OrderFast Privacy Policy
Last updated 19 October 2026
1. Who we are
OrderFast: Chat to Order ("OrderFast", "we", "us") is a Shopify app operated by OrderFast LLC, registered in Lebanon at Hadath, Boulevard Kamil Chamoun, Lebanon. It lets a merchant and their staff forward order messages to an OrderFast chat bot on Telegram, review a summary, and create the order in their Shopify store.
This policy explains what information OrderFast collects, why, who we share it with, and how long we keep it. It applies to:
- Merchants who install OrderFast on a Shopify store
- Staff members whose Telegram accounts a merchant links to the bot
- Merchants' customers, whose details appear in the orders staff forward to the bot
By installing or using OrderFast you agree to this policy. If you do not agree, please uninstall the app.
2. Information we collect
We only collect what OrderFast needs to turn chat messages into Shopify orders.
| Source | What we collect | Whose data |
|---|---|---|
| Shopify, when you install the app | Store name, domain, contact email, plan, currency, time zone; an access token for the permissions you approve | Merchant |
| Shopify, while the app runs | Product titles, variants, SKUs, prices and stock; customer names, phone numbers, email addresses and shipping addresses; orders and draft orders created through OrderFast | Merchant and their customers |
| Your app settings | The staff members you invite (their Telegram name, username and account id), delivery fee, order type, tags, retention period and other preferences | Merchant and staff |
| Chat messages sent to the bot | The message text you forward, the sender's Telegram account, the time sent, and our replies | Staff and the customers named in each order |
| Billing | Your plan, handled through Shopify's billing system. We never see or store card details | Merchant |
| Usage and technical data | Number of orders processed, errors, IP address and browser details when you open the app in Shopify admin | Merchant and staff |
We do not collect payment card numbers, government ID numbers or passwords. We do not knowingly collect sensitive categories of data such as health or religious information. If a forwarded message contains such details, we process them only to create the order and remove them with the message on the schedule in section 6.
3. How we use information
We use the information above only to run and improve OrderFast:
- Read orders: match the items in a message to your products, sizes and prices, and pick out the customer's name, phone number and address
- Create orders: create the draft order or order in your Shopify store, and find or create the matching Shopify customer
- Reply in chat: send the order summary, the confirmation and any follow-up questions back to the staff member who sent the order
- Verify staff: check that a message comes from a Telegram account linked to your store
- Show your dashboard: count orders, time saved and accuracy, so you can see what the app does for you
- Billing and support: charge your plan through Shopify, answer your questions and fix problems
- Keep the service safe: prevent abuse, spam and unauthorized access
- Improve accuracy: review anonymized or aggregated error patterns, such as items the bot often fails to match
We do not use your data for advertising, we do not build marketing profiles of your customers, and we never message your customers ourselves.
4. How we use AI
OrderFast uses an AI model to read free-text orders. When a staff member forwards an order, we send that message, together with the products from your catalog it may refer to, to our AI provider, Anthropic. The model returns the items, quantities, customer details and address it found.
- Our agreement with the AI provider does not allow it to use your data to train its models.
- The provider processes the data only to return a result to us and deletes it within 30 days, unless it must keep it longer to investigate misuse of its service.
- When the model is unsure, nothing is created in your store until a staff member reviews the summary and taps Confirm. Merchants can also require a confirmation tap for every order.
- We use AI only for reading orders. We do not use it to make decisions about your customers.
5. Who we share information with
We do not sell, rent or trade personal information. We share it only with the service providers that make OrderFast work, each bound by a contract to protect it and use it only for us.
| Provider | Purpose | Data shared |
|---|---|---|
| Shopify | Hosts your store, creates orders and handles app billing | Order, customer and product data you already hold in Shopify |
| Telegram (Telegram Messenger Inc.) | Carries chat messages between your staff and the bot | Message content and staff Telegram accounts |
| Anthropic | Reads order messages (section 4) | Message content and the matching products |
| Amazon Web Services (Stockholm, Sweden) | Runs our servers, queues and backups | All data we store |
| Neon (Frankfurt, Germany) | Hosts our database | All data we store |
| Our email provider | Answers your support requests | Your contact details and the messages you send us |
If you turn on the order feed in the app, a copy of each order message is posted to a Telegram channel that you own and control. If we add WhatsApp as a channel, Meta Platforms will be listed here before it goes live.
We may also disclose information if the law requires it, to protect the rights or safety of our users or the public, or as part of a merger or sale of our business. In a sale, the buyer must keep honoring this policy.
6. How long we keep information
We keep information only as long as we need it to run the service.
| Data | How long we keep it |
|---|---|
| The original chat message and the customer's name, phone number, address and note | Removed after the retention period you set in the app: 30 days by default, from 1 to 365 days |
| Order log (order number, product lines, totals, time, staff member, status) | While the app is installed, for your dashboard and support |
| Staff accounts and settings | Until you remove them or uninstall the app |
| Billing records | As long as tax and accounting law requires |
| Backups | Up to 35 days, then deleted |
Orders and customers created in your Shopify store belong to you and stay in Shopify. Deleting OrderFast data does not remove them from your store.
When you uninstall: Shopify notifies us at once and we discard your store's access token and stop processing. 48 hours later Shopify sends us a deletion request and we delete your store's data from our systems, apart from billing records we must keep by law.
Customer requests through Shopify: we respond to Shopify's privacy requests. When a customer asks your store for their data, we provide what OrderFast holds about them. When a customer asks to be erased, we delete their details from our systems. We complete both within 30 days.
7. How we protect information
- All data is encrypted in transit (HTTPS/TLS) and at rest.
- Shopify access tokens and API keys are stored encrypted and never shown in the app.
- Every message from the chat platform and every Shopify webhook is checked for a valid signature before we act on it.
- Only staff accounts you have linked can create orders for your store.
- Access to production systems is limited to the people who need it, with two-factor sign-in.
- We request only the Shopify permissions OrderFast needs.
No system is perfectly secure. If a breach affects your data, we will tell you without undue delay and, where the law requires, within 72 hours of becoming aware of it.
8. Your rights
Who is responsible for what. For your customers' and staff's information, the merchant decides why it is processed and is the data controller. OrderFast processes it on the merchant's behalf, as a data processor. For merchants' own account and billing information, OrderFast is the controller.
Depending on where you live, including under the EU and UK GDPR and California's CCPA, you may have the right to:
- Get a copy of the personal information we hold about you
- Correct information that is wrong
- Have your information deleted
- Object to or restrict how we process it
- Receive your information in a portable format
- Complain to your local data protection authority
Merchants and staff can email us at support@orderfast.co. Customers of a store should contact that store first; we will help the merchant answer. We reply within 30 days and will not treat you differently for using these rights.
9. Other things to know
International transfers. Our servers and providers may be located outside your country, including in the European Union and the United States. When we move personal data out of the EU, UK or another region with transfer rules, we rely on safeguards such as the EU Standard Contractual Clauses.
Children. OrderFast is a business tool and is not meant for anyone under 16. We do not knowingly collect children's information.
Changes to this policy. We may update this policy as the app or the law changes. We will change the date at the top and, for significant changes, tell merchants by email or in the app at least 14 days before they take effect.
10. Contact us
For questions about this policy or your data:
- Email: support@orderfast.co
- Post: OrderFast LLC, Hadath, Boulevard Kamil Chamoun, Lebanon
- Website: www.orderfast.co
If you are in the EU or UK and we appoint a local representative, their details will be listed here.