Roles

For your stockists' order details, you (the brand) are the controller and Carnet is your processor, under our Data Processing Agreement. For your own account data, Carnet is the controller.

Data Processing Agreement · Privacy policy

The notice buyers see on order pages names the brand and gives privacy@ordersheet.net.

What we store

Sheets and links you create
Order requests: lines, quantities, references
Buyer contact details: name, email, company, phone if given
No card or payment data: payment stays in Shopify

Protection

Buyer contact details, email recipients and link tokens are encrypted at rest, with a key per store. Order lines are not.
Signed links you can pause or revoke
Each public link is rate-limited per 24 hours
Shopify's GDPR requests handled automatically (customer data request, customer redact, shop redact)
Limited Shopify access: Carnet reads products, themes, markets, languages and customers (to match stockists) and creates draft orders. It does not edit your theme and does not read your orders or inventory. See the table below.

Setup and permissions

These are all the Shopify access scopes Carnet asks for at install.

Scope	What Carnet uses it for
`read_products`	Reads your products, images and variants to build line sheets
`read_customers`	Reads customers, to match stockists
`write_draft_orders`	Creates draft orders from stockist orders
`read_markets`, `read_locales`, `read_translations`	Reads your markets, store languages and translations, for buyer pages
`read_themes`	Reads your theme's colours and fonts for the theme import. Carnet has no write access to themes: it does not edit your theme.
`write_app_proxy`	Lets buyer links open on your store's own domain under `/apps/carnet` (Shopify's app proxy), so a link looks like your store's

Carnet has no scope to read your orders or inventory.

Retention

Data	Kept
Order request details	180 days after processing (60 days if never processed)
Email bodies	7 days after sending
Backups	Backups keep encrypted copies until they expire (35 days)
After uninstall	Deleted following Shopify's data deletion request (2 days after uninstall, 60 days at most)

Sub-processors

Provider	Purpose
Shopify	Platform
Microsoft Azure	Hosting, database, email (region: France Central)
Cloudflare	Network and buyer link hosts

Security incidents

Carnet has a written incident response policy. The operator leads every incident, from detection to review.

Detection: production errors raise an automatic alert, and we act on notices from Shopify and our hosting providers.
Containment first: we can rotate encryption and session keys, revoke third-party access tokens and take the app offline.
Notification: if a personal data breach affects your data, we email you without undue delay after we become aware of it, at the contact address registered for your shop in Shopify. The email says what happened, which data and how many records are affected, the likely consequences and what we are doing. It gives you what you need to meet your own duties under Articles 33 and 34 of the GDPR, including the 72-hour deadline to notify your supervisory authority. We also inform Shopify, as its partner program requires.
After every incident we write a review with the cause and the fixes, and we test the procedure at least once a year.

Who has read your buyers' data

Every time buyer contact data (name, email, phone, address) is decrypted, by you or your staff in the Carnet admin, or by a background job such as sending a recap email or creating a draft order, Carnet records when, for which store, which staff member or job, and which request. The record never contains the data itself. Entries are kept for 365 days, then deleted, and are deleted with the rest of your store's data on uninstall. Only the Carnet operator can read the log, directly in the database.

Contact

Merchants: hello@ordersheet.net. Buyers: privacy@ordersheet.net.

Security & privacy