Oops Window Privacy Policy
Last updated: October 26, 2026
Oops Window is a Shopify app that gives a store's customers a short window after checkout to correct their shipping address or cancel their order. This policy explains what information the app handles, why, and what happens to it. It is operated by Marquis Enterprises LLC ("we", "us").
Who this applies to
Merchants who install Oops Window on their Shopify store, and customers who place orders with those stores. For customers, the store is responsible for its own privacy practices; we process order information on the store's behalf and only to provide the app's features.
Information about merchants
| What | Why |
|---|---|
| Store domain and Shopify shop ID | To identify your store. |
| Shopify access tokens | To place and release fulfillment holds, update addresses, and cancel orders on your behalf. They expire and are renewed automatically. |
| Your app settings | Edit window length, which changes customers may make, and the cost you enter for a shipping mistake. |
| Your plan (Free or Pro) | Read from Shopify to apply the right limits. Billing is handled entirely by Shopify; we never see payment details. |
Information about customers
When an order is placed, we store:
| What | Why |
|---|---|
| Shopify order ID and customer ID | To know which order has an edit window and who may change it. |
| A one-way hash of the order's checkout token | So a customer who checked out as a guest can prove an order is theirs. The token itself is not stored and can't be recovered from the hash. |
| When the edit window opens and closes, and its status | To hold fulfillment during the window and release it afterwards. |
| Whether the customer changed their address or cancelled, and when | To show the merchant a record of changes. The new address itself is not stored. |
Names, email addresses, phone numbers and shipping addresses are not stored by Oops Window. When a customer opens the edit option, the app reads their current shipping address from Shopify to show it to them, and sends any correction straight back to Shopify. Shopify remains the place this information is kept.
What we don't do
- We don't sell or rent any information, or share it for advertising.
- We don't use tracking cookies or analytics on customers.
- We don't contact customers. Order and cancellation emails come from the store, through Shopify.
Service providers
- Shopify: the platform the app runs on, and where all order and customer details live.
- Railway (railway.com): hosts the app's server and database in the United States.
Server logs
To operate and troubleshoot the app, our server records events such as a store's domain, order IDs, and error messages from Shopify. These logs don't intentionally contain names, email addresses, phone numbers or shipping addresses, and they're kept only as long as our hosting provider retains them.
How long we keep information
- When a merchant uninstalls Oops Window, we delete all of that store's information right away, including its settings, tokens and order records. Shopify's follow-up deletion request, sent about 48 hours later, is honored as well.
- When a customer asks a store to erase their data and the store forwards the request through Shopify, we remove the link between that customer and their orders. What remains is an anonymous record that a change was made, which can no longer be tied to them.
Security
All connections to the app, to Shopify, and to our database are encrypted in transit. Access tokens expire after one hour. Requests from the checkout and order status pages are verified with tokens signed by Shopify, and a customer can only view or change an order they placed.
Your rights
Customers: to access or erase your information, contact the store you ordered from. Shopify passes those requests on to us, and we act on them. You can also contact us directly using the details below.
Merchants: you can stop all data collection at any time by uninstalling Oops Window, which deletes your store's data as described above, or contact us with any request.
If you're in the EU, UK, or California, you have rights under GDPR, UK GDPR, or the CCPA, including access, correction, and deletion. We will respond within 30 days.
Changes
If we change this policy, we'll update the date at the top of this page.
Contact
Marquis Enterprises LLC
Email: dev@marquisenterprises.pro