Gifting is unusual: your customer gives us personal data about other people. This page explains exactly what we hold, why, for how long, and what you and they can ask us to do about it.
Cadora is an application installed by merchants on their Shopify stores. Who controls the data depends on whose data it is:
| Data | Our role |
|---|---|
| Shopper & gift recipient data flowing through a merchant's store | Processor. The merchant is the controller. We process it on their instructions to provide the gifting service. |
| Merchant & staff account data, billing records, support correspondence | Controller. We decide how this is used to run and support our business. |
| Website visitors on cadora.app | Controller. |
If you are a shopper or a gift recipient and want your data changed or deleted, the fastest route is the merchant's store you ordered from. We will help them, and you can also contact us directly.
The point of Cadora is that one person sends gifts to many others. That means the shopper enters personal data about third parties who are not present. We hold, on the merchant's behalf:
Two consequences worth stating clearly. First, dietary and allergy information can be sensitive data in some jurisdictions; merchants should only enable those fields where they have a lawful basis, and we treat them with the same protections as the rest of the record. Second, recipients did not give us their data directly — the merchant is responsible for having a lawful basis and for the notice their privacy law requires. We support recipient requests as described in section 11.
Where a merchant enables recipient-facing features, such as asking a recipient to supply or confirm their own address, we process the recipient's response for that purpose only.
| Purpose | Basis (where GDPR applies) |
|---|---|
| Providing the gifting flow, creating orders, and sending transactional email | Performance of contract; processor acting on controller instructions |
| Saving and resuming gift carts | Performance of contract / legitimate interests |
| Support, troubleshooting, and service communication | Legitimate interests |
| Billing, tax, and financial records | Contract and legal obligation |
| Security, fraud prevention, and abuse monitoring | Legitimate interests |
| Improving and securing the service using aggregated, de-identified data | Legitimate interests |
We do not sell personal data, and we do not use recipient data for our own marketing. We do not use merchant or recipient data to train third-party generative AI models.
Shoppers pay on the merchant's Shopify checkout. Cadora never receives, stores, or transmits cardholder data. Payment processing is handled by Shopify and its payment providers under their own terms. Our own fees are billed through the Shopify Billing API, so we do not hold merchant payment card details either.
We use a small number of vendors to run the service.
| Vendor | Purpose & region |
|---|---|
| Amazon Web Services (AWS) | Application hosting, database, file storage, and infrastructure logging — United States |
| Amazon Simple Email Service (SES) | Sending transactional and pay-link emails (part of AWS) — United States |
| Shopify | Platform, orders, and billing |
Each subprocessor is bound by a written agreement with confidentiality and security obligations. We will give merchants reasonable notice before adding a subprocessor that processes recipient data.
| Data | Retention |
|---|---|
| Saved / abandoned gift carts | 30 days from last activity, then deleted or de-identified |
| Started but unpaid ("abandoned") gift orders | 90 days from creation, then deleted; cleared automatically as soon as an order is paid |
| Completed gift orders and recipient records | While the merchant's account is active, then deleted when Shopify sends us the mandatory shop-data-erasure request that follows an uninstall |
| Merchant account & configuration | Deleted on that same shop-data-erasure request following uninstall |
| Billing and tax records | As required by law, typically 7 years |
| Application and security logs | 90 days |
| Support correspondence | 24 months |
Merchants can request earlier deletion. Orders that exist in Shopify are governed by the merchant's own Shopify retention settings, not ours. Merchants should export anything they need before uninstalling.
We are based in Canada and use vendors that process data in Canada and the United States. Where personal data moves out of the UK, EEA, or another restricted region, we rely on an approved transfer mechanism such as the Standard Contractual Clauses, the UK Addendum, or an adequacy decision, together with additional safeguards where needed.
No system is perfectly secure. If a breach affects personal data we hold, we will notify affected merchants without undue delay and, where we are the processor, support their own notification obligations.
Depending on where you live, you may have the right to access, correct, delete, port, or restrict processing of your personal data, to object to processing based on legitimate interests, and to withdraw consent. You also have the right not to be discriminated against for exercising these rights.
If you are a shopper or gift recipient: contact the merchant whose store the gift came from — they are the controller and can action your request directly. You may also write to privacy@cadora.app and we will route your request to them and assist.
If you are a merchant: email privacy@cadora.app. We respond within 30 days, or sooner where the law requires. We may need to verify your identity first.
If you are in the UK or EEA you may complain to your local supervisory authority; in Canada, to the Office of the Privacy Commissioner.
Because you are the controller of shopper and recipient data, a few responsibilities sit with you:
In the gifting flow we use strictly necessary cookies and browser storage to keep a session, hold worksheet progress, and let a shopper resume a saved cart. These are functional, not advertising.
On our marketing website (cadora.app) we do not currently use any analytics, tracking, or advertising cookies of any kind. If that changes, we will add a consent banner before anything non-essential runs and update this section.
Cadora is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child's data has reached us, contact us and we will delete it.
We may update this policy. If a change is material we will give merchants reasonable notice by email or in-app before it takes effect. The "last updated" date above always reflects the current version.
Privacy questions and rights requests: privacy@cadora.app, or write to Cadora Inc., 202-2149 Yonge St, Suite 1006, Toronto, ON M4S 0C5, Canada.
We have not appointed an EU or UK representative under Article 27, and we do not have a designated Data Protection Officer. Privacy enquiries are handled by the team at the address above.
See also our terms of use.