1. About Orion
Orion is the trading brand under which Fortress Fulfillment Ltd (company number 16303070), a company registered in England and Wales, provides software for Shopify merchants. Our registered office is 128 City Road, London, EC1V 2NX, United Kingdom.
This policy explains the personal information involved in providing Orion Blend, Orion Blog, our support communications and related services (together, the “Services”), including information received from Shopify, directly from merchants and through service operation. References to “Orion”, “we”, “us” and “our” mean Fortress Fulfillment Ltd.
For privacy questions or requests, contact David Burkart at david@orionapps.co.uk. For product support, contact support@orionapps.co.uk.
2. What our applications do
Orion Blend provides design and visual presentation controls for Shopify storefront themes. Orion Blog provides tools for presenting blog indexes, articles, related content and reading navigation. The features a merchant enables may affect which store content the relevant app needs to access.
Merchants control their Shopify stores, their published content and the information they choose to configure through our applications. Shopify independently processes information in accordance with its own policies.
3. Information handled through the Services
Store and account information. When a merchant installs or uses an Orion application, we use the store’s Shopify domain or identifier and the information needed for installation, authentication, permissions, access and subscription administration. Business contact information may be provided directly by a merchant or made available through an authorised Shopify integration.
Merchant settings and store content. Our applications use the settings and content needed to present merchant-selected features. Orion Blend works with theme settings and design configurations. Orion Blog works with blog and article material, images, related-content selections and product references where enabled. This information may be accessed through Shopify and, where necessary for a selected feature, maintained in application configuration. Access to Shopify content does not, by itself, mean a separate permanent copy is created.
Support correspondence. If you contact us, we process the contact details, store information, messages, files and other information you choose to provide so that we can investigate and respond to your enquiry. Please do not send passwords, API credentials, payment card numbers or unnecessary personal information.
Operational information. Running an online service can involve handling technical information, such as request timestamps, IP addresses, browser or device information, service logs, security events and error details. Such information may be generated by our applications or infrastructure providers in connection with delivery, troubleshooting and protection of the Services.
Storefront visitors. Orion features can appear on merchants’ public storefronts. Their purpose is to display store content and design, not to create advertising profiles of shoppers. Loading a storefront can result in network requests and technical logs, including IP addresses, at the services delivering the page or its assets. The particular requests depend on the enabled feature, merchant theme and delivery infrastructure. Merchants remain responsible for the privacy notices and consent arrangements applicable to their own storefronts.
4. How and why information is used
We use store identifiers, account information and merchant configuration to deliver the applications and their selected features; billing and subscription information to administer plans and trials; support correspondence to respond to enquiries; and operational records to maintain service reliability, diagnose faults and protect systems. We also use information when necessary to comply with legal obligations.
Where UK data protection law applies, providing a requested service and administering its commercial relationship generally relies on contractual necessity; protecting our systems and improving operational reliability relies on our legitimate interests in operating a secure, dependable service, balanced against individuals’ rights; and legally required records rely on compliance with a legal obligation. Where consent is required for a particular use, that use must have a valid consent basis.
We do not treat installation of an Orion app as permission to use customer information for unrelated purposes.
5. Shopify, service providers and disclosures
Our applications exchange information with Shopify as needed to operate merchant-authorised features. Service providers supporting hosting, data storage, email delivery, logging and technical support may also process information needed to perform those functions. We limit service-provider access according to its purpose and apply the contractual and security safeguards required by applicable law.
We may disclose information where required by law, to protect legitimate rights and security, or as part of a corporate transaction subject to appropriate safeguards. We do not disclose merchant or shopper information simply because another merchant requests it.
6. International processing
Orion is operated by a UK-registered company and serves merchants internationally. Service providers may process information outside the United Kingdom. Where international data protection rules apply, transfers must be supported by a recognised legal basis or appropriate safeguards. For information about transfers relevant to your request, contact david@orionapps.co.uk.
7. Retention, uninstalling and deletion
We retain personal information only as long as necessary for its purpose. Retention is determined by the duration of an app relationship, the need to maintain settings or resolve support requests, security and troubleshooting needs, applicable accounting or legal obligations, and the time needed to establish or defend legal claims. These criteria differ between account records, support messages and technical logs.
Uninstalling an app ends that app’s access to the merchant’s store through the installation, but does not necessarily cause every historical support, security or legally required record to disappear immediately. Information that we are obliged or entitled to retain may remain for the applicable period. Information in backups may remain until the normal backup lifecycle expires, subject to appropriate restrictions.
We handle applicable Shopify customer-data and shop-data requests through the platform’s required privacy processes in addition to requests received directly.
8. Security
We seek to use reasonable organisational and technical safeguards appropriate to the nature of the information and the risks involved. No internet-based service can be guaranteed completely secure. Merchants are responsible for protecting their own Shopify credentials and controlling access to their store.
9. Your rights and choices
Depending on applicable law, you may have rights to access, correct or delete personal information, restrict certain uses, receive portable copies where applicable, and object to processing based on our legitimate interests. Where we rely on consent, you may withdraw it without affecting processing already lawfully carried out.
Please send privacy enquiries to david@orionapps.co.uk, identifying the relevant store and Orion application where possible. We may ask for information reasonably needed to verify a request before responding. If you are a shopper, the store at which you interacted may be best placed to identify your data and initiate any request involving its Shopify records.
If UK data protection law applies, you may also raise a concern with the UK Information Commissioner’s Office at ico.org.uk.
10. Changes to this policy
We may revise this policy as the Services and legal requirements evolve. The date at the top will be updated when we publish a revised version. Where the law requires additional notice, we will provide it.
11. Contact
Fortress Fulfillment Ltd, trading as Orion
Questions about this document?
Contact the Orion team