Privacy Policy

1. Information we collect

Through Shopify APIs

The App uses these Admin API scopes: read_orders, write_orders, read_customers, read_merchant_managed_fulfillment_orders, write_online_store_pages.

• Shop: domain, name, contact email
• Online Store page: on install the App creates a published page titled Track Order at /pages/track-order so shoppers have a URL to look up orders. The App does not edit theme files.
• Orders: order number, status, line items, tracking, shipping address, fulfillment data
• Customers: email and/or phone, only to verify a shopper owns the order they look up
• Billing: App subscription status via Shopify Billing

From merchants

• Shop domain on install
• App settings (e.g. cancel / past-orders toggles)
• Plan selection via Shopify Billing
• Support messages you send us

We may email the shop address for install/uninstall notices (via Amazon SES). Card payments for App charges are handled by Shopify — we do not store card numbers.

From shoppers (storefront widget)

Shoppers submit an order number and email or phone. We use that in real time through Shopify's API to show tracking, then discard it. We do not keep customer emails, phones, addresses, or order contents in our database.

Optional ratings/comments are saved as an order metafield on the merchant's Shopify store (ordertrack.rating), not in our database. Free-text comments may include personal details the shopper types.

2. How we use it

• Run order tracking, cancellation, past orders, and ratings
• Create the Track Order storefront page at /pages/track-order
• Authenticate the App and manage Free / Unlimited plans
• Send transactional merchant emails and support replies
• Security, reliability, and Shopify compliance webhooks

Under GDPR / UK GDPR we process merchant data to perform the App contract and for legitimate interests in operating and securing the App. Customer data from Shopify is processed on the merchant's behalf for the features they enable.

3. Cookies and logs

We use essential session cookies for merchant login in the Shopify admin. The storefront widget may use temporary browser storage for form state. We do not use advertising cookies or ad pixels.

We keep Shopify access tokens, shop settings, subscription records, and aggregated monthly lookup counts (no customer identity). Server logs may include IP, path, and time for security — not customer order payloads.

4. Storage and sharing

• MongoDB: shop settings, sessions, usage counters
• Amazon SES: merchant transactional email
• Shopify: orders, ratings metafields, App billing

Providers act only to run the App. Data may be processed outside your country (including outside the EEA) with appropriate safeguards where required. We may disclose data if required by law, to protect rights or safety, or in a merger / sale of the business.

5. Security

We use HTTPS, authenticated Shopify API access, verified webhooks, and access controls. No system is perfectly secure.

6. Retention

• Shop settings and sessions while the App is installed
• Deleted on uninstall and on Shopify shop/redact
• No customer lookup records in our DB, so customers/data_request and customers/redact are acknowledged with nothing to export or erase on our side. Ratings stay on the merchant's Shopify order metafields.
• Logs kept only as needed for security and debugging

7. Your rights

Depending on law (e.g. GDPR, UK GDPR, CPRA), you may request access, correction, deletion, restriction, or portability of personal data, withdraw consent where applicable, or complain to a regulator.

Merchants can uninstall anytime in Shopify admin. Contact app.support@postexglobal.com for privacy requests. Customer requests may need the merchant's involvement; Shopify also forwards compliance webhooks to the App.

8. Changes

We may update this page and will change the "Last updated" date when we do.

9. Contact

Xstak Order Tracking — XStak Pte Ltd
Email: app.support@postexglobal.com
Apps: xstak.com/shopify-apps
App: order-track.xstak.com