Privacy Policy

Last updated: 16 February 2026

AddressLock ("we", "our", "the app") is operated by B4SED Ltd, a company registered in England and Wales (company number 16181102). This policy explains what data we collect, why we collect it, and how we handle it.

1. What AddressLock Does

AddressLock is a Shopify app that prevents Shopify from automatically overwriting a customer's default shipping address when they place an order with a different address. It monitors order and customer events and restores the original default address.

2. Data We Collect

We collect the minimum data necessary for the app to function:

• Shop domain — your myshopify.com URL, to identify and authenticate your store
• Shopify access token — to make API calls on your behalf (stored encrypted at rest)
• Customer IDs and address IDs — Shopify's internal numeric identifiers only, used to track and restore default addresses
• Order IDs — to correlate address changes with order events
• Timestamps — when events occurred, for activity logging and data lifecycle management

3. Data We Do NOT Collect

• Customer names, email addresses, or phone numbers
• Actual street addresses, cities, or postal codes
• Order line items, products, or prices
• Payment or billing information
• Any personally identifiable information (PII) beyond Shopify's internal numeric IDs

4. How We Use Your Data

• Maintaining a baseline record of each customer's default address ID so we can detect unwanted changes
• Processing Shopify webhooks (orders/create, customers/update) to trigger address restoration
• Displaying an activity log of restore actions within your Shopify admin dashboard
• Enforcing plan limits (free tier vs. paid plan)

5. Where Data Is Stored

All data is stored on Cloudflare's global network using Cloudflare Workers and D1 (SQLite-based database). Data is encrypted at rest and in transit via TLS. We do not transfer your data to any third-party services beyond Cloudflare's infrastructure and Shopify's own APIs.

6. Data Retention

• Customer baseline records — retained while the app is installed; deleted on uninstall
• Address snapshots — retained while the app is installed; deleted on uninstall
• Activity logs — automatically pruned after 30 days
• Webhook deduplication records — automatically pruned after 24 hours
• Shop credentials — deleted when you uninstall the app

7. Data Sharing

We do not sell, rent, or share your data with any third parties. Data is only exchanged between AddressLock and the Shopify API as required for the app to function.

8. Cookies & Tracking

AddressLock does not use cookies, local storage, or any client-side tracking. The app runs entirely within the Shopify Admin iframe and does not track you outside of it.

9. Your Rights

You can:

• Uninstall the app at any time — all data associated with your store will be deleted automatically
• Export your data — use the "Export Logs" button in the app dashboard
• Request deletion — contact us and we will remove all data associated with your shop
• Request access — contact us for a full summary of data we hold for your store

If you are located in the EU or UK, you have additional rights under GDPR/UK GDPR, including the right to access, rectification, erasure, data portability, and the right to lodge a complaint with a supervisory authority (the ICO in the UK).

10. GDPR & Legal Basis

Our legal basis for processing data is legitimate interest — specifically, providing the service you installed and consented to when adding the app to your Shopify store. We process only the data necessary to deliver the app's core functionality.

11. Changes to This Policy

We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date at the top of this page.

12. Contact

For privacy questions, data requests, or concerns:

Email: [email protected]

B4SED Ltd, United Kingdom