Privacy Notice

Workroom Production is operated by Derek Zhang, an individual based in China. Privacy and support contact: whitleylobalbo315@gmail.com.

Development notice. This notice describes the current development hosting for Workroom on Cloudflare Workers with a SQLite-backed Durable Object for synthetic development-store testing. It is not a real merchant public launch. Backup behavior and restore procedures must be verified before real merchant production use.

Information Used

From Shopify, Workroom requests read access to recent orders, including store and order identifiers, order labels and change times, cancellation/payment/fulfillment status, currency, product-line identifiers, titles, SKUs, current quantities, and custom order-line properties. Workroom does not request dedicated customer name, email, phone, or address fields.

Personalized text or custom properties may still contain a person's name or other personal information. Authorized staff can enter production text, colors, placement, sizes, notes, artwork URLs or descriptions, deadlines, confirmation references, quality-check results, rework reasons, quantities, and optional labor/material costs. Workroom records staff identifiers, versions, and action times.

Installation state, encrypted authentication tokens, policy acknowledgements, plan-verification results, first-release usage records, AI draft usage metadata, webhook receipts, and privacy-request records support access control, auditing, and allowance enforcement. A separate encrypted recovery journal records minimal privacy and uninstall event identifiers so that a future database recovery can be checked against later deletion and access-revocation requests.

Purposes

Display source orders and current order-line details.
Maintain versioned production records and source-change warnings.
Support staff quality control, rework, CSV export, and printed work sheets.
Calculate the Free lifetime allowance and Standard allowance for the verified Shopify billing cycle.
Test editable AI draft suggestions only in the operator's separately authorized synthetic development store.
Handle support, security, uninstall, and privacy requests.

Workroom does not sell this information, use it for advertising, provide a public customer portal, send customer messages, or host uploaded artwork. AI drafting is optional. When staff choose it and confirm the checkbox, Workroom sends only the text typed or pasted into the AI draft box to MiniMax for a draft response. Workroom does not attach Shopify source orders, customer contact fields, shop identifiers, staff identifiers, saved work orders, artwork files, billing data, or history to that AI request.

Development-Only AI Drafting

AI drafting is excluded from the public merchant feature set submitted for review. It is disabled by default for Shopify stores and enabled only for the operator's explicit synthetic development-store allowlist. Core work-order access does not enable AI. MiniMax does not receive data from other merchants through this feature.

When a staff member pastes requirements into the AI draft box, explicitly opts in, and selects Generate suggestions, Workroom sends only that text to MiniMax-M3 through the MiniMax China API. Workroom does not automatically attach Shopify orders, customer fields, shop or staff identifiers, saved specifications, artwork, or order history. Pasted text itself may contain personal information; include only information you are authorized to share and avoid unnecessary personal or sensitive data.

AI suggestions require individual selection and review before they are copied into the unsaved form. Saving uses the ordinary work-order workflow. AI does not confirm customer approval, release work, or decide quality checks.

Workroom does not persist or log the original AI input or complete model response. They exist transiently while generating and reviewing the draft. Selected and saved fields follow the work-order retention policy. Request IDs, shop identifiers, timestamps and usage counters are retained for up to seven days, subject to successful cleanup. Shop erasure removes shop AI metadata; anonymous aggregate daily counts are kept until expiry. Ordinary content deletion or reinstall does not reset the current daily allowance.

MiniMax is an additional service provider and this feature uses its China endpoint. Provider processing, retention and any model-improvement uses are governed by the applicable MiniMax Open Platform privacy policy and agreements. Workroom does not promise zero provider retention or a no-training arrangement. Provider contractual safeguards and cross-border requirements must be reviewed before real merchant availability. The current allowlisted deployment remains for synthetic testing.

Access and Providers

Authenticated Shopify staff access the merchant workspace. Printed QR codes point to an authenticated location and are not access credentials. The merchant decides who may use its Shopify store and must protect printed or exported information.

The core service uses Shopify for installation, staff authentication, order APIs, and billing-plan verification. Workroom runs on Cloudflare Workers with a SQLite-backed Durable Object. App secrets are stored with Cloudflare Secrets, and per-shop Shopify tokens are encrypted before storage. MiniMax's China API is used only for the separately restricted synthetic development feature above. The operator is based in China and the providers may process data in multiple locations; Workroom does not promise a fixed processing region. Applicable transfer arrangements must be established before real merchant use in a jurisdiction that requires them; this notice does not itself establish those arrangements.

Retention and Deletion

Completed or cancelled work-order content is retained for 180 days after the last business change, then eligible for cleanup. Viewing a record does not restart the period. Unfinished work orders do not automatically expire and should be reviewed by staff.

Source order lines not linked to a work order become eligible for deletion after 30 days from insertion or the last accepted source business update. Viewing or refreshing the same source version does not extend the period. Existing cache entries start this period when the retention migration is first applied.
Completed privacy-request records become eligible for deletion 180 days after completion. Shop-level operational events become eligible after 180 days. Work-order history follows its parent work order. Open privacy requests remain until resolved, including overdue requests.
Installation and policy receipts remain while service access is active. Minimal order-line identities, first-release usage debits and webhook delivery identifiers remain until mandatory shop erasure to prevent duplicate imports, allowance resets and replay of old destructive events. These are potentially linkable records, not anonymous data. Ordinary content deletion and reinstall do not reset them.
Development AI request metadata expires after 7 days; original AI input and complete responses are not persisted or logged by Workroom. Selected, saved suggestions become work-order content. Short-lived operator replay nonces are removed after their authentication validity ends.
The separate recovery journal contains only the shop identifier, relevant order identifiers, event type and delivery identifier, installation generation and a random installation identifier, timestamps and processing metadata. It contains no original customer payload, production text, contact fields or authentication tokens. These linkable records are encrypted and restricted to the service and authenticated operator. They become eligible for deletion 35 days after first receipt, subject to successful bounded cleanup; a retry does not extend this period. They may remain after shop erasure during that period to protect against accidentally restoring erased content or revoked access. This is not an indefinite audit archive.

The service checks retention hourly through a scheduled Worker and Durable Object alarms, processes bounded batches, and records run outcomes and failures. Expired content is removed after a successful cleanup pass; a backlog, outage or processing failure can delay removal. Operators must review failures, overdue requests and unfinished work rather than treating a configured schedule as proof of deletion.

Uninstalling revokes app access and stops new synchronization. A verified Shopify shop/redact callback must erase the shop installation, production content, source snapshots, identities, usage ledger, AI shop-level usage metadata, and main-database webhook receipts and privacy-request metadata unless a documented legal obligation requires retention. The separate minimal recovery journal follows the 35-day schedule above. Anonymous AI global daily counters may remain for up to 7 days. Late Shopify order events after redaction are ignored and must not create fresh production data.

Backups and logs may follow provider retention processes. Workroom has not yet configured or verified a self-managed production backup and restore process for this development deployment. Workroom cannot remove printed sheets or downloaded files retained by a merchant and does not promise that every provider copy disappears on the same day.

Privacy Requests

Customers should normally contact the merchant handling their order. Merchants can also contact the support address above. Shopify customer-data-request callbacks create tasks for operator review. Workroom does not automatically send exports. Its signed, replay-protected operator interface and a Shopify-generated empty-scope synthetic data request have been verified. Real customer delivery and platform-generated customer/shop erasure remain to be validated; queuing a request or creating an export does not fulfill it.

Verified Shopify customer redaction and shop redaction callbacks execute deletion workflows. Shopify requires mandatory privacy callbacks to be handled and requested actions completed within 30 days, except where legally required retention prevents redaction. Queuing an export request is not completion.

Changes

The effective notice must state a version and date and reflect the actual service. This notice is not a claim that legal review, public listing approval, long-term hosting, or all jurisdiction-specific compliance work is complete.