Shipmate — Privacy Policy

Shipmate ("we", "us") is a fulfillment and order-scanning app for Shopify merchants. This policy explains what data we access, how we use it, and how we protect it. We are committed to processing the minimum data needed to provide our service.

1. Information we access and process

When a merchant installs Shipmate, with their authorization we access data through the Shopify Admin API to provide fulfillment tooling:

• Orders — order numbers, fulfillment status, line items, and the customer's name (to identify and pack the order).
• Products & inventory — product, variant, and SKU data (for barcode/QR generation and SKU assignment).
• Staff identity — the name/email of the Shopify staff member using the app, to attribute scans and assign orders.

We do not access or store customer email addresses, phone numbers, shipping/billing addresses, or any payment/card information.

2. Information we store

• The store's Shopify access token, shop domain, and subscription status.
• Order numbers and scan records (what was scanned, when, by whom).
• Staff/scan activity used for analytics and order assignment.

3. How we use it

Solely to provide the app's functionality: scanning and packing orders, fulfillment analytics (KPIs), assigning orders to staff, and generating barcodes/SKUs. We do not use this data for any other purpose.

4. Data sharing and sub-processors

We do not sell personal data or share it for advertising. Data is processed by the infrastructure providers that run our service:

• Supabase — database hosting (PostgreSQL).
• Cloudflare — application hosting.
• Shopify — the platform the data originates from.

5. Security

• Data is encrypted in transit (TLS/HTTPS) and at rest, including backups.
• Database access is restricted to our server via a private key that is never exposed to browsers.
• Each store's data is isolated by its shop domain.
• We maintain a written security incident response policy and will notify affected merchants and, where required, regulators within 72 hours of becoming aware of a personal-data breach.

6. Data retention and deletion

We keep a store's data only while the app is installed. When a merchant uninstalls Shipmate, we delete that store's data in response to Shopify's shop/redact request. We also honor Shopify's customers/redact and customers/data_request webhooks; as we store no customer contact information, these requests are acknowledged accordingly.

7. Your rights

Depending on your jurisdiction (e.g., GDPR, CCPA), you may have the right to access, correct, or delete personal data, or to request its deletion. Merchants and their customers can exercise these rights by contacting us at the email below, or by uninstalling the app to trigger deletion.

8. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by the "Last updated" date above.

9. Contact

Questions or requests: quintom53@gmail.com