Privacy

Last updated: 30 June 2026

Who this is

TRUE Original is a Shopify app that issues a TRUE certificate of authenticity for qualifying orders on a merchant's store, then shows the buyer a link (and optional QR code) to that certificate. This page explains what data the app handles and why.

What we handle, and why

• Your store settings and access token. When you install, the app stores your Shopify access token and the configuration you set (which products get certified, field mappings, delivery choices) so it can do its job.
• Order and product data. Using the app's Shopify permissions (read_orders, write_orders, read_products), the app reads an order's products to decide which line items get a certificate, reads the product fields you mapped to fill the certificate, and writes the finished certificate's link back onto the order as a Shopify metafield.
• Buyer details. To issue and deliver a certificate the app uses the buyer's name and email from the order. These are sent to TRUE, which issues the certificate. If your rules hold a certificate for manual review, the buyer's name, email, and the certificate's field values are stored by the app until a person issues or discards that certificate.

Where the data lives

• The app's own database. Holds your settings, your encrypted access token and TRUE credentials, a processing log (order ids and status), records of issued certificates (order and line-item ids, the TRUE document id, the public certificate link, and TRUE's response), the queued order webhooks the app processes, and any certificates held for review.
• TRUE (trueoriginal.com), which issues and stores the certificate of record.
• Your Shopify store, where the certificate's link is saved on the order.

Who we share it with

The app shares certificate data with TRUE, the issuer. If you turn on email delivery, the certificate email is sent through our email provider (Postmark). The app does not sell your data or share it for advertising.

Keeping it, and deleting it

When you uninstall the app, its Shopify access token is deleted right away. About 48 hours later Shopify sends a shop data-erasure request, and the app deletes every record for your store from its database, including any certificates that were held for review. The certificate of record continues to live in TRUE and on your Shopify order; those are managed there.

For a request about a single buyer's data, contact us at SUPPORT_EMAIL_TBD and we will help.

Security

Connections use HTTPS. Your TRUE credentials and Shopify access token are encrypted at rest. Shopify's compliance and order webhooks are verified with Shopify's HMAC signature before the app processes them.

Contact

Questions about this policy or your data: SUPPORT_EMAIL_TBD.