Effective date: 1 September 2026

Last updated: 1 September 2026

This Privacy Policy explains how OrangeFox Pte Ltd (“OrangeFox”, “we”, “us”, or “our”) collects, uses, stores, and shares information when you use the Retention Audit tool at audit.orangefox.io and when you visit our website at orangefox.io. By using our services, you agree to the practices described in this policy.

OrangeFox Pte Ltd is a private company limited by shares, incorporated in Singapore (UEN 202535501G), with its registered address at 20A Tanjong Pagar Road, Singapore 088443. We provide retention analytics and marketing infrastructure services to ecommerce businesses. For any privacy-related queries, contact us at hello@orangefox.io.

When you connect your Shopify store or use our services, we collect:

• Shopify store domain (e.g. yourstore.myshopify.com)
• Email address — optionally provided on the results page for follow-up communications
• Company name, VAT/Tax ID, and invoice email — provided optionally when purchasing an Advanced plan and requesting a company invoice

When you authorise Retention Audit via Shopify OAuth, we request read-only access to your store’s order history using the following Shopify API scopes: read_orders, read_customers, and read_all_orders. We access this data solely to calculate retention metrics for your store. Specifically, we process:

• Order identifiers, dates, and amounts — to calculate purchase gaps, repurchase rates, and revenue figures
• Anonymised customer identifiers — to track repeat purchase behaviour across orders. We do not store names, email addresses, or personal details of your store’s end customers.
• Order landing site and UTM parameters — to classify orders by acquisition channel (paid, organic, or unknown)
• Product collection and tag metadata — used once at connection time to infer your store’s product category. Not stored beyond the category classification.

Your Shopify access token is encrypted at rest using AES-256-GCM encryption and is used only to fetch order data during audit processing. We never share access tokens with third parties.

Payments for the Advanced plan are processed by Stripe, Inc. OrangeFox does not store credit card numbers, bank details, or any payment card data. We store only the Stripe session ID and payment intent ID for transaction reference and invoice generation purposes. Stripe’s privacy policy is available at stripe.com/privacy.

When you visit orangefox.io or use the Retention Audit tool, we may automatically collect:

• Log data — IP address, browser type, pages visited, time spent — collected via our hosting infrastructure (Dreamhost for orangefox.io, Vercel for audit.orangefox.io)
• Analytics data — page views, session duration, referral source — collected via Google Analytics 4 and Google Tag Manager on orangefox.io
• Error and performance data — anonymised error reports and stack traces collected via Sentry on the Retention Audit tool. Sentry is configured to strip access tokens and email addresses before transmission.
• CDN and security data — requests to orangefox.io pass through Cloudflare’s network for security and performance. Cloudflare may process IP addresses and request metadata. NitroPack CDN is used on orangefox.io for performance optimisation.

We use the information collected for the following purposes:

• To provide the Retention Audit service — processing your Shopify order data to calculate and display retention metrics
• To generate your audit report — computing repurchase rates, purchase gaps, buyer segments, channel attribution, revenue leak estimates, and related metrics
• To send transactional emails — purchase confirmations, invoice delivery, and (with your email address) a one-time follow-up email about your audit results. We use Resend to deliver these emails.
• To manage our CRM — your shop domain, email, and audit results are recorded in our internal Notion workspace for lead tracking and follow-up by the OrangeFox team
• To process payments — facilitating your Advanced plan purchase via Stripe and generating our own branded invoice PDF
• To improve our services — analysing aggregate, anonymised usage patterns via Google Analytics 4
• To monitor application health — capturing errors via Sentry to diagnose and fix technical issues

For users in the European Economic Area (EEA) and United Kingdom, we rely on the following legal bases:

• Contract performance — processing necessary to provide the Retention Audit service you have requested
• Legitimate interests — fraud prevention, security monitoring, service improvement, and CRM management, where these interests do not override your rights
• Consent — where we send marketing or follow-up communications and you have provided your email address
• Legal obligation — where we are required to retain records for tax or legal compliance purposes

We do not sell your personal data. We share data only with the following processors, solely to the extent necessary to provide our services:

We retain your data for the following periods:

• Audit results and associated metrics — retained indefinitely so you can return to your report. You may request deletion at any time by contacting hello@orangefox.io.
• Encrypted Shopify access tokens — retained while your audit is active. Tokens are refreshed automatically when they expire. You may revoke access at any time from your Shopify admin under Settings > Apps and sales channels.
• Email addresses and contact information — retained until you request removal
• Payment records (Stripe session ID, payment intent ID) — retained for 7 years for accounting and legal compliance
• Error logs (Sentry) — retained for 90 days
• Website analytics (Google Analytics 4) — retained for 14 months per GA4 default settings

OrangeFox is incorporated in Singapore. Some of our service providers are located in the United States and other countries. Where we transfer personal data from the EEA or UK to countries without an adequacy decision, we rely on Standard Contractual Clauses (SCCs) or the processors’ own certification (e.g. Stripe, Google) as the transfer mechanism. For transfers from Singapore, we comply with the Personal Data Protection Act 2012 (PDPA) and its cross-border transfer obligations.

Under the Singapore Personal Data Protection Act, you have the right to access and correct personal data we hold about you. To exercise these rights, contact us at hello@orangefox.io. We will respond within 30 days.

If you are located in the EEA or UK, you have the following rights:

• Access: Request a copy of the personal data we hold about you
• Rectification: Request correction of inaccurate personal data
• Erasure: Request deletion of your personal data (“right to be forgotten”)
• Restriction: Request that we limit how we use your data
• Portability: Request your data in a structured, machine-readable format
• Objection: Object to processing based on legitimate interests
• Withdrawal of consent: Where processing is based on consent, withdraw it at any time

To exercise any of these rights, contact us at hello@orangefox.io.

Our website at orangefox.io uses cookies for analytics (Google Analytics 4 via Google Tag Manager) and performance optimisation (NitroPack). The Retention Audit tool at audit.orangefox.io uses session cookies only for the OAuth authorisation flow and does not use advertising or tracking cookies. You may control cookie preferences through your browser settings. Disabling cookies on the audit tool may prevent the Shopify connection flow from completing.

We implement appropriate technical and organisational measures to protect your data, including: AES-256-GCM encryption of Shopify access tokens at rest; TLS encryption for all data in transit; row-level security on our Supabase database; Sentry error monitoring configured to strip sensitive data before transmission; and access controls limiting data access to authorised OrangeFox personnel only.

The Retention Audit service is intended for business users and is not directed at children under the age of 13. We do not knowingly collect personal data from children.

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this document. We encourage you to review this policy periodically. Continued use of our services after changes are posted constitutes your acceptance of the updated policy.

For any questions, concerns, or requests relating to this Privacy Policy or your personal data, please contact:

OrangeFox Pte Ltd

• 20A Tanjong Pagar Road, Singapore 088443
• Email: hello@orangefox.io
• UEN: 202535501G