Last updated 2026-09-07
PO Engine reads purchase orders your customers send you and turns them into Shopify draft orders. This page says exactly what it does with them. It is short because there is not much to say, and that is the point.
A purchase order is read the moment you upload it and the file is then discarded. What is kept is the order lines read out of it, and a fingerprint of the file used to recognise the same document arriving twice so you are never charged for it twice.
Purchase orders are read by rules, not by a language model, so nothing on them is sent to anyone. If that ever changes it will be a paid service whose terms forbid training on what is sent to it, and never a free tier.
On Cloudflare's network, in a database in Western Europe. Your Shopify data is read over Shopify's own API and only ever written back as a draft order.
Order lines and the corrections you make are kept while you have the app installed, because that is what makes the app stop asking you the same question. Delete a document and it goes immediately. Uninstall and everything goes, without you having to ask.
Read your products, customers and companies, and create draft orders. It cannot complete an order, take a payment, send an invoice, or email your buyer. Those stay your decisions, made in Shopify.
PO Engine is an app installed by a Shopify merchant on their own store. The merchant is the controller of their customers' data; this app processes it on their instructions and for no other purpose. If you are a buyer whose purchase order was read by this app, the merchant you sent it to is who to ask, and they can remove it themselves at any time.
Only what a purchase order contains and what Shopify provides to match it: the order lines, the buyer's name, email, delivery address and account number where the document states them, and the merchant's own product catalogue, customers and companies. Nothing is collected from anyone browsing the merchant's shop.
Nobody. There are no third-party services in the processing path, no analytics, no advertising, no trackers and no cookies beyond what Shopify's own admin sets. Data is not sold, and there is nothing here that could be sold.
A merchant can delete any document and everything read from it, from inside the app, immediately. Uninstalling removes everything for that shop without anyone having to ask. Shopify's own privacy requests are answered: a request to see what is held is shown to the merchant in the app, and a request to erase a customer removes their documents, the corrections made on them, and what the app had learned about how they word their orders.
The record that a draft order was created: its Shopify id, its total and the date. That is a billing record, it is not personal data, and it is what the merchant was charged for. The buyer's own wording and printed prices are removed from it.
Written support only, and answered in writing. Contact me@majedesigns.dev.