Effective date: November 1, 2026. Operator: AmoraOS LLC ("AmoraOS", "we", "us"), 30 N Gould St, Suite R, Sheridan, WY 82801. Privacy contact: hello@amoraos.com.
1. Who this policy covers
AmoraOS is order-management and fulfillment software used by licensed alcohol retailers and their fulfillment partners ("Merchants"). This policy explains how we handle personal information about three groups:
- Merchant staff: people who sign in to AmoraOS to work orders, print labels, manage inventory or run reports.
- Brand and partner users: people at spirits brands, retail partners or corporate-gifting clients who are given a limited portal by a Merchant.
- Shoppers: customers of a Merchant whose orders flow into AmoraOS from the Merchant's online store or marketplace so they can be packed and shipped.
Merchants decide what shopper data enters AmoraOS and why; they are the "controller" or "business" for that data and we process it on their behalf (see our Data Processing Addendum). Each Merchant's own privacy policy governs its relationship with its shoppers. This policy also covers visitors to amoraos.com.
2. Information we collect
From Merchant staff, brand and partner users. Name, work email or username, role, password (stored only as a salted hash), optional two-factor secret (encrypted), sign-in times and IP addresses, and the actions you take in the product (kept in an audit log).
About shoppers, on a Merchant's behalf. Order details the Merchant's store sends us: name, shipping and billing address, email, phone, items, prices, order status, and delivery tracking events. We also receive a Merchant's support tickets about an order if the Merchant connects its help desk. We never receive card numbers or payment credentials; payment is taken by the Merchant's store or payment provider.
Automatically. Server logs with IP address, browser type and the pages requested, kept for security and troubleshooting. AmoraOS sets one strictly necessary sign-in cookie. We do not use advertising cookies or trackers on the product.
From third parties. Order and shipment information from platforms a Merchant connects, such as Shopify, ShipStation, marketplace channels, and delivery status from carriers.
3. How we use information
- To run the service: import orders, print packing slips and shipping labels, write tracking back to the store, show inventory and reports.
- To ship lawfully: every shipping label for alcohol is created with adult signature required at delivery, and orders addressed to government regulator offices are held for review.
- To support Merchants: answer questions, investigate problems, and, where a Merchant has connected its help desk, show the ticket beside the order.
- To secure the service: detect misuse, enforce roles, keep audit trails.
- To bill Merchants for their subscription and usage.
- To improve the service with aggregated, de-identified usage statistics.
- To meet legal obligations, including alcohol shipping laws and lawful requests from authorities.
Assistant features. Merchants may ask AmoraOS questions about their orders and stock, or ask it to draft a customer-service reply. Those requests, including order details, are processed by our AI provider (Anthropic) under commercial terms that prohibit it from training its models on the data; it keeps the data only briefly for abuse monitoring before deleting it.
We do not use shopper data for our own marketing, and we never contact a Merchant's shoppers for marketing.
4. How we share information
Only as needed to do the above, with:
- Shipping and delivery providers chosen by the Merchant: carriers (UPS, FedEx, USPS, regional delivery services) and label platforms (EasyPost, ShipStation), which receive the recipient's name, address, phone and email to deliver the parcel.
- The Merchant's own platforms: Shopify stores, marketplace channels and help-desk accounts that the Merchant connected.
- Service providers that host and run AmoraOS under contract: cloud hosting and database providers, email delivery, the AI provider above, and payment processing (Stripe) for subscription billing and for checkout features a Merchant enables. The current list is in the Data Processing Addendum.
- Authorities when required by law, including alcohol regulators, or to protect rights and safety.
- A successor if AmoraOS is sold or merged, under this policy.
We do not sell personal information and do not share it for cross-context behavioral advertising.
5. How long we keep information
- Shopper and order data lives while the Merchant's store is connected. When a Merchant uninstalls AmoraOS from a store, that store's data is purged when Shopify's redaction request arrives, 48 hours after uninstall.
- A shopper deletion request relayed by a Merchant or Shopify removes that shopper's personal fields from our records.
- A Merchant may export all of its data at any time and may close its account; the data is deleted 14 days after the request unless the Merchant cancels during that period.
- Encrypted backups are kept for 7 days and age out automatically.
- Audit and server logs are kept for 12 months for security.
- Billing records are kept for 7 years as tax law requires.
6. Security
Data moves only over HTTPS, with HTTP Strict Transport Security enabled. Our database is encrypted at rest and reachable only from our application servers. Store access tokens are additionally encrypted in the application. Every person has an individual account with a role; warehouse and pickup staff see only their station, brand users never see shopper identity, and partners see only their own orders. Two-factor sign-in is available to every staff account. Exports, deletions and settings changes are recorded in an audit log. We keep a written security incident response policy and will notify affected Merchants without undue delay, and within 72 hours of confirming an incident that affects their data. No system is perfectly secure, and we cannot guarantee against every unauthorized access.
7. Your choices and rights
Merchant staff, brand and partner users can see and change their profile in the product, and can ask their administrator or us to delete their account.
Shoppers should direct requests about their order data to the Merchant they bought from, because the Merchant decides what we hold. When a Merchant or Shopify forwards a request to us, we act on it.
California residents have the right to know what personal information we collect, use and disclose, to request deletion or correction, to opt out of sale or sharing (we do not sell or share), and not to be discriminated against for exercising these rights. Send requests to hello@amoraos.com; we will verify your identity and respond within 45 days, extendable once by 45 days where the law allows. An authorized agent may make a request on your behalf.
Residents of other U.S. states with privacy laws (for example Colorado, Connecticut, Virginia, Texas, Oregon) have similar rights of access, correction, deletion and portability, and may appeal a refusal by replying to our response.
Residents of the European Economic Area, United Kingdom or Switzerland have rights of access, correction, deletion, restriction, portability and objection, and may complain to a supervisory authority. AmoraOS processes data in the United States; transfers from those regions rely on the EU Standard Contractual Clauses and the UK Addendum.
8. Age
AmoraOS is a tool for licensed businesses. It is not directed at anyone under 21, and shoppers' orders handled through AmoraOS are subject to the Merchant's age verification and to adult-signature delivery. If we learn we hold information about a person under 21 other than as part of a lawful order record, we delete it.
9. Changes
We will post changes here with a new effective date and tell Merchant administrators by email at least 30 days before material changes take effect.
10. Contact
hello@amoraos.com · AmoraOS LLC, 30 N Gould St, Suite R, Sheridan, WY 82801. For privacy requests, put "Privacy request" in the subject line.