ReadyPO Privacy Policy

Effective date: October 28, 2026

ReadyPO is provided by B2B Commerce Tools LLC, doing business as B2B Commerce Tools ("we," "us," or "our"). This policy explains how we handle information when merchants and their buyers use the ReadyPO Shopify app, including PO uploads, PO email processing, review tools and buyer cart creation.

Our privacy contact is Taylor Simpson, at t.simpson@b2bcommercetools.com or 715-410-6409. General app support is also available at support@b2bcommercetools.com.

Business mailing address: B2B Commerce Tools LLC, 1822 Cypress Trail, New Richmond, WI 54017, United States.

This policy covers ReadyPO. A merchant's own privacy notice explains how that merchant handles customer information, and Shopify's privacy information covers Shopify's services. Our marketing website and its newsletter/contact forms have separate data practices that must also be disclosed where applicable.

Information we handle

ReadyPO processes information supplied by merchants and buyers, information made available through the merchant's authorized Shopify connection, and information generated while providing the service. This may include:

• Store and account information: store domain and identifiers, staff/account contact details, permissions, app authentication credentials, settings, subscription status and usage counts.
• Purchase orders: uploaded files and images; emailed attachments, sender/recipient details, subject and message text; PO numbers, line items, product codes, quantities, prices and delivery instructions.
• Customer and purchasing information: names, email addresses, phone numbers, shipping/billing addresses, customer identifiers, and company, location and buyer-contact details included in a PO or available through authorized Shopify access.
• Review and outcome information: selected products and addresses, approvals, quantity/price decisions, unit-conversion and customer-code rules, and references to the Shopify draft orders or buyer carts created from a PO.
• Operational and support information: processing status, timestamps, errors, source size/type, processing duration, token/cost measurements, email delivery status and information supplied in a support request. Requests may also include IP addresses; a buyer's IP address may be forwarded to Shopify as part of cart creation.

Only submit information needed to process the purchase order. Payment-card information should be entered through Shopify checkout, not included in PO documents or support messages. ReadyPO does not need payment-card numbers to extract a PO or create a draft/cart.

How we use information

We use information to extract PO details, match products against the merchant's catalog, check purchasing context, apply the merchant's review settings, manage address and line-item decisions, and create Shopify drafts or buyer carts when requested or permitted by the merchant's automation settings.

We also use it to retain PO history and originals for review/recovery, deliver configured notifications, provide support, measure processing performance and usage, enforce plan allowances, protect the service and handle privacy requests.

Customer data is used to provide ReadyPO and support the service. We do not sell personal information or share it for cross-context behavioral advertising.

For buyer information processed as part of a merchant's PO workflow, the merchant determines the purpose of the order processing. Merchants must provide any required privacy notices and have the necessary permissions or other lawful basis for submitting information.

AI processing and merchant control

ReadyPO sends submitted PO content to OpenAI's API to extract structured order information. The content sent may contain customer names, addresses, contact details and other information printed in the document or email. ReadyPO can make an additional extraction request when needed to recover product identifiers.

AI extraction can be incorrect. Merchants choose which checks require review and whether eligible POs may create drafts automatically. Buyers review their PO before creating a cart. A ReadyPO draft/cart is not a completed checkout payment. Merchants can use Shopify's manual order-entry process instead of submitting a PO to ReadyPO.

ReadyPO requests store:false for OpenAI Responses API extraction and disables voluntary feedback, evaluation/fine-tuning and input/output sharing in its designated OpenAI account. API data is not used for model training unless sharing is enabled. These controls do not mean zero retention: OpenAI may retain content for abuse monitoring or other permitted purposes under its applicable terms and account settings.

Service providers and disclosures

We use providers to operate ReadyPO and carry out the functions described in this policy:

Configured merchant notifications may contain PO details, email context, links and original attachments. Merchants should choose appropriate recipients. Copies delivered to a merchant's or sender's mailbox are controlled by that mailbox owner; removing information from ReadyPO does not recall an email that was already delivered.

We may also disclose information when required to comply with applicable law or a valid legal process, or as necessary to investigate misuse and protect the service.

Retention and deletion

ReadyPO retains normal PO history for the merchant until the merchant deletes it or an applicable privacy/store-erasure process removes it. There is no automatic purge of ordinary PO history merely because it is old. The retention periods below distinguish operational PO history from security access logs and prepared privacy exports.

• PO files, parsed details and email context: retained for the merchant's workflow until removed through available deletion tools or an applicable privacy/store-deletion process. Related email context and technical processing/delivery records may be stored independently of an inbox entry; deleting one visible entry is not the same as a complete privacy erasure.
• Authentication credentials: used for the authorized Shopify connection. Uninstall handling removes stored app sessions and stops new processing and pending notifications. It does not immediately erase all retained PO history.
• Customer privacy requests: clearly identified customer data is removed through the deletion process. Files with uncertain ownership or mixed/shared email information require review; the request is not marked complete while that review remains unresolved. Unrelated customers' POs are preserved. ReadyPO's privacy handling does not delete customer profiles or orders already held in Shopify.
• Security access logs: retained for 90 days, then removed by scheduled cleanup, subject to applicable privacy erasure. These logs record limited access-event metadata for security review rather than PO content, addresses, raw credentials or signed download links.
• Prepared customer-data exports: available to the authenticated merchant for 30 days, then erased by background cleanup. The merchant is responsible for providing the copy securely to the requesting customer. Pending requests retain the identity/review information needed to resolve them; completed requests may retain limited status/timestamp information.
• Usage accounting: after customer deletion, usage counts may remain with randomized record identifiers and the PO/customer/resource links removed. Store-linked usage/billing records are removed during required store redaction; they are not retained solely to prevent a Free-plan allowance reset.
• Store erasure: after uninstall, Shopify ordinarily sends a store-redaction request after 48 hours. ReadyPO processes the applicable request to remove the store's retained app data. A delayed request that predates a reinstall, or an ambiguous request concerning an active installation, is checked to avoid erasing unrelated new-installation data.

The current Mailgun plan does not provide stored message-body retrieval for the ReadyPO domain and provides one day of event-log retention. This describes those specific provider features, not zero transient processing, delivery-queue storage or deletion of every provider copy. ReadyPO's own retained email originals/history follow the app retention schedule above, independently of Mailgun's retrieval feature.

Support-case personal information is normally removed within 90 days after the case is resolved, and unnecessary attachments are removed sooner. Information needed for an open case, a documented dispute, a security investigation or a legal obligation may be kept for that purpose and reviewed for continuing need. Other operational records are retained as needed for the stated service, security and applicable obligations. Records erased from the active database may remain in restricted backup/recovery copies until those copies expire under the provider's recovery schedule. Render currently provides a three-day point-in-time recovery window for ReadyPO; logical exports, if created, have a separate provider retention period. Applicable erasures must be reapplied before restoring normal service from a backup.

Our providers may retain information according to their own applicable agreements and configured settings. ReadyPO database deletion does not itself erase a provider's abuse-monitoring logs or previously delivered emails.

Privacy requests and choices

If you are a buyer, contact the merchant whose store received your PO to request access, correction or deletion. You may also contact us at support@b2bcommercetools.com so we can route the request appropriately. We may need to verify the requester and merchant relationship before disclosing or deleting information.

Where applicable, privacy rights may include access, correction, deletion, restriction or objection to processing, portability, withdrawal of consent, and a complaint to the relevant supervisory authority. The rights available and any exceptions depend on applicable law. Contacting us does not require sending a password, payment-card information or an entire unrelated customer database.

Merchants control review/automation settings, buyer-upload availability and email intake/notifications. Stopping intake or disabling buyer uploads does not by itself erase existing records. A buyer who does not want a PO processed through ReadyPO should contact the merchant for another ordering method.

Security and processing locations

The app uses authenticated merchant/buyer flows, store/customer access boundaries, signed webhook verification and expiring original-file download links. Original links and exported customer data should be treated as confidential. Public app/API connections use HTTPS. Render documents encryption at rest for its managed PostgreSQL databases and backups. Required TLS is configured on the ReadyPO Mailgun domain, with certificate verification also Required. This prevents unencrypted fallback for outgoing delivery governed by those settings; a recipient unable to establish TLS may not receive the message. This is not evidence that every inbound email hop uses TLS or that messages are end-to-end encrypted.

ReadyPO's currently selected Render services are in Virginia, United States. Providers may process information in other locations according to their services, agreements and account settings. The ReadyPO Mailgun domain uses the US region.

If we identify a personal-data security incident affecting ReadyPO, we will investigate, take appropriate containment/remediation steps, and provide notifications required by applicable law and our agreements.

Changes and contact

We may update this policy as ReadyPO or its data practices change. We will update the effective date and provide additional notice where required.

• Privacy contact: Taylor Simpson
• Email: t.simpson@b2bcommercetools.com
• Phone: 715-410-6409
• App support: support@b2bcommercetools.com
• Business: B2B Commerce Tools LLC, doing business as B2B Commerce Tools
• Mailing address: 1822 Cypress Trail, New Richmond, WI 54017, United States