Privacy Policy
Last updated: October 22, 2026
Touchstone Commerce LLC ("Touchstone", "we", "us") makes Dodecahedron, an app for Shopify merchants. This policy explains what data the app collects when a merchant installs it, how we use that data, and the choices merchants and their customers have. It also covers this website.
Our role
When a merchant installs Dodecahedron, the merchant controls their store's data, including their customers' data. We process that data only on the merchant's behalf, to provide the app's features, and following the merchant's instructions and Shopify's terms. Shoppers with questions about their own data should contact the store they bought from first; we will help the merchant respond.
What we collect from a merchant's store
Dodecahedron reads data from the merchant's store through Shopify's API, using only the permissions the merchant approves at installation.
| Data | Why we use it | Do we store it? |
|---|---|---|
| Store details: store domain, currency, locations, and an access token issued by Shopify | To connect to the store and run the app | Yes |
| Products, variants, prices, unit costs and inventory levels | To build mystery product pools, pick items and keep stock accurate | Yes, for products in a pool |
| Mystery orders: order and line item IDs, order numbers, the items picked, SKUs, unit costs, payment and fraud-review status, fulfillment status, tracking numbers and refunds | To fill, ship, cancel and return mystery orders, and to produce sales and reconciliation reports | Yes. For payment and fraud status, we store only whether an order is waiting to ship, and why |
| The shopper's shipping name and address on mystery orders (third-party fulfillment only) | To create the internal shipping order that the merchant's warehouse uses to deliver the box, and to keep its address up to date | No. It is copied directly from one order to another inside the merchant's Shopify store, and never saved in our systems |
| Merchant settings: fulfillment method, 3PL name, and mystery product configuration | To run the app the way the merchant chose | Yes |
We do not collect or store shoppers' email addresses, phone numbers, payment details or browsing activity, and we do not store shoppers' names or addresses. Dodecahedron does not place cookies or tracking code on the merchant's storefront.
Data we write to the merchant's store
To do its job, Dodecahedron writes to the merchant's store: it adjusts inventory, creates and updates the mystery product, creates internal shipping orders for third-party fulfillment, adds tags and staff-only notes to orders, and saves app records on orders that list the items picked. This data lives in the merchant's Shopify store and is governed by Shopify's privacy policy and the merchant's own.
How we use data
- To provide, maintain and support the app's features.
- To troubleshoot problems the merchant reports, and to keep the app secure.
- To bill for the app through Shopify's billing system.
We use data only for these purposes. We do not sell data, share it for advertising, or use it to build profiles of shoppers.
Who we share data with
- Shopify, which provides the platform the app runs on.
- Infrastructure providers that host the app and its database for us, under agreements that require them to protect the data and use it only to provide their service.
- Authorities, when the law requires it, or to protect the rights and safety of our users or others.
- A successor, if Touchstone is merged or acquired, under the same protections described here.
A merchant's 3PL or warehouse receives the internal shipping orders through the merchant's own connection to Shopify, not from us.
How long we keep data
- While the app is installed, we keep store data for as long as the merchant uses the features that need it. Reports cover the most recent 60 days of orders.
- When the merchant uninstalls, we delete the store's access token right away. When Shopify asks us to erase the store's data, which it does 48 hours after uninstalling, we delete all remaining data we hold about that store.
- When a shopper asks a store to erase their data, Shopify passes the request to us, and we delete the records we hold about that shopper's orders.
How we protect data
- Data is encrypted in transit and at rest.
- Access to production systems and data is limited to the people who need it to run and support the app, using strong, unique passwords, and access is logged.
- Test and production data are kept separate.
- We keep backups encrypted, and we have a plan for responding to security incidents, including notifying affected merchants and Shopify as required.
Requests from merchants and shoppers
Merchants can ask us at any time what data we hold about their store, or ask us to delete it, by emailing support@touchstonecommerce.com. Shoppers' requests to access or erase their data reach us from Shopify through the merchant's store, and we respond to them as required. Depending on where you live, you may have rights under laws such as the GDPR or the California Consumer Privacy Act, and we will help merchants honor them.
This website
This website doesn't use cookies or analytics, and has no forms. It loads fonts from Google Fonts, which receives your IP address when the page loads. If you email us, we use your message only to reply.
Children
Dodecahedron is a business tool for merchants and isn't directed to children.
Changes to this policy
We'll update this page if our practices change, and change the date at the top. For significant changes, we'll notify merchants who have the app installed.
Contact
Touchstone Commerce LLC
support@touchstonecommerce.com