DueFox Privacy Policy

Last updated October 2026.

DueFox is built and operated by Packsaddle Software, LLC ("we", "us"). This policy explains what data the app collects when a merchant installs it on their Shopify store, why, and how it's handled.

What we collect

When a merchant installs DueFox, we collect and store:

• Wholesale application data submitted through the app's public application form: company name, contact name, email, phone (optional), and requested payment terms.
• Order and invoice data for B2B orders placed on the store: order number, total, currency, due date, PO number, and the buyer contact's name and email, read from Shopify via the merchant's own API access.
• Payment records the merchant enters manually (amount, method, reference, date) to track offline payments such as checks or wires.
• An activity log of actions taken in the app (invoices created, payments recorded, reminders sent).

We never receive or store credit card numbers or other payment card data. When a buyer pays online, they enter their card directly into Shopify's own hosted checkout — DueFox never has access to it.

Why we collect it

This data is the core of what the app does: tracking which companies are approved for wholesale terms, what they owe, when it's due, and reminding both the merchant and the buyer as needed. We don't use it for advertising, and we don't sell it.

Who we share it with

Three services process data on our behalf, strictly to run the app:

• Shopify — the platform the app is built on. All store and order data passes through Shopify's API.
• Resend — sends payment reminder and notification emails on the merchant's behalf.
• Railway — hosts the app and the database where the data described above is stored.

We don't share data with anyone else.

Data retention and deletion

Data is kept for as long as the app is installed, so the merchant has a continuous AR record. If a merchant uninstalls the app, Shopify sends us a shop redact request 48 hours later, and when we receive it we permanently delete all app data for that store.

If a buyer asks a merchant what data we hold about them, or asks for it to be deleted, Shopify notifies us automatically and we respond within the required window: we erase the contact's personal details (name, email) from our records while preserving the underlying order totals and dates the merchant may be legally required to keep for accounting purposes.

Access log

We keep a log of when buyers' names and emails are viewed or used by the app, such as when a merchant opens an invoice list, when a reminder or payment link is sent, and when contact details arrive from Shopify. The log records the kind of data and the number of records, never the data itself. Merchants can see it in the app under Access log. Entries are kept for 12 months and deleted with the rest of the store's data when we receive the shop redact request.

Your rights

If you're a wholesale buyer and want to know what a merchant using DueFox has stored about you, or want it deleted, contact the merchant directly, or email us at support@packsaddlesoftware.com and we'll help route the request.

Data processing agreement

If your business is subject to the GDPR or similar data protection law, see our Data Processing Agreement for how we process data on your behalf as a processor.

Contact

Questions about this policy or how DueFox handles data: support@packsaddlesoftware.com.