Cleatly privacy policy

Last updated 2026-09-27

Cleatly: Click and Drop Sync ("Cleatly", "we") is a Shopify app that sends a merchant's Shopify orders to that merchant's own Royal Mail Click & Drop account and brings tracking numbers back to Shopify. This policy explains what data the app handles for merchants who install it and for their customers.

Who is responsible

For customer data in orders, the merchant is the controller and Cleatly processes it on the merchant's behalf. For merchant account data (shop domain, contact email, plan), Cleatly is the controller. Contact: support@saypdf.com.

What we access and why

Data	Why	Where it goes
Customer name and delivery address	Needed to create the shipment and customs declaration	The merchant's own Click & Drop account
Customer email and phone	Royal Mail delivery notifications, only if the merchant turns this on	The merchant's own Click & Drop account
Order contents, values, weights, HS codes, origin	Packages and customs declaration	The merchant's own Click & Drop account
Tracking numbers	Marking the order fulfilled in Shopify	Shopify
Merchant contact email	Alerts about failing orders, weekly summary, plan and setup reminders, replies to support requests	Our email provider (sending only)
Support requests the merchant writes in the app	Answering them	Stored encrypted; read only by the operator
Click & Drop API key	Calling Click & Drop on the merchant's behalf	Stored encrypted; never shared

We do not sell data, use it for advertising or profiling, or share it with anyone other than Royal Mail (the merchant's own account), Shopify, and the infrastructure providers that host the app.

How long we keep it

Order notifications from Shopify, which contain customer details, are stored encrypted and deleted 7 days after they are processed, or 7 days after they arrived if they could not be processed.
For each order we keep the Shopify order number, its Click & Drop id, its status, the destination country, the tracking number, and an order summary for the merchant's order list: product names, SKUs, quantities, and the order total and currency. No customer names, addresses, emails or phone numbers.
Support requests are kept while the app is installed, so earlier answers stay available, and erased with the rest of the shop's data.
Database backups are encrypted (AES-256) and kept for 14 days, then deleted. Data erased from the app disappears from backups when those backups expire.
When a merchant uninstalls, Shopify asks us 48 hours later to erase the shop's data, and we do. We keep only the shop domain and whether it has used a free trial.
When Shopify forwards a customer's erasure request, we delete any stored notifications for that customer's orders.

Security

Data is encrypted in transit (TLS) and at rest (AES-256-GCM for API keys, access tokens, order notifications and support messages). Access to production systems is limited to the operator. Requests to Royal Mail may be routed through dedicated servers we operate, which forward them without storing their content.

Your rights

Customers should contact the merchant they ordered from; we act on the merchant's instructions and on Shopify's privacy requests. Merchants can request access to or deletion of their data at support@saypdf.com. UK and EU residents can complain to their data protection authority (in the UK, the ICO).

Changes

We will update this page and its date when the policy changes, and email merchants about material changes.