LatelingLateling Privacy Policy
Last updated: 31 October 2026
In one sentence: Lateling reads your customers' orders from Shopify straight into your own browser, and we never see them.
Who we are
Sudarshan Hosalli (sole proprietor), Kusnoor, GB Jnanaganga, Kalaburagi Reshmi College, Kalaburagi, Karnataka 585106, India, sudarshanhosalli90956@gmail.com. Contact us at sudarshanhosalli90956@gmail.com for any privacy question.
What Lateling does
Lateling is a Shopify app that works inside your Shopify admin. It lists recent orders that look late or stuck, finds a customer's order by email, name or order number, and shows its delivery status and tracking, with reply templates. An optional Chrome extension shows the same details in a side panel next to emails in Gmail.
Data we handle, and where it goes
| Data | Where it lives | Do we receive it? |
|---|---|---|
| Customer and order data (names, emails, shipping addresses, order contents, tracking) | Admin page: fetched by your browser from Shopify, as the staff member who is signed in, and shown on screen; it exists only in the page's memory while the page is open. Gmail add-on: fetched directly from Shopify to your browser and held in memory (chrome.storage.session) for up to 5 minutes, then discarded; also cleared when you close the browser. |
No. It never passes through our server and we never store it. |
| Email content from Gmail (Gmail add-on only: sender address, subject, message text) | Read inside your browser only to find the right customer and order number. | No. It is never transmitted anywhere by Lateling. |
| Shopify access used by the admin page | Held by Shopify. We hold no token for the admin page. | No. |
| Shopify access and refresh tokens (Gmail add-on only) | Stored in your browser (chrome.storage.local). |
They pass through our server in memory during sign-in and token refresh (about every hour). They are not stored or logged. |
| Connection code | A signed code that works for 10 minutes and contains only your shop's domain. Our server creates it when you ask for it on the admin page's Gmail add-on tab, after checking Shopify's session token. It contains no token or password. | We create it; we do not store it. |
| Reply templates, late limits and sign-off | Saved in your own Shopify store (an app-owned metafield). The admin page and the Gmail add-on read it; the add-on keeps a copy in your browser. | No. |
| Access log (who used Lateling to look at orders) | Saved in your own Shopify store (an app-owned metafield, next to your settings). Each entry has the time, whether it was through the admin page or the Gmail add-on, who (the Shopify staff user ID, or the Gmail address of the person using the add-on), what they did (for example "opened an order's details" or "copied a reply") and the order names, such as #1042. It never holds a customer's name, email or address, or what was typed in a search. Kept for 90 days (at most 1,000 entries) and shown on the admin page's Settings tab. | No. It is written to your store by your browser and is not sent to us. |
| Monthly lookup counter (Gmail add-on) | Your browser only. It keeps a one-way fingerprint of each looked-up thread and query for the current month (to count lookups), not the customer's email or your search text. | No. |
| Plan and billing status | Shopify App Pricing: you choose a plan on Shopify's plan page and Shopify bills you; the app asks Shopify which plan the store is on. | No. We do not see payment details. |
| Uninstall / mandatory privacy webhooks from Shopify | Our server acknowledges them. | We hold no customer or shop data, so there is nothing to delete or export. |
Our server (a Cloudflare Worker) has request logging switched off. It handles only: checking Shopify's session token when you create a connection code, the Shopify sign-in handshake and token refresh for the Gmail add-on, and Shopify's required webhooks. It also serves the admin page's static files; the admin page reads orders through Shopify, not through our server.
The access log is a record kept with your store's own access, so a member of your staff with the right access could in principle change it from their own browser. Treat it as a convenience record, not tamper-proof evidence.
Third parties
- Shopify: the source of order data, the place your settings are saved, and our billing. Governed by Shopify's own terms and privacy policy.
- Cloudflare: hosts our small server. It processes network traffic as any host does.
- InboxSDK (Streak): the open-source library that lets the Gmail add-on display inside Gmail. The library sends its own usage events and
error reports to
api.inboxsdk.com, which can include a hash of your email address, a session identifier and the name of the Gmail feature used. Lateling does not add order or customer data to those reports. InboxSDK is operated by Streak; see Streak's privacy policy. - Google: Gmail is where the optional extension runs. We do not use the Gmail API and have no access to your Google account.
We do not sell data, use it for advertising, or use it to train AI models.
Shopify access
Lateling requests the Shopify scopes read_customers and read_orders (read-only) and, because they include personal data,
works under Shopify's Protected Customer Data requirements. It cannot create, change, refund or cancel anything.
Retention and your choices
- Disconnecting a store in the Gmail add-on's settings deletes its tokens from your browser immediately. To also revoke Shopify's side, uninstall the app in your Shopify admin.
- Uninstalling the extension removes everything it stored in your browser. Your saved settings and the access log are in your own Shopify store, under your control there; entries older than 90 days are dropped automatically as new ones are written.
- Because we store nothing about you or your customers, there is nothing to request from us. Questions about a specific customer's data should go to the store that holds it.
Security
The admin page runs inside Shopify's admin using Shopify's App Bridge and session tokens, and is served with a strict content security policy. The Gmail add-on's tokens stay in the extension's private storage (not readable by Gmail or other pages). Sign-in uses Shopify's OAuth with signed state and HMAC verification; traffic is HTTPS only.
Changes
We will post updates here and update the date above. Material changes will be announced in the extension.