Privacy policy

This policy explains how Docket: PDF Invoice Printer ("Docket") collects, uses, stores, shares, and deletes personal information. Docket is operated by Tactic Consulting Services LLC, a company established in the United States.

Information we process from Shopify

Docket receives only the Shopify data needed to provide the service. This can include your shop domain and Shopify identifiers; subscription status; orders, draft orders, refunds, and fulfillment details; document and order identifiers; line items, prices, discounts, taxes, currencies, and payment or fulfillment status; and customer name, billing and shipping addresses, and email. Docket does not request or retain customer or address phone values or order notes. A merchant-configured VAT value can be selected from transient Shopify custom attributes for the document; the complete attribute collection is not retained.

Information you provide

Merchants can provide business names, addresses, tax identifiers, numbering preferences, template text, brand colors, logos, and other document settings. If you contact Docket, we process the contact details, conversation, and any order or document references you choose to share. Visitors who use Docket's public pre-sales chat can provide a conversation and, only if they ask for follow-up, an email address.

Information from visitors and customers

The Docket marketing site does not use advertising cookies, behavioral analytics, or cross-site tracking. When someone visits a Docket page, opens a hosted document link, or uses public chat, our infrastructure provider processes ordinary request information such as IP address, browser and device details, requested URL, and request time to deliver and secure the service. Public chat uses Cloudflare Turnstile and a short-lived session token to prevent abuse.

Docket does not collect information directly from a merchant's storefront visitors through pixels or other tracking technology. Customer information reaches Docket through Shopify or when a merchant or customer contacts us about a document.

How we use information

We use the information described above to:

• Authenticate merchants and operate Docket inside Shopify.
• Generate, store, retrieve, and deliver invoices, packing slips, credit notes, and quotes.
• Apply merchant settings and maintain document numbering and version history.
• Confirm subscription entitlement through Shopify and prevent unauthorized writes.
• Answer support and pre-sales questions that a user submits.
• Protect Docket, prevent abuse, troubleshoot failures, and comply with legal obligations.

We do not sell personal information or share it for cross-context behavioral advertising. We do not use merchant, order, or customer information for advertising, behavioral tracking, profiling, or a decision with legal or similarly significant effects, and we do not use it to meter product usage. Docket places no storefront pixel, sends no customer marketing, and does not contact a customer directly. Merchant-configured Shopify notifications remain the customer delivery channel. A future feature requiring customer consent or an opt-out cannot ship until it applies the relevant Shopify consent state.

Documents are stored records

When Docket generates a document, it stores a snapshot of the relevant order data together with the rendered PDF. This keeps the document exactly as issued even if the live Shopify order changes later. Docket also stores the identifiers, settings, sequence information, and access token needed to index and retrieve that record.

Support conversations and AI

Public pre-sales chat and authenticated in-app support use language models to answer the questions a user chooses to submit. Default responses are processed through Cloudflare Workers AI. When explicitly requested, authenticated support can use Anthropic's Claude through Cloudflare AI Gateway for an escalated response. Authenticated support can retrieve limited operational references, document type and status, timestamps, and subscription state for the current merchant when needed to answer the request. Protected customer data never enters a language model prompt or tool result. This includes names, email, addresses, VAT values, PDFs, document snapshots, access tokens, storage references, and raw database rows.

Conversation history and summaries can be stored so the conversation can continue and support has the context the user provided. AI Gateway caching is disabled for support and pre-sales conversations. Docket does not use merchant, order, customer, support, or pre-sales data for model training, profiling, advertising, or significant automated decisions. If the assistant does not resolve your question, you can email support@docketpdf.com for direct support. Do not submit information to chat that is not needed for your question.

Service providers and disclosure

Docket uses Shopify to provide app installation, authentication, commerce data, and billing. Cloudflare provides hosting, databases, object storage, key-value storage, durable storage, security, email delivery, and AI infrastructure. Anthropic provides model processing only for explicitly requested authenticated-support escalations. These providers process information on our behalf to provide their contracted services.

We may also disclose information when required by law or when reasonably necessary to protect the rights, safety, and security of Docket, its users, or others. We do not rent or sell merchant or customer data to third parties.

Retention

Documents are records. PDFs, order snapshots, document indexes, merchant settings, and public customer links remain stored while Docket is installed. If billing ends while Docket remains installed, those records remain so resubscribing can restore the same archive. Billing cancellation does not start a deletion timer.

While Docket remains installed, an authenticated merchant can request a complete archive of every stored rendered PDF from the Documents screen. The archive includes a manifest and is built from Docket's stored records without using live Shopify data or re-rendering documents. It is not limited by Bulk Print's current result page. This archive export remains available if billing ends while Docket remains installed.

Authenticated support conversations and summaries are retained for no more than 12 months after last activity. Public pre-sales conversations, summaries, and contact details are retained for no more than 6 months after last activity. Protected-data access events and monthly reviews are retained for 12 months. Infrastructure logs that can contain personal data are retained for no more than 30 days. Public chat session tokens expire after 30 minutes. Email verification codes expire after 10 minutes, and their rate-limit counters expire after one hour.

Customer data requests and private exports

When Shopify sends a verified customer data request, Docket creates a ZIP containing a manifest and every matching stored order snapshot and PDF identified by the customer and order identifiers in the request. The ZIP stays in private storage. Docket emails a private, unguessable download link only to the verified store owner or merchant; the buyer or customer is not emailed directly by Docket.

The private download link expires after 30 days and stops working immediately if the app is uninstalled or the shop is redacted sooner. Expired links do not work while storage cleanup is pending.

Deletion

Docket processes Shopify lifecycle events that require shop-data deletion. The app/uninstalled event queues deletion, and shop/redact deletes the shop's Docket data, including its documents, snapshots, PDFs, settings, sessions, contact associations, support state, pending exports, secure download tokens, and generated ZIPs. Former public and export links then return not found. Queued work cannot recreate data from the deleted installation, and Docket creates or retains no automatic post-uninstall archive.

Customer-redaction requests delete only the matching customer's document records, stored snapshots and PDFs, access tokens and public links, and support contact identity and conversation state. A request does not delete another customer's records. Docket does not silently retain this customer data under the general "documents are records" policy. If a law requires a specific retention exception, Docket handles and documents that exception and its legal basis explicitly rather than applying a blanket exception.

International processing

Tactic Consulting Services LLC is established in the United States. Docket and its service providers can process information in the United States and other countries, which may have different data-protection laws from the country where the information originated. Where required, we rely on our providers' contractual and other lawful transfer safeguards.

Security

Docket uses transport encryption, access controls, signed access tokens, and Cloudflare storage encrypted at rest. Docket creates no application-managed backup or production data copy for development or staging. Provider-managed encrypted durability and recovery copies are subject to access controls and bounded provider retention. Current object storage remains authoritative after deletion, and recovery cannot recreate a missing object. No system is completely secure, but we limit access to information to operating the service, protecting it, and helping with a support request a user opened. Read the security overview or report a security concern to security@docketpdf.com.

Data processing terms

Docket's technical Data Processing Addendum draft describes merchant and Docket roles, instructions, security, subprocessors, transfers, rights assistance, deletion, audit, and incident obligations. It is available at /dpa and remains subject to legal counsel review before approval or contractual use.

Your privacy rights

Depending on where you live, you may have rights to access, correct, delete, restrict, or object to processing of your personal information, or to request a portable copy. You may also have a right to appeal a decision or complain to a data-protection authority. Docket will not discriminate against you for exercising an applicable privacy right.

If you are a customer of a Shopify merchant, contact that merchant first because the merchant controls the underlying Shopify order. You can also contact us directly using the details below for a verified privacy request.

Changes to this policy

We may update this policy when Docket's data practices or legal obligations change. We will post the revised policy here, update the date above, and provide any additional notice required by law.

Contact us

Questions or privacy requests can be sent to support@docketpdf.com or mailed to:

Tactic Consulting Services LLC
169 Madison Ave, STE 11653
New York, NY 10016
United States