Last updated: October 23, 2026
Effective: October 7, 2026
1. Who we are
Pasturly is an application for Shopify that gives direct-to-consumer farms the operational tools Shopify lacks: subscription boxes, selling by catch weight, pickup points and delivery routes alongside shipping, packing and staging, and cut sheets for whole and part animals. It is operated by Nature’s Grove Farm LLC (“we,” “us,” “Pasturly”), Latrobe, PA, USA.
For privacy questions, contact us at pasturlyapp@gmail.com.
Pasturly is installed by Shopify merchants (“Merchants”) on their own Shopify stores. It enables those Merchants to sell to, and deliver to, their own customers (“End Customers”).
This policy also covers our website, pasturly.com. What the website collects, and who helps us run it, is in Section 13.
Pasturly now comes two ways. Sections 2 to 12 describe the Shopify app above, Pasturly (Shopify). Pasturly (Standalone), our own platform for farms that sell without Shopify, is described in Section 14; it is not open to farms yet. How to have your data deleted, from either one, is in Section 15.
2. Our two roles
This distinction matters, and it determines who is responsible for what.
As a data controller. For information about the Merchant themselves — the account holder and staff who install and use Pasturly — we decide how and why that data is processed. This policy governs that relationship.
As a data processor. For information about End Customers — the people who buy from or subscribe to a Merchant — and about drivers and market staff a Merchant adds to Pasturly, the Merchant is the controller. We process that data only on the Merchant’s documented instructions, as set out in our Data Processing Agreement (Schedule A of our Terms of Service). We do not use that data for our own purposes.
3. Information we process
3.1 Merchant information (we are controller)
| Data | Source | Purpose |
|---|---|---|
| Store domain and store name | Shopify, on install | Account identification, support, billing |
| Name and email of the staff member signed in to the app | Shopify, on sign-in | Keeping that person signed in |
| Pasturly plan | Shopify | Deciding which features are available |
| Store currency, locale and locations | Shopify API | Prices, dates and fulfillment |
| App configuration (box plans, schedules, fulfillment channels, delivery fees, shipping reach, packing and staging set-up, cut sheet options, the processor’s name and email, where delivery routes start) | Merchant input | Operating the service |
| Support correspondence | Merchant | Responding to enquiries |
| Usage and error logs | Automatic | Diagnosing faults, improving reliability |
3.2 End Customer information (we are processor)
We access the minimum set of fields required for the service to function. Each is tied to a specific, necessary function:
| Data | Why it is required |
|---|---|
| Name | Identifying customers in the Merchant’s admin, on pick lists and pack labels, at pickups and markets, and on a driver’s route |
| Email address | Matching a waitlist sign-up or a cut sheet to the right customer and order |
| Phone number | Shown to the Merchant and their driver so the customer can be reached on delivery or pickup day |
| Shipping and billing address, and ZIP code | Working out which pickup points, delivery routes and shipping options serve the customer and on what dates; limiting shipping to the states the Merchant has chosen to ship to; placing a delivery stop on a map and planning the route |
| Map point for a delivery address | Ordering stops on a delivery route. Worked out from the street address alone |
| Order history | Building, packing and handing over orders; reconciling catch-weight orders to what was actually weighed |
| Pack weights | Charging a catch-weight order for what it actually weighed |
| Subscription details (box, schedule, contents, status, missed and rescheduled boxes) | Operating the subscription itself |
| Cut sheet choices | Telling the Merchant’s processor how a customer’s share of an animal is to be cut |
| Notes the Merchant writes about a customer | Delivery instructions and similar, for the Merchant’s own use. Never shown to the customer |
| Payment method metadata (last four digits, card brand, expiry date) | Displaying the stored card on a subscription in the Merchant’s admin. Read from Shopify when displayed; not stored by Pasturly |
3.3 Drivers and market staff (we are processor)
When a Merchant adds a driver or someone to work a market stall, we hold their name, a PIN stored only as a one-way hash (we cannot read it back), and when they last signed in.
3.4 What we never receive
We do not have access to full payment card numbers, CVV codes, or any raw payment credentials. All payment processing and credential storage is handled by Shopify. We only ever see the non-sensitive metadata listed above.
4. How we use information
We process personal data solely to:
- Create, schedule, modify and bill box subscriptions, and let subscribers change an upcoming box before its cutoff
- Take one-off and manual orders, and charge catch-weight orders for what was weighed
- Determine which fulfillment channels serve an address, and on what dates
- Limit shipping to the states the Merchant has chosen
- Build, pack, label and stage orders, and record when they are handed over
- Plan delivery routes and show drivers and market staff the orders they need
- Collect cut sheets and prepare them for the Merchant’s processor
- Handle failed payments
- Provide Merchants with operational reporting for their own customers
- Provide support and diagnose faults
We limit our use of personal data to these purposes. We do not sell personal data. We do not share it with advertisers. We do not use it to train machine learning models. We do not use End Customer data to market our own product.
5. Consent
Where a Merchant’s End Customers have made consent choices — including marketing preferences and any applicable opt-out of data sale — we respect and apply those decisions as recorded in Shopify. Pasturly does not send email or text messages to End Customers itself; notifications about an order or subscription are sent by Shopify on the Merchant’s behalf, and are transactional rather than marketing.
We do not use personal data for automated decision-making that produces legal or similarly significant effects.
6. Legal bases (UK/EU Merchants)
Where GDPR applies:
- Contract — processing necessary to deliver the service the Merchant has subscribed to
- Legitimate interests — securing the service, preventing fraud, diagnosing faults
- Legal obligation — retaining records where law requires it
For End Customer data, the Merchant determines the legal basis as controller.
7. Sub-processors and other recipients
We use a small number of third-party providers. Each is bound by contractual confidentiality and data protection obligations.
| Provider | Purpose | Location |
|---|---|---|
| Shopify Inc. | Platform, payment processing, customer notifications, data source | Canada / global |
| Railway Corporation | Application hosting, database hosting and backups | United States (US East, Virginia) |
To plan delivery routes, we send delivery street addresses — with no name, email, phone number or order details — to the US Census Bureau Geocoder, a free public service of the US government, which tells us where on a map each address is. When a driver opens turn-by-turn directions, the stop addresses are passed to Google Maps by the driver’s own phone, not by us.
The current list is maintained in Annex III of our Terms of Service at pasturly.com/terms. We will give Merchants at least 30 days’ notice before adding or replacing a sub-processor.
The providers above are for Pasturly (Shopify). Those for Pasturly (Standalone) are in Section 14.5.
8. Retention
We do not keep personal data longer than needed.
| Data | Retention |
|---|---|
| Active subscription and order data | For the life of the subscription, or for as long as the order is being built, packed and handed over |
| Cancelled subscription data | 90 days after cancellation, then deleted |
| Map points for delivery addresses | For the life of the installation, so the same address is not looked up twice |
| Merchant account and configuration | Duration of installation |
| All Merchant and End Customer data after uninstall | Deleted when Shopify sends shop/redact, normally about 48 hours after uninstall, and in every case within 30 days |
| An End Customer’s data after Shopify asks for it to be erased | Deleted on receipt of customers/redact, except a share of an animal they bought, which is kept without their name. See below |
| Support correspondence | 24 months |
| Access and security logs | 12 months |
| Financial records | As required by law, typically 7 years |
| Anything held in a backup | Until that backup expires — at most 89 days. See below |
| A farm’s nightly export, held outside the database | 30 days |
About shares of an animal. When a customer buys a whole, half or quarter of an animal, their share is also part of the Merchant’s record of that animal: how it was divided, how it was cut, what it weighed and what it sold for. When Shopify asks us to erase that customer, we remove their email address and Shopify customer from the share and delete its history, and keep the rest — the cut sheet, the animal and any balance — with nothing left on it that says who they are. The share keeps the number of the Shopify order it came from, which Shopify erases the customer from itself. A share started at checkout but never bought is deleted outright.
About backups. We keep two kinds, for two different failures. Our hosting provider takes automated backups of the database itself. We also write a nightly export of each Merchant’s own records — including End Customer names and addresses — to encrypted object storage held separately from the database, because the subscriptions a Merchant has are cancelled by Shopify shortly after an app is uninstalled and that export is the only way to tell a Merchant what they had. Both live with our hosting provider in the United States, listed in Annex III of our Terms.
The retention periods above describe our live systems. We also take automated backups, so that a mistake or a failure does not cost a farm its records. A backup is a photograph of the database at a moment, and we do not reach into one to edit it — doing so would defeat the purpose of having it. So data we have deleted can still exist in a backup until that backup expires, which is at most 89 days. Backups are access-controlled, are never used to bring deleted data back into the live system, and anything restored from one is put through the same deletion rules again.
We implement Shopify’s mandatory compliance webhooks — customers/data_request, customers/redact, and shop/redact — and act on them within the required timeframes.
9. Security
We maintain safeguards appropriate to the data we handle:
- Encryption in transit. All connections use TLS, including between the application and its database.
- Encryption at rest. Databases and file storage are encrypted.
- Encrypted backups. Backups are encrypted and access-controlled.
- Tenant isolation. Every database query is limited to the store it belongs to, so one Merchant’s data is never shown to another.
- Separated environments. Development and test environments use entirely separate databases. Production personal data is never copied into test environments.
- Access logging. Access to End Customer personal data is logged with timestamp and actor.
- Access control. Access is limited to personnel who require it. Accounts use strong unique credentials and multi-factor authentication. Driver and market PINs are stored only as one-way hashes.
- Data loss prevention. Automated backups run on a regular schedule and are test-restored quarterly, with independent backup of subscription contract state.
- Incident response. We maintain a documented Security Incident Response Policy and will notify affected Merchants without undue delay, and in any event within 72 hours.
No system is perfectly secure, and we do not claim otherwise.
10. Individual rights
Depending on jurisdiction, individuals may have rights to access, correct, delete, port, or restrict processing of their personal data, and to object to processing.
End Customers should direct requests to the Merchant whose store they bought from or subscribed to, as that Merchant is the controller. We assist Merchants in responding, and act on Shopify’s compliance webhooks automatically.
Merchants may contact us directly at pasturlyapp@gmail.com. We respond within 30 days.
You may also lodge a complaint with your local supervisory authority.
11. International transfers
Pasturly’s data is stored in the United States. Data may be processed in countries other than where it was collected. Where required, we rely on Standard Contractual Clauses or another lawful transfer mechanism.
12. Cookies
Pasturly’s embedded admin, and the driver and market pages, use only cookies strictly necessary for authentication and session management. We do not use advertising or third-party tracking cookies.
For cookies on our website, pasturly.com, see Section 13.
13. This website
This section covers pasturly.com itself, rather than the Pasturly app. For anything you give us through the website, Nature’s Grove Farm LLC is the data controller.
13.1 The early-access list
When you join the early-access list we collect your name and email address and, if you give them, your farm’s name and what you tell us about what you sell and how. We use them only to tell you when there is a place for your farm and to understand what your farm needs. We do not add you to a newsletter, and we do not sell or share your details.
Each sign-up is stored in the website’s database and nowhere else. We keep a sign-up until you install Pasturly, ask us to remove it, or 24 months pass, whichever comes first. To see or remove your sign-up, email pasturlyapp@gmail.com.
13.2 Who helps us run the website
| Provider | What they do | What they receive |
|---|---|---|
| GoDaddy | Hosts the website and its database, and measures visits to it | Everything sent through the website, including early-access sign-ups; the pages you visit, your IP address and your browser details |
| Cloudflare | Delivers the website and blocks malicious traffic, on GoDaddy’s behalf | Your IP address and browser details |
| YouTube (Google) | Plays the setup videos on our Learn page | Your IP address and browser details when that page loads, and anything YouTube’s own cookies record |
These providers may process data in the United States and other countries, under their own privacy policies.
13.3 Cookies and similar technology
The website sets no advertising cookies of its own. When you visit:
- Cloudflare sets a security cookie (
__cf_bm) that tells people apart from automated bots. It expires after 30 minutes. - Our host, GoDaddy, adds scripts that measure visits and how quickly pages load.
- YouTube may set its own cookies when you open the Learn page, which plays its videos.
- People who run the website get sign-in cookies. Visitors never do.
Our fonts are served from our own website, not fetched from Google Fonts.
You can block or delete cookies in your browser’s settings. The website still works, though the videos may not play.
14. Pasturly (Standalone), our own platform
Pasturly (Standalone), called just “Pasturly” in this section, is our own platform for farms that sell without Shopify: the farm’s website and checkout, its customers’ own pages, email to its customers, and a market app for Android phones. It is not open to farms yet, and this section takes effect when it opens.
Our two roles are the same as in Section 2. For the farm’s own account we are the controller. For the farm’s customers, and the people who work for the farm, the farm is the controller and we process their data only on the farm’s instructions. Sections 6, 10 and 11 apply to Pasturly as they do to Pasturly (Shopify), with “Merchant” meaning the farm and “End Customer” one of its customers. We do not sell personal data, and we do not share it with advertisers.
14.1 What Pasturly holds
| Data | Whose | Why |
|---|---|---|
| Names and email addresses of the farm’s owner and the people they add, and the sign-in links we email them | The farm (we are controller) | Signing people in, and letting the owner decide who can do what |
| The farm’s Pasturly plan and its billing | The farm (we are controller) | Billing the plan, through Stripe on Pasturly’s own Stripe account |
| Customers’ names, email addresses, phone numbers and addresses | The farm’s customers (farm is controller) | Taking, packing and delivering their orders, and reaching them on pickup or delivery day |
| Orders and payments, CSA memberships and shares of an animal | The farm’s customers (farm is controller) | Running the farm’s sales, and its records of them |
| Whether a customer wants the farm’s news, and when and how they said so | The farm’s customers (farm is controller) | Sending newsletters and campaigns only to customers who asked for them |
| The emails sent to each customer, and for newsletters and campaigns, whether they were opened and which links were clicked | The farm’s customers (farm is controller) | Showing the farm what was sent, and how each campaign did |
| Who opened a customer’s details, and when | The farm’s staff (farm is controller) | So the farm can see who looked at what, for example if a phone goes missing |
| Usage and error logs | Automatic | Diagnosing faults, improving reliability |
Card payments are taken by Stripe on the farm’s own Stripe account. Card numbers go to Stripe, not to us: we never see a full card number or a CVV code.
14.2 Email to customers
Pasturly sends email on the farm’s behalf, through Postmark. There are two kinds, kept apart:
- Email about an order or an account: receipts, pickup and delivery reminders, bills and sign-in links. These are not tracked: we do not record whether they are opened or which links are clicked.
- Newsletters and campaigns from the farm. These go only to customers whose wish to receive them is recorded. Buying something is never taken as a yes. Every one carries an unsubscribe link and the farm’s postal address, and unsubscribing takes effect at once. For these alone, we record when an email is opened and which links are clicked, for the farm that sent it. Opens are not exact: some email apps, Apple Mail among them, open messages on the reader’s behalf.
Postmark keeps a copy of each message for 45 days. If someone marks a farm’s email as spam, Postmark keeps that address on its list of addresses not to send to, and by Postmark’s own rule that entry cannot be deleted.
14.3 The market app
Pasturly’s market app runs on the farm’s Android phone at markets and pickups. What it sends from the phone:
- Each sale: what was sold, weights, amounts and how it was paid, with the staff member who made it, so the farm knows who took each sale.
- A customer’s email address, only if the customer asks for a receipt by email.
- Card details, read by Stripe’s software on the phone and sent straight to Stripe, on the farm’s Stripe account. We never see them.
- The phone’s location, which Stripe requires for every card payment and uses to prevent fraud. Card payments do not work without it.
- Device identifiers: the phone’s own Pasturly sign-in, and the identifiers Stripe uses for the phone and the card reader.
- Diagnostics: Stripe’s software reports card reader and payment errors to Stripe.
The app shows customers’ names, phone numbers and addresses on its orders, pickups and route screens, but those come from Pasturly; the phone does not collect them. The app has no advertising, no crash reporter of its own, and does not read the phone’s photos, contacts, messages or files. Everything it sends is encrypted in transit.
14.4 How long we keep it
| Data | Retention |
|---|---|
| The farm’s account and everything in it | Until the farm closes its account, then deleted |
| Emails sent, and each campaign and how each person responded | For the life of the farm’s account, so a farm can look back at a campaign from years ago. When a customer is forgotten, their name and address are removed from all of it |
| A customer’s orders, payments and shares of an animal after they are forgotten | Kept as part of the farm’s records, with their name removed |
| Messages held by Postmark | 45 days |
| Access and security logs | 12 months |
| A farm’s nightly export, held outside the database | 30 days |
| Anything held in a backup | Until that backup expires — at most 30 days |
Backups work as described in Section 8: we do not edit them, they are never used to bring deleted data back, and anything restored from one goes through the same deletion rules again.
14.5 Who helps us run it
| Provider | Purpose | Location |
|---|---|---|
| Stripe, Inc. | Card payments, taken on each farm’s own Stripe account; sales tax calculation; Pasturly’s own plan billing | United States |
| Postmark (ActiveCampaign, LLC) | Sending email on Pasturly’s and each farm’s behalf | United States |
| Railway Corporation | Application hosting, database hosting and backups | United States |
Card payments are records in the farm’s own Stripe account, which Stripe holds under its own privacy policy. As with Pasturly (Shopify), delivery street addresses alone are sent to the US Census Bureau Geocoder to plan routes, and a driver’s own phone passes stop addresses to Google Maps for directions.
15. Deleting your data
How to have your data deleted, what goes, what stays and for how long. To ask us anything about it, email pasturlyapp@gmail.com. We respond within 30 days.
If you buy from a farm that uses Pasturly (Standalone)
Ask the farm, which controls your data: it can delete it from its Customers screen. You can also ask from your own page in Pasturly, the one the farm’s emails sign you in to. If you cannot reach the farm, email us and we will help them act on it.
- What is deleted: your addresses, phone number, tags, sign-in links, your choice about the farm’s news, and your name and email address on every email and campaign record.
- What is kept: your orders, payments and any share of an animal, with your name removed, because they are part of the farm’s sales records. Card payments stay in the farm’s Stripe account, held by Stripe.
- When: at once, unless you have something open with the farm: an order not yet handed over, a share not yet delivered, a CSA season under way, or money owed. Then your request waits, the farm sees what is open, and it is carried out by itself when the last thing closes, or sooner if the farm chooses.
- How long copies last: up to 30 days in backups and the farm’s nightly export, and 45 days for messages held by Postmark.
If you run a farm on Pasturly (Standalone)
The owner can close the farm in Pasturly under Setup → Close this farm, typing the farm’s name to confirm, or email us to ask. Closing deletes everything Pasturly holds for the farm: its products, customers, orders, pickup points, drivers, weights, staging, email history and everyone’s sign-in. There is no undo. Copies in backups and the nightly export are gone within 30 days. Records in the farm’s own Stripe account are the farm’s and Stripe’s, and closing Pasturly does not delete them.
If you work for a farm, including on the market app, ask the farm’s owner to remove you. Uninstalling the market app removes it and its sign-in from your phone.
Pasturly (Shopify)
Customers of a Shopify store should ask that store, or Shopify. When Shopify asks us to erase a customer, we do, as Section 8 describes. A Merchant who uninstalls the app has everything we hold for their store deleted when Shopify sends shop/redact, normally about 48 hours after uninstall and in every case within 30 days. Backups expire within 89 days.
The early-access list
Email pasturlyapp@gmail.com and we will remove your sign-up from the website. We otherwise keep it no longer than Section 13.1 says.
16. Children
Pasturly is a business tool and is not directed to children. We do not knowingly collect personal data from anyone under 16. If we learn we have, we delete it.
17. Changes
We may update this policy. Material changes will be notified to Merchants by email or in-app at least 30 days before taking effect. The date at the top reflects the current version.
18. Contact
Nature’s Grove Farm LLC (Pasturly), Latrobe, PA, USA. Email pasturlyapp@gmail.com.