders, and it never completes an order;
• the plan the store chose, from Shopify;
• the store’s settings in POcatch: the email addresses its staff forward orders from, and how much a purchase order’s price may differ before POcatch asks.

About the store’s customers, from what the store sends to its POcatch address (forwarded emails) or uploads in the app. POcatch doesn’t collect it from the customers themselves:

• the emails: the sender, the recipients, the subject, the text and the attached files (PDFs, photos, spreadsheets);
• what POcatch reads from a purchase order: the buyer’s company, the contact’s name, email address and phone number, shipping and billing addresses, the order number and dates, the products, quantities and prices, and any notes;
• what POcatch learns when the store creates a draft order: a customer’s own names for the store’s products (such as their item codes), and the email addresses their orders come from, so their next order is matched by itself;
• Shopify’s IDs for the customer, the company and the location an order belongs to.

POcatch shows the store the names Shopify has for its customers and products, but asks Shopify for them each time rather than keeping them. POcatch never contacts the store’s customers: it never emails them, never signs in as them, and never completes an order. A draft order waits in Shopify for the store’s staff.

Why, and on what legal basis

POcatch uses AI to read each purchase order and suggest matches. It makes no decision with legal or similarly significant effects on anyone: the store’s staff check and create each draft order themselves.

We don’t sell personal data, don’t share it for advertising, and don’t use it to train AI models.

How it’s protected

• The customers’ details POcatch keeps (email addresses, names, phone numbers, addresses, subjects, and what was read from an order) are encrypted in the database (AES-256-GCM). Email addresses are found through a keyed hash, not stored in the clear.
• Everything travels over encrypted connections (TLS).
• An order’s original files open only through signed links that expire within an hour; a customer’s data export, through a signed link that expires after 7 days.
• Each store reaches only its own data, inside its Shopify admin. Access for support is limited to Hossein Karami.

Who else handles it

POcatch uses these services, listed with what they handle and where at pocatch.com/subprocessors:

• Railway hosts POcatch’s servers and database, in the United States.
• Cloudflare receives the emails sent to POcatch addresses, stores them until they’re deleted, and keeps the encrypted nightly backups of the database, both in its Eastern Europe region; it also carries traffic to the app.
• Anthropic (Claude) reads each purchase order and helps match its lines to products. It receives the email and its files, under its commercial terms, which don’t allow training on the data.
• Resend delivers the app’s emails.
• Sentry records the app’s errors, in the United States, without customers’ data.
• Shopify is where the app runs and where the store pays for its plan, under Shopify’s own terms.
• Google (Google Analytics) counts visits to pocatch.com if you allow it, and receives the events of POcatch’s App Store listing from Shopify (see “The website”). It never receives data from the app.

Some of these are outside the European Economic Area, the United Kingdom and Türkiye, mainly in the United States. Data transferred there is protected by each provider’s data processing terms, which rely on the European Commission’s Standard Contractual Clauses or the EU–US Data Privacy Framework, and by the safeguards Türkiye’s KVKK requires.

How long it’s kept

• Emails and their files: deleted 90 days after they arrive. What POcatch read from the order (the buyer’s details) is cleared at the same time, and an order still waiting for review is closed. What remains is what the store needs for its records: the order number, its status, totals and counts, and the draft order it became. As a safeguard, anything left in the email storage is deleted after 120 days.
• What POcatch learned about a customer (their names for products, their addresses) is kept while the store uses POcatch. The store can remove it at any time on the Customers page.
• A customer’s data export is deleted after 7 days.
• When a store uninstalls POcatch, Shopify tells the app 48 hours later to delete the store’s data, and POcatch deletes everything it keeps about the store and its customers, including the stored emails.
• Error reports are kept by Sentry for up to 90 days.
• Backups: the database is copied every night, encrypted (AES-256-GCM) before it leaves the server, and each copy is deleted after 35 days. So data deleted from POcatch is gone from the backups within 35 days. A backup is opened only to restore the service after a failure.

Your rights

Depending on where you live (for example under the EU or UK GDPR, Türkiye’s KVKK, or US state laws such as California’s), you may have the right to know what data is kept about you, to get a copy, to have it corrected or deleted, to restrict or object to its use, and to take it elsewhere. You also have the right to complain to a data protection authority (in Türkiye, the Personal Data Protection Authority; in the EU, the authority where you live).

• If you’re a customer of a store that uses POcatch, ask the store: it decides how your purchase orders are handled. When you ask Shopify for your data or its deletion, Shopify forwards the request to POcatch, which then deletes your emails, what it read from your orders and what it learned about you, or gives the store a file with all of it.
• If you’re a store owner or staff member, write to support@pocatch.com.

We answer within 30 days. We won’t treat you differently for using these rights.

Children

POcatch is a tool for businesses. It isn’t meant for children and doesn’t knowingly handle children’s data.

The website

pocatch.com sets no cookies until you choose. On your first visit it asks whether it may use Google Analytics to count visits. If you allow it, Google Analytics sets two cookies (_ga and _ga_NYGQE7DJ25, kept for up to 13 months) and sends Google the pages you visit, the page you came from, your type of device and browser, and your approximate location. Google Analytics doesn’t store your IP address, and we don’t use the data for advertising. Google keeps it for up to 14 months and may process it in the United States, under the EU–US Data Privacy Framework.

If you don’t allow it, nothing is loaded. Your choice is kept in your browser, not in a cookie, and we ask again after 13 months. You can change it at any time with Cookie settings at the bottom of every page.

When you view POcatch’s listing on the Shopify App Store, Shopify sends us events through Google Analytics: that the listing was viewed, that Install was clicked, and that the app was installed. Shopify’s privacy policy covers the App Store.

The website’s fonts and pictures come from pocatch.com itself, and it runs no advertising scripts. Its hosting keeps standard request logs to deliver and secure the pages.

Changes

If this policy changes, the new version is published here with a new date. Important changes are also announced in the app, before they take effect when they affect how customers’ data is handled.

Contact

Hossein Karami, individual developer, Istanbul, Türkiye support@pocatch.com (a postal address for formal requests is available on request)