Privacy policy
TrackFlow Order Tracking ("TrackFlow", "we") is a Shopify app operated by Priyanka. It lets merchants follow their shipments and gives their customers a page to track orders. This policy explains what we collect, why, and what happens to it.
Roles
For the personal information of a merchant's customers, the merchant is the controller and TrackFlow acts as a processor on the merchant's behalf. For the merchant's own account information, TrackFlow is the controller.
Information we collect
When a merchant installs TrackFlow, Shopify shares the following with us, limited to the permissions the merchant approves (read orders and read fulfilments):
- Store information: shop domain and name, shop contact email, time zone and country.
- Order information: order number, dates, status, items, totals and currency.
- Customer information on those orders: name, email address, phone number and shipping address.
- Fulfilment information: carrier names, tracking numbers and tracking links.
We also keep technical logs (such as IP address, request time and page requested) to operate, secure and troubleshoot the service. We do not collect payment card details: TrackFlow's plans are billed by Shopify.
How we use it
- To show merchants their orders and shipments, and who each shipment is for.
- To show a merchant's customers the status of their shipment on the tracking page.
- When the merchant enables it, to send shipment-status emails to their customers on the merchant's behalf.
- To provide support, keep the service secure, and meet legal obligations.
We do not sell personal information, use it for advertising, or share it for cross-context behavioural advertising.
Service providers
We use service providers to run TrackFlow, who process data only on our instructions:
- Render — application hosting and database (United States).
- Shopify — the platform the app runs on, and billing for paid plans.
- If a merchant's plan uses live carrier tracking, tracking numbers and carrier names are sent to our tracking data provider (AfterShip).
- If customer emails are enabled, recipient email addresses and message content are sent to our email delivery provider.
Security
Data is encrypted in transit (HTTPS). Shopify access tokens are additionally encrypted in our database. The database is not reachable from the public internet, and each merchant can only access their own store's data.
Retention and deletion
- We keep store, order and customer information while TrackFlow is installed.
- When a merchant uninstalls TrackFlow, we stop syncing immediately and delete the access tokens. Shopify then sends us a shop deletion request (48 hours after uninstall), and we delete that store's orders, customers and shipments.
- When Shopify sends us a customer deletion request on a merchant's behalf, we remove that customer's name, email, phone and address from the related orders.
- Technical logs are kept only as long as needed for security and troubleshooting.
Your rights
If you are a customer of a store that uses TrackFlow, please contact that store first: it controls your information and can ask us, through Shopify, to provide or delete it. Merchants and anyone else can contact us to access, correct or delete their information, and, where applicable law (such as the GDPR or CCPA) gives you further rights, we will honour them.
Changes
We may update this policy. We will change the date above and, for significant changes, notify merchants in the app.
Contact
Questions about this policy or your information: Priyanka@gmail.com.
See also our terms of service and data processing terms.