Privacy Policy

Effective November 3, 2026

DrawerTally is a Shopify app that emails merchants a daily end-of-day report for each of their retail locations. It is operated by Montreux Holdings LLC, New York ("we", "us"). This policy explains what data the app accesses, what it keeps, for how long, and why.

Our role

We handle store data on behalf of the merchant who installs DrawerTally. For that data the merchant decides what happens (they are the "controller" or "business") and we act as their processor or service provider, under the data processing terms in our Terms of Service. We are responsible for our own records, such as support emails.

What we access from your store

With the permissions you grant when installing, we read:

Orders: amounts, discounts, taxes, refunds, payment transactions (type, method, amount, time) and the location where the sale happened. We use these only to calculate your report.
Locations: names and IDs, so each location gets its own report.
Cash drawer sessions (Shopify POS Pro): opening and closing balances, cash totals, adjustments, over/short amounts and any notes entered at the register.
Store details: store name, contact email, currency and time zone.

We do not request or use your customers' names, email addresses, phone numbers or addresses.

What we store

Your settings: recipient email addresses, send time, which locations to report on, and when you accepted our terms.
A history of reports sent: date, location, recipients, status and the net sales total shown in the app. We delete it after 90 days.
Addresses that used the "stop these emails" link, and when, so the store can see it.
The access credentials Shopify issues so the app can prepare reports while you are away.

Order data is read, summarized and discarded. We do not keep copies of your orders.

Report emails

Reports go only to the recipients the store chooses. Our email provider keeps a copy of each email it sends, including the report and its spreadsheet, for 30 days for delivery and troubleshooting, then deletes it. Anyone who receives reports can stop them with the link at the bottom of any report email, or by asking the store or us.

How we use it

Only to produce and deliver your reports, keep the service secure and working, and support you. We do not sell or share personal information, use it for advertising, or combine it with data from other sources.

Service providers

These providers process data for us, only to provide their service:

Shopify: the platform the app runs on; it also handles billing.
Render (United States): application hosting and database, encrypted at rest.
Resend (United States): delivers the report emails.
Google Workspace: our support email.
Cloudflare: our domain's DNS and web redirects.

We'll update this list before adding a provider that handles store data.

Where data is processed

In the United States. If your store is elsewhere, its data is transferred to the United States.

Security

All connections are encrypted in transit (HTTPS/TLS). Stored data, including backups, is encrypted at rest by our hosting provider. Access to production systems is limited to the operator of the app. Report emails are encrypted in transit where the recipient's email provider supports it, but email is not end-to-end encrypted. If a breach affects your store's data, we'll tell you without undue delay. To report a security problem, email support@drawertally.com.

Retention and deletion

Uninstalling the app stops all emails immediately. Shopify notifies us 48 hours after uninstall, and we then delete everything we hold for your store: settings, report history and credentials. You can ask for earlier deletion at support@drawertally.com.
Report history is deleted after 90 days, even while the app is installed.
If a store closes without the app being uninstalled, we delete its data about a month after Shopify stops recognizing the store.
Deleted data can remain in our hosting provider's encrypted daily backups until they expire, normally about a week. Copies of sent emails stay with our email provider for 30 days.
One thing is kept after deletion: a one-way fingerprint (hash) of your store's Shopify address and the date your free trial started, so reinstalling doesn't restart the trial. It contains no store name, sales or contact details.

Your rights and choices

Merchants can see and change their settings in the app, and uninstall to have their data deleted.
People who receive reports can stop them with the link in any report email.
Anyone can ask us to access, correct or delete personal information we hold about them, or ask about this policy, at support@drawertally.com. If the request concerns a store's data, we'll pass it to that store and help them respond. We reply within 30 days.

Your customers' privacy requests

We respond to Shopify's customer data request and deletion notices. Because we don't store customer personal data, there is normally nothing to return or delete.

Children

DrawerTally is a business tool. It isn't meant for children, and we don't knowingly collect their data.

Changes and contact

We may update this policy. Changes are posted here with a new effective date, and we'll tell merchants in the app or by email about material changes. Montreux Holdings LLC, New York, USA. Email support@drawertally.com.