Privacy Policy

OrderSync is operated by Sage Digital LLC ("OrderSync", "we", "us"), a US company. OrderSync is an AI order-processing platform: it reads inbound purchase orders — PDFs, emails, spreadsheets, EDI files, portal exports — and creates clean, validated orders in your ERP or e-commerce platform.

This policy covers the OrderSync platform at app.ordersync.io, this website, the OrderSync Integration plugin for WooCommerce, the OrderSync app for Shopify, and the OrderSync plugin for ChatGPT, Codex, Claude and other AI assistants.

Account information. Name, email address, company name, and authentication credentials when you create an OrderSync account.

Order documents and their contents. The purchase orders you or your customers submit for processing — including the business contact details, product lines, quantities, prices, and shipping addresses they contain. This is the core of the service: we process these documents to create orders on your behalf.

Store and catalog data. When you connect a WooCommerce store, Shopify store, or ERP, we access product catalogs, customer records, and order data as needed to match incoming purchase orders to your products and create orders. The scopes we request are limited to what order processing requires.

Usage data. Standard analytics about how the platform and website are used (pages viewed, features used, approximate location from IP), plus error and performance telemetry.

Free extraction tools. The PO extractor, invoice extractor and email order parser are open to anyone, with no account. The file you upload is processed and deleted immediately afterwards, and is never used to train AI models. We do keep a record of each use: the company the document is addressed to or from, its city and state, the document total, the number of line items, the file size, and whether extraction succeeded. We use that to improve the tools and to contact businesses that may be a fit for OrderSync. We do not keep the document itself, its line-item detail, street addresses, or the names of individuals appearing on it.

We use your data to provide the service: extracting order data from documents, matching products to your catalog, creating orders in your connected systems, showing you a review queue, and notifying you about order status. We also use aggregate usage data to improve extraction accuracy and product quality.

We do not sell your data. We do not use your order documents to train publicly available AI models.

OrderSync uses large language models to extract structured order data from unstructured documents. Document contents are sent to our AI model providers (such as OpenAI and Google) under agreements that prohibit them from using your data to train their models. Extraction results are validated against your catalog before any order is created.

We use a small set of infrastructure providers to run the service: cloud hosting and storage (DigitalOcean, Cloudflare), AI model providers (OpenAI, Google), transactional email (Cloudflare), website hosting (Vercel), product analytics (PostHog), and error monitoring. Each receives only the data needed to perform its function.

The OrderSync app for Shopify stores only your shop domain, its mapping to your OrderSync team, your plan and usage counters, and the OAuth session Shopify requires. Product, customer, and order data is read from Shopify's API when processing purchase orders.

We honor Shopify's mandatory privacy webhooks: when you uninstall the app, shop data is deleted on receipt of Shopify's shop redaction request, and customer data requests and redaction requests are processed in accordance with GDPR.

The OrderSync Integration plugin sends purchase order documents and the store settings you configure to app.ordersync.io for processing, and receives created orders back. The plugin itself stores no customer data beyond WordPress options needed for the connection (API key, security token). Uninstalling the plugin removes these options.

The OrderSync plugin (listed in ChatGPT as OrderSync EDI) lets an AI assistant such as ChatGPT, Codex or Claude use our EDI tools: check, explain or render an EDI document as a PDF, explain a rejection, read a remittance or deduction, draft 997, 855, 856 and 810 replies to a purchase order, compare related documents, check GS1 numbers and make SSCC labels, turn spreadsheet rows into an 850, work out UK late payment interest, and look up a retailer's EDI requirements. It needs no account and asks for no personal information.

What it receives. Only what the assistant sends to run the tool you asked for: the EDI document or spreadsheet rows (pasted text, or a temporary link to a file you attached, which we download once to read it), barcode numbers, invoice amounts and dates, or a retailer name. EDI documents can contain business names, addresses and contact details of the trading partners named in them.

How it is used and kept. The input is processed in memory to produce the result and discarded when the request ends. We do not store documents or results, do not log their contents, do not use them to train AI models, and do not use them for marketing. No AI model processes the document on our side: the tools are deterministic parsers and checks. The UK and EU trade check works differently and is described in the next section.

Request records. Our hosting provider records standard request metadata (IP address, time, response status) for security and reliability. These records hold no document contents and are kept for no more than 30 days. The assistant you use handles your conversation under its own privacy policy.

Links to our website. A result can include a link that opens the same document in one of our free tools on ordersync.io. For EDI documents the document travels in the part of the link after the # sign, which your browser keeps to itself and never sends to our servers; the page reads it in your browser. Calculator links carry their numbers in the address instead. Our analytics remove document contents and tool inputs from every address before it is recorded. The link also says it came from the plugin, so we can count visits from AI assistants.

Our free VAT number checker, EORI number checker and Peppol lookup, and the matching check in the OrderSync plugin for AI assistants, ask public registries about a business on your behalf.

What is sent, and to whom. The VAT numbers, EORI numbers, Peppol IDs or GLNs you enter, or a company name when you search Peppol by name. We pass them to the registry that holds the answer: HMRC for UK VAT and GB EORI numbers, the European Commission's VIES service for EU and Northern Ireland VAT numbers, its EOS service for EU and Northern Ireland EORI numbers, and the Peppol network and Peppol Directory. If you add your own VAT number to get a consultation number, it goes to HMRC or VIES with the check. Numbers are sent in the body of the request, never in a page or API address.

How it is kept. We keep each VAT and EORI answer in server memory for up to 10 minutes so a repeat check does not ask the registry again. Nothing is written to a database, and the numbers and names you check never go into our logs or analytics, which record only counts such as how many checks came back valid. Lists you check in bulk are read in your browser; only the numbers are sent, 10 at a time.

Who sees the answer. The registry's answer is shown only to the person who ran the check. The registries handle each request under their own terms and privacy notices.

Order documents and extracted data are retained while your account is active so you can audit how each order was created. You can request deletion of specific documents or your full account data at any time. When an account is closed, associated data is deleted within 30 days, except where retention is required by law.

Data is encrypted in transit (TLS) and at rest. Access to production systems is restricted and authenticated. API access to your connected stores uses scoped tokens that you can revoke at any time from your store's admin.

To report a security issue or a suspected breach, email james@ordersync.io with "Security" in the subject. We read every report and reply within two business days. Our contact details for security researchers are also published at /.well-known/security.txt.

Depending on your jurisdiction (including under GDPR and CCPA), you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise any of these rights, email us — we respond to verified requests within 30 days.

Questions about this policy or your data: james@ordersync.io.

We may update this policy as the product evolves; material changes will be noted on this page with a new "last updated" date.