Hold Rules privacy policy

Last updated 21 October 2026

Hold Rules is a Shopify app made by Worklea Services ("we", "us"). It puts fulfillment holds on new orders whose items match rules the merchant sets, and releases those holds by hand or automatically. This policy explains what data the app uses when a store installs it, why, and what happens to that data.

Our terms of service include a data processing agreement that sets out how we handle this data on your behalf.

Data the app accesses

When a merchant installs Hold Rules, Shopify lets the app read the following through Shopify's API:

Fulfillment orders: the line items of new orders' fulfillment orders (product, SKU, vendor and quantity), the order's ID and number, and the holds on them, to check them against the merchant's rules, place and release holds, and show held orders in the app.
Products: the tags, vendor and product type of the products in those orders, because rules are based on them.
Store information: the store's myshopify.com address and whether it is a development store, its time zone (for release dates), to connect the app to the right store and handle billing.

Hold Rules does not request or read customers' names, email addresses, phone numbers or shipping addresses.

Data the app stores

Access credentials: the store's address and the access token Shopify issues to the app, so the app can act on the store's behalf. These are kept in our database.
Hold rules: each rule's name, conditions (for example a product tag or vendor), what to hold, the hold reason and note, and when to release. These are kept in our database.
Hold records: for each hold the app placed, the Shopify IDs of the fulfillment order, order, hold and rule, and when it was placed, is due for release and was released. These are kept in our database so the app can release its own holds on time.
Settings: whether the app is on or paused. These are saved inside the merchant's own Shopify store, as app data attached to the store.
Server logs: technical logs that may include the store address, kept for troubleshooting.

Order contents, order numbers and product details are read when needed and not copied into our database; only the IDs listed above are kept.

How we use data

Only to provide the app: checking new orders against the merchant's rules, placing and releasing fulfillment holds, showing which orders are held, and applying the merchant's plan. We do not sell data, use it for advertising, or share it with third parties, except the services we need to run the app:

Shopify, which provides the store data and handles billing for paid plans.
Our hosting provider, whose servers run the app and store the data described above.

Payments

Paid plans are charged by Shopify on the merchant's Shopify invoice. We never see or store card details.

Retention and deletion

When a store uninstalls Hold Rules, its access credentials, hold rules and hold records are deleted from our database. Holds already placed stay on the store's orders until the merchant releases them in Shopify.
When Shopify asks us to delete a store's data, which it does 48 hours after uninstall, we delete anything remaining for that store.
Requests from Shopify to delete or report data about a specific customer are answered promptly. Since the app doesn't store customers' personal information, there is normally nothing to delete or report.
Server logs are capped in size and the oldest entries are deleted automatically.

Security

The app is served only over HTTPS. Requests from Shopify are checked to confirm they really come from Shopify. Access credentials are encrypted (AES-256) before they are stored, on a server with restricted access.

Your rights

Merchants and their customers can ask what data we hold about them, and ask us to correct or delete it, by emailing support@worklea.org. Customers of a store may also contact the store directly.

Changes

If we change how the app uses data, we'll update this page and the date at the top.

Contact

Worklea Services, support@worklea.org