Routewise OMS Privacy Policy
Last updated: 26 October 2026
This policy explains what data Routewise OMS uses, why, and for how long. Routewise OMS is an order routing app for Shopify, provided by ExactWhy Solutions Private Limited, India ("ExactWhy").
Contact: hello@exactwhy.com Address: B-604, Pragati IT Park, Mota Varachha, Surat, Gujarat 394101, India
Shopify also has its own privacy policy: https://www.shopify.com/legal/privacy
1. Who this policy covers
- Store owners and staff who install Routewise OMS.
- Shoppers whose orders Routewise OMS routes. We mostly see their order data through the store, not directly from them.
2. Our role
- For store data, ExactWhy acts as a service provider (a "processor" under GDPR, a "service provider" under CCPA) for the merchant, who is the controller.
- For staff accounts and our own support, ExactWhy is the controller.
3. What data we use
| Data | Who it is about | Why we use it |
|---|---|---|
| Store details: name, domain, email, time zone, currency | Merchant | Run the app and show the store's name |
| Location details: name, address, time zone, daily limits, schedules | Merchant | Route orders to the right location |
| Inventory levels for each location | Merchant | Check that a location can fulfill an item |
| Order details: order ID and number, order time, sales channel, line items, product IDs, order tags, discount codes, line item properties, totals, shipping method | Shopper (indirect) | Make the routing decision and show the reason |
| Product details: tags, product type, vendor, collections | Merchant | Match the routing rules the merchant builds |
| Customer tags, and whether the order comes from a B2B company account | Shopper (indirect) | Match the routing rules the merchant builds. Read only when a rule needs it. |
| Customer shipping address (city, region, postal code, country) | Shopper | Calculate distance and match the routing rules. We only keep what is needed for routing. |
| Staff name and email | Staff member | Show who changed a setting in the audit log |
| Support messages and setup call details | Merchant or staff | Answer your questions |
| Chat messages with Ask Routewise OMS (AI help) | Merchant or staff | Answer questions about your store's routing |
| Technical logs (errors, timestamps, request IDs) | Merchant or staff | Keep Routewise OMS running and fix bugs |
Line item properties, discount codes and customer tags are checked against the merchant's rules when an order is routed or when a rule is tested. We do not save them to our database; while a merchant edits a rule we keep them in memory for up to 10 minutes to count matching orders, then discard them.
We do not ask for customer passwords or payment card details. Routewise OMS does not read or store payment information.
We do not collect shopper names, email addresses or full street addresses for routing. If we ever need more data than this list, we will update this policy first.
4. Why we use it and legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Run Routewise OMS for the store you installed it in | Performance of the contract with you |
| Keep the app secure and stop abuse | Legitimate interest |
| Answer your support questions | Performance of the contract, and legitimate interest |
| Meet legal and Shopify requirements (for example, deletion requests) | Legal obligation |
| Improve Routewise OMS using anonymous, aggregated usage data | Legitimate interest |
We do not sell personal data. We do not use store data to train AI models for other customers.
5. Ask Routewise OMS (AI help)
Ask Routewise OMS is a read-only help chat. It can read your routing settings, decisions and help articles for your own store. It cannot change settings, publish policies or move orders.
- Chat messages are sent to our AI provider, Anthropic (Claude), to create answers. See section 7.
- We do not send shopper names, emails or full addresses to the AI model. We send city and distance only.
- Chat logs are kept for 30 days for support and quality checks, then deleted.
6. How long we keep data
| Data | Kept for |
|---|---|
| Order routing data (orders, decisions, alternatives) | 90 days by default. You can choose 30 or 60 days in Settings. |
| Audit log (setting changes) | 12 months |
| Location and policy settings | While Routewise OMS is installed, plus the deletion period in section 8 |
| Ask Routewise OMS chat logs | 30 days |
| Support emails | 2 years, then deleted. |
| Technical logs | 30 days |
| Backups | 30 days. Deleted data may stay in backups for up to 30 days. |
You can ask us to shorten the retention for your store at any time.
7. Service providers (subprocessors)
We use these service providers to run Routewise OMS. We will update this list when we change providers.
| Category | Provider | Location | What they do |
|---|---|---|---|
| App hosting and logs | Fly.io | United States (Virginia) | Runs the Routewise OMS app and keeps its error logs |
| Database | Neon (on Amazon Web Services) | United States (Virginia) | Stores store settings and routing records |
| Support email | Google Workspace (Google LLC) | United States and other countries where Google runs data centers | Support replies from hello@exactwhy.com |
| AI help chat | Anthropic (Claude) | United States | Answers questions in Ask Routewise OMS |
| Shopify | Shopify Inc. | Canada and US | Login, billing and store data |
Service providers may process data outside India, including in the US and EU. Where required, we use standard contractual clauses or similar safeguards.
8. Shopify compliance webhooks and data deletion
Routewise OMS subscribes to Shopify's three mandatory privacy webhooks:
- customers/data_request: when a shopper asks the store owner for their data, Shopify sends us the request. We return the data we hold for that customer to the store owner, using the IDs in the request.
- customers/redact: when the store owner asks for a shopper's data to be deleted, we delete the data we hold for that customer in that store.
- shop/redact: 48 hours after a store uninstalls Routewise OMS, Shopify sends this request. We delete all data we hold for that store.
We confirm each webhook with a success response, check that it really came from Shopify, and complete the deletion within 30 days, as Shopify requires. For shop/redact, we aim to delete within 48 hours of receiving the request.
If the law requires us to keep some data, we keep only that data and tell the store owner.
9. Your rights
If you are in the EU, UK or India (GDPR, UK GDPR, India DPDP): you can ask for access, correction, deletion, restriction, a copy of your data (portability) and to object to processing. You can also withdraw consent where we rely on it. Contact us at hello@exactwhy.com. You can also complain to your local data protection authority.
If you are in California (CCPA): you can ask us to tell you what personal information we hold, delete it, and correct it. We do not sell personal information and we do not share it for cross-context behavioural advertising. We will not treat you differently for using these rights.
If you are a store owner and the data is about your shoppers, please send the request to us through the store owner's Shopify admin or contact hello@exactwhy.com. We will work with the store owner to respond.
We respond within 30 days.
10. Security
- All traffic uses HTTPS.
- Shopify session tokens and webhook signatures are checked on every request.
- Secrets (API keys, database passwords) are stored in the hosting provider's secret store, never in code.
- Staff access is limited, protected with multi-factor authentication, and removed when a person leaves.
- Our support team has read-only access to a store by default. Write access needs the merchant's permission, is time-limited, and is recorded in the store's audit log as "Routewise OMS support".
- Routewise OMS does not add code to storefronts or checkouts.
No system is 100 percent secure. If we find a breach that affects your data, we will tell you as the law requires, and we will tell affected merchants within 24 hours.
11. Children
Routewise OMS is for businesses. It is not directed at children under 16.
12. Changes to this policy
We will post changes here and, for material changes, tell store owners in the app or by email at least 30 days before the change takes effect.
13. Contact
ExactWhy Email: hello@exactwhy.com Address: B-604, Pragati IT Park, Mota Varachha, Surat, Gujarat 394101, India