Trade Counter
Privacy Policy
Version 1.1 · Effective 10 September 2026 · Operated by Orumio
Trade Counter runs a merchant’s wholesale order desk. It reads the email conversations in the mailbox the merchant connects, matches each retailer request to the merchant’s own system of record — Shopify B2B, or Zoho Inventory + Books — and prepares or performs the order-desk work (quotes, availability answers, purchase orders, order-status answers) under a policy the merchant has ratified. To do that it stores the business contact details of the merchant’s retail buyers and the text of their emails. This page says exactly which data, why, for how long, and who else can see it.
1. Who we are
Trade Counter (the “app”) is built and operated by Orumio (“we”, “us”).
| Operator | Orumio |
| Representative | Masanori Iwata |
| Address | Mitsuhashi Building 3F, 1-3-3 Kita-Aoyama, Minato-ku, Tokyo 107-0061, Japan |
| Contact | support@orumio.com |
| Telephone | Disclosed without delay in writing or by email upon request to the contact address above. |
When you connect your system of record and your mailbox you are the controller of the personal data in them; we act as your processor and process it only to provide the app to you, on your instructions. The terms of that relationship are set out in our Data Processing Agreement, which forms part of your agreement with us.
2. What personal data the app processes
2.1 Stored by the app
| Data | Personal data? | Why it exists | Source |
|---|---|---|---|
| Company (retailer) names, external ids | No — business identifiers | To know which retailer wrote | Shopify B2B, or the Zoho Books contact |
| Company location names, shipping and billing addresses, payment terms, currency | Address fields can identify a person at a small business | To lock a purchase order to the retailer’s recorded ship-to and terms — the app never ships anywhere else | Shopify B2B, or the Zoho Books contact’s addresses |
| Company contacts: name, business email, business phone, job title, role per location | Yes | To verify that the sender of an email is a buyer who may order for that retailer and location | Shopify B2B, or the Zoho Books contact persons |
| Product variants or items (SKU, title, status) | No | To match ordered lines to the merchant’s products | Shopify, or Zoho Inventory |
| Orders and draft orders (PO number, lines, prices, status, fulfilment and tracking) | Order lines can be linked to a buyer | To answer status questions and to record what the app prepared. On Zoho these are read for each question and never copied into our database | Shopify |
| Email messages in the connected mailbox: sender, recipients, headers, subject, text, attachments | Yes | To interpret order-desk requests and to write the reply in the same thread | The merchant’s Gmail or forwarding address |
| Receipts, exceptions, audit and job events | Reference a contact or message by id | The merchant-visible record of what was done and why | The app |
| The merchant’s staff accounts (name, email) | Yes — the merchant’s own staff | To run the workspace and record who did what | Sign-up |
| The Zoho contact and item records as read, kept verbatim | Yes — the contact record contains its people, their emails and its addresses | So a field can be re-derived without a second call against the organisation’s daily API budget. It is the same data as the three rows above, in the shape Zoho returned it | Zoho Books and Zoho Inventory |
| System-of-record and mailbox access tokens | No — credentials | To read records and send replies while nobody is signed in. Encrypted (§5) | OAuth |
2.2 Read live, not stored
Prices are calculated by the merchant’s own system of record for the retailer’s purchasing entity at the moment of each quote or order and copied into the receipt; inventory is read live and never mirrored as an authority. On Shopify that calculation is a read. On Zoho there is no such read, so the app creates a draft Estimate or Sales Order in the merchant’s organisation to obtain the authoritative total, and deletes it again on every path that does not go on to place the order — proving it gone by reading for it. The merchant is told this before they connect, and accepts it: the visible consequence is a consumed document number and an entry in the organisation’s activity log. Nothing is emailed by Zoho at any point.
3. Why we process it
One purpose: to run the merchant’s order desk — the customer-service and store-management purposes we declared to Shopify when we requested access to protected customer data, and the same purposes on Zoho. The app makes no decision with a legal or similarly significant effect on any person: it prepares orders and answers a merchant has authorised per class, starts every class in “Watch” (nothing is sent; on Shopify nothing is written; on Zoho a draft is created to read the total and deleted again), holds each action for a cancel window before it runs, and turns anything it cannot verify into an exception for a human. A retailer can always reach a person: replying to any message puts it in front of the merchant’s staff.
We do not, and the app has no mechanism to:
- use personal data for marketing, advertising or profiling;
- sell or share personal data with anyone, or transfer it to a data broker;
- use personal data to train machine-learning models (our interpretation provider's terms state that API inputs and outputs are not used to train models);
- build analytics or audience products out of your data.
4. Who else processes it (sub-processors)
| Service | Role | Personal data it can see |
|---|---|---|
| Shopify | The platform your store runs on, when Shopify B2B is your system of record | All store data — Shopify is the source of truth and its own privacy terms govern it |
| Zoho (the data centre your organisation is in) | The platform your records run on, when Zoho Inventory + Books is your system of record | Your organisation’s own data — Zoho is the source of truth and its own privacy terms govern it. Your organisation stays in the data centre it is already in; we call only the regional host that answered your authorisation |
| Vercel (United States) | Application hosting, and a private file store | Data in transit while a request is served, runtime logs (ids only), and the attachment files of the mail you forward, which rest in a private store |
| Neon (United States) | Managed Postgres database | Everything in §2.1, at rest |
| Anthropic, via Vercel AI Gateway (United States) | Interpretation of message text into structured claims | The new text of a message, its quoted parts, subject, attachment text and filenames. No customer-facing text is generated; their published terms state that API inputs are not used for training |
| Google (United States) | Gmail, when you connect a Gmail mailbox | The mailbox you connect, under your Google account’s terms |
| Resend (United States) | Forwarding intake and notification email | Messages forwarded to your intake address; the notification emails we send you |
| Inngest (United States) | Background job orchestration | Record ids only — never message content |
| Clerk (United States) | Sign-in for the merchant’s staff | Your staff’s names and email addresses |
| Sentry (United States) | Error reporting and product telemetry | Ids and timings only — never names, addresses, subjects or bodies |
Our database and application servers are in the United States. If you are in the European Economic Area or the United Kingdom this means your data is transferred outside that region; the safeguards are in the Data Processing Agreement (§12).
5. How it is protected
- Encryption in transit. The app is served only over HTTPS; every connection to your system of record, the database and the mailbox providers uses TLS.
- Encryption at rest. The database and its backups are encrypted by the provider (AES-256). System-of-record and mailbox tokens are additionally encrypted with AES-256-GCM under a key held only in the hosting secret store and bound to their own row, so a token copied elsewhere cannot be opened.
- Structure, not confidence. The part of the app that reads untrusted email text can neither act nor write; the parts that act see only typed, verified facts. Every reply goes to the authenticated sender, never to a “reply-to” address; every order ships only to the retailer’s recorded address.
- Separate environments. Production runs on its own database project; development and tests never touch it.
- Access. Production access is limited to the operator with multi-factor authentication; every critical change is written to an audit log the merchant can see.
- Incidents. A written incident response policy: contain within one hour, assess within a day, notify affected merchants within 72 hours of confirming a personal data breach.
6. How long we keep it
| Data | Retention |
|---|---|
| Shopify-sourced records (companies, locations, contacts, variants, orders) | While the app is installed. Refreshed from Shopify continuously; a contact removed in Shopify is revoked at once. Deleted within 30 days of uninstall or of a redaction request from Shopify |
| Zoho-sourced records (contacts, their people and addresses, items) | While the organisation is connected. Refreshed hourly; a contact removed in Zoho is marked deleted and its identity revoked at once. Zoho sends no uninstall or redaction signal, so there is no automatic deletion: disconnecting revokes our access and erases the tokens, and we erase the records within 10 business days of the merchant asking — at the latest when the workspace is closed |
| Email message text and extracted attachment text | 180 days after the message arrived. The message header (who wrote, when, subject) and the receipt built on it stay, so the merchant keeps the record of what was done |
| Receipts and exceptions | While the app is installed — they are the merchant’s record of work done |
| Audit events | 90 days |
| Job event logs | 180 days |
| Database history / backups | Provider-managed, encrypted, 1 day of point-in-time history |
We honour Shopify’s mandatory compliance webhooks: customers/data_request (we provide the merchant with what we hold about the contact), customers/redact (we delete or anonymise it) and shop/redact (we delete the merchant’s tenant). Zoho has no equivalent — it sends nothing when a merchant stops using it — so for a Zoho workspace the same three outcomes are reached by asking us, and we answer within 10 business days (§7). We say so here rather than describe an automatic deletion that does not exist.
7. Your rights
Merchants can export, correct or delete their data by writing to us; uninstalling the Shopify app deletes Shopify-sourced data as above, and disconnecting a Zoho organisation revokes our access to it. Retail buyers’ data is held on behalf of the merchant they deal with: requests for access, correction, deletion or objection can be made to that merchant or to us, and we answer within 10 business days. Residents of the EEA and the United Kingdom have the rights under the GDPR; residents of Japan those under the APPI; residents of US states with privacy laws those set out in the Data Processing Agreement, Annex IV.
8. This website
This site (trade-counter.orumio.com) runs no analytics at all: no measurement tag is built into it. It sets no cookie, stores nothing on your device, and there is nothing here for a consent banner to ask about.
The app itself is not measured. There is no analytics tag and no tracking script of any kind on app.trade-counter.orumio.com — the screens behind sign-in, where the order desk’s work is. The only third-party code that runs in your browser there is the sign-in provider’s own (Clerk, in the table above), which is what signs you in. What the app records about its own use is the audit trail and receipts described above, in the merchant’s own database.
9. Changes and contact
We announce material changes to merchants by email 30 days before they take effect. Questions and requests: support@orumio.com.