Depositly — Privacy Policy

Effective date: October 9, 2026

Last updated: October 9, 2026

Depositly ("the App"), provided by MerchBytes ("we", "us", or "our"), lets Shopify merchants create deposit templates for bottles, containers and other returnable items, link them to product variants so that the deposit is added to those products in Shopify POS and in the online store, take returned containers back at Shopify POS, and review applied and returned deposits in reports ("the Service"). This Privacy Policy explains what information we collect, how we use and share it, how long we keep it and what rights you have when you install or use the App with your Shopify store.

Information the App Collects

We process only the information needed to provide the Service:

  • Store and account information: your store's myshopify domain, your Shopify store ID, the store contact email address that Shopify provides when you open the App, your store currency, and when and whether the App is installed. We also read your store name and time zone from Shopify when a slip is printed; we do not keep a separate copy of them.
  • Authentication information: the Shopify access token and refresh token with their expiry times, and the session tokens used to connect the App to your store and to verify each request from your Shopify admin and Shopify POS.
  • Deposit templates and settings: each template's name, amount and colour; the deposit item name; whether taxes apply to deposits; whether deposits are added automatically at POS; whether deposits are added in the online store; and the ID of the deposit product the App creates in your store. A template you delete is marked as deleted and kept with its name and amount, so that past records stay readable.
  • Linked products: the IDs of the Shopify product variants you link to each template, and the ID of each template's variant on the deposit product. To show the linked products, the App reads their titles from Shopify; we do not keep a copy of them.
  • Applied deposits: for each sale with deposits that the Depositly block records after payment in Shopify POS: the Shopify order ID and order number, the deposit template and its name, the deposit amount, the ID of the product variant the deposit was added to, the POS staff member ID and the time.
  • Returned deposits: for each return taken at Shopify POS: the amount and currency, whether the money was taken out of the cash drawer ("Cash removed") or applied to the sale ("Applied to sale"), the time, the POS staff member ID, the POS location ID and a request ID that prevents the same return from being recorded twice (random for a cash removal, based on the order for "Applied to sale"). For a cash removal we also keep the POS device ID and the ID of the Shopify cash session it was recorded in; for "Applied to sale", the Shopify order ID and order number.
  • Subscription information: the status of your Depositly subscription, which we read from Shopify billing to check access to the Service. Shopify handles the billing.
  • Report exports: when you download or email a report, a record of the report type, the period and time zone requested, whether the link was opened, and a download link that expires after 24 hours. When you email a report, we use the email address you enter only to send that email and do not save it with your store's data; like other request details, it may appear in our server request logs. The App's admin remembers the last address in your browser's local storage so that it is filled in next time.
  • Technical and support information: request and error logs kept by our servers; operational alerts our team receives by email, for example when the App is installed or uninstalled or when a request to Shopify fails, which contain your store domain and the error details; authentication details where needed to diagnose a failed sign-in; and the information you send us when you contact support or make a privacy request.

We receive this information from Shopify and Shopify POS, from what you and your staff enter in the App, and from your messages to us.

What we do not collect. Depositly does not collect personal information about your customers: no names, email addresses, phone numbers or postal addresses, and it does not read customer records or online store orders. It stores no staff names, only the numeric staff member ID that Shopify POS provides. It never receives or stores payment card details: payments are taken by Shopify POS and Shopify checkout. In the online store, deposits are added by the App's Cart Transform function, which runs on Shopify's servers and sends us nothing about your customers or their carts. The App adds no scripts, cookies or tracking to your online store and does not use advertising or analytics trackers.

Information kept in your Shopify store. The App creates a deposit product in your store, named after your deposit item name (by default "Deposit") and tagged "depositly", with one variant per template at the template's amount, and publishes it to Point of Sale and Online Store. It stores the IDs of the linked templates in an app metafield on each linked product variant, and the deposit configuration (the template variants and amounts, and the automatic and online store settings) in a metafield of the App's Cart Transform. When a cashier adds or deletes deposits by hand, the App marks the cart lines with a hidden line property (_depositly or _depositly_off). A cart line with a deposit becomes a bundle of the product and its deposit, and "Apply to sale" adds a cart discount titled "Deposit return". A "Cash removed" return is recorded in the POS device's Shopify cash session with the note "Return Deposits", the amount, the staff member and the time. All of this becomes part of the products, orders and cash records in your Shopify store.

On the POS device. The App keeps a snapshot of the current sale's deposits (templates, amounts, currency, product variant IDs and any "Deposit return" discount) in the App's storage on the Shopify POS device, so that the Depositly block can record them after payment. A snapshot older than two hours is not used; it is deleted or replaced on the next sale. While a cash removal is being confirmed, its request is kept there too, so that it is not sent twice. These entries are removed once they are sent or no longer needed.

Shopify Permissions

  • read_products and write_products: to create and update the deposit product and its variants, to store the linked templates in an app metafield on your product variants, and to show the names of linked products.
  • read_cart_transforms and write_cart_transforms: to create the App's Cart Transform, which adds deposits to cart lines, and to keep its configuration up to date.
  • write_publications: to publish the deposit product to Point of Sale and Online Store, so that deposits can be added there.
  • read_cash_tracking and write_cash_tracking: for "Remove cash", to find the open cash session of the POS device and record the cash taken out of it.

The App does not request permission to read orders, customers or staff accounts.

How We Use Information

We use information to:

  • Connect the App to your store and authenticate requests.
  • Keep the deposit product, the variant metafields and the Cart Transform configuration in line with your templates and settings, and restore them when you use Repair.
  • Show the deposits of the current sale in Shopify POS, record cash removals in the POS cash session, apply the "Deposit return" discount and print the "Cash removed" slip.
  • Provide the Applied and Returned reports and report exports.
  • Check your Depositly subscription through Shopify billing.
  • Respond to support and privacy requests.
  • Diagnose problems, keep the App secure and improve it.
  • Meet legal obligations and address disputes or misuse.

We do not sell or rent personal information and do not use it for advertising.

If the EU or UK General Data Protection Regulation applies to you, we process your store information to provide the Service you installed (performance of a contract), to keep the App secure and to support you (our legitimate interests), and where the law requires it (legal obligations). For information about your staff and sales that you process with the App, such as POS staff member IDs and order IDs, we act on your behalf as your service provider (processor).

Sharing Information

We exchange information with Shopify as needed to provide the Service. Shopify's own handling of your data is described in Shopify's Privacy Policy. Deposit records and reports are available to people who have access to the App for your store.

We use service providers to host and operate the App. Our servers and database run on Amazon Web Services (AWS) in the United States, and report emails and operational alerts are sent through AWS. Google Firebase Hosting serves the files of the App's admin interface (pages, scripts and styles); it stores none of your store's data, but like any web host it receives technical request information, such as IP address and browser type, when the admin loads. Our team receives operational alerts in an email inbox hosted by Google. If you use the App from outside the United States, your information is transferred to and processed in the United States.

When you print a "Cash removed" slip, its content (your store name, the date, "Cash removed", the note "Return Deposits" and the amount) is sent through Shopify POS to a connected printer, or to the printer you pick in the print dialog.

We may disclose information when required by law, to respond to lawful requests or to protect our rights.

Data Retention and Deletion

We keep information while the App is installed on your store and as long as needed to provide the Service. You can ask us to delete your store's data at any time by writing to the address below.

When you uninstall the App, we mark your store's installation as uninstalled, and Shopify turns off the App's Cart Transform, so deposits are no longer added. About 48 hours later Shopify sends us a shop data erasure request (shop/redact). If the App is still uninstalled at that time, we permanently delete all of your store's Depositly data: templates and settings, linked products, applied and returned deposit records, report records, and the installation record with the store contact email and the access and refresh tokens. If you reinstall the App before that request arrives, your data is kept.

Report download links expire 24 hours after they are created, and a generated report file is deleted from our server once it is downloaded.

Because the App holds no personal information about your customers, customer data requests from Shopify (customers/data_request and customers/redact) find nothing to return or delete. Deposit records contain order IDs and order numbers, but no customer details; they are kept until your store's data is deleted.

Server logs, operational alert emails and backups are not part of this deletion; we keep them only as long as needed to operate and secure the App. The deposit product (tagged "depositly") stays in your store after you uninstall; you can delete it in your Shopify admin. Shopify removes the App's Cart Transform and, after a while, the App's metafields on your product variants. Orders, discounts, cash records and printed slips in your Shopify store follow your own and Shopify's retention practices.

Your Rights

Depending on the laws that apply to you, including the GDPR and US state privacy laws, you may have the right to access, correct, update, export or delete personal information we hold about you, to object to or restrict some processing, and to complain to a data protection authority.

To make a request, email us at the address below, name the Shopify store concerned and describe the request. We may need to verify your identity or your authority to act for the store. We respond within the time required by the applicable law.

If you are a customer or staff member of a store that uses Depositly, please contact that store first; we will help the merchant respond.

Security

Requests between Shopify POS, your Shopify admin and our servers use HTTPS, and the App's API for your deposit templates, deposit records and reports accepts only requests verified with a Shopify session token for your store. Report download links use a random code and expire after 24 hours. Access to our systems is limited to people who need it to operate the App.

Changes

We may update this Privacy Policy to reflect changes to the App, our practices, or legal or regulatory requirements. We will publish the updated policy on this page and change the "Last updated" date above.

Contact Us

For questions about our privacy practices, privacy requests or complaints, email contact@merchbytes.com or write to:

MerchBytes
8 The Green, STE A
Dover, DE 19901
USA