Privacy Policy

Last updated: August 7, 2026

This Privacy Policy describes how Dropiloship Tracking Order ("the App", "we", "us", or "our") collects, uses, and shares information when you install or use our Shopify application.

1. Information We Collect

A. Information collected through Shopify APIs

When a merchant installs the App, we access the following data via Shopify's authenticated APIs:

• Order and fulfillment data — order name/number, fulfillment status, tracking number, tracking carrier, and tracking URL. This data powers the public tracking page.
• Product data — product title, handle, image URL, and variant pricing, only when the merchant manually selects products for the "Recommended Products" widget on the tracking page.
• Destination city and country — used solely to display a destination map on the tracking page. We never collect or store street addresses.

B. Information collected from merchants

• Branding settings — colors, logo, header image, page title, support email, and support message, provided voluntarily by the merchant to customize the tracking experience.
• Notification settings — sender name, reply-to email, email templates, and trigger preferences for customer email notifications.

C. Information collected from customers (end-buyers)

• Order lookup — when a customer looks up their order, they enter an order number and email. The email is verified in real time against a one-way hash (HMAC) stored in our database; we never store the raw customer email address.
• Delivery reviews — an optional star rating and comment after delivery. No personally identifiable information is attached to reviews.
• Page-view analytics — we record a one-way hash of the visitor's IP address for aggregate traffic analytics. We do not store raw IP addresses.
• Cookies & tracking — we do not set cookies, use pixels, or employ third-party tracking technologies on the public tracking page.

2. How We Use the Information

We use the collected information exclusively to:

• Display order tracking status to end-buyers on the branded tracking page.
• Send email delivery notifications to customers on behalf of the merchant.
• Show recommended products chosen by the merchant.
• Display destination maps and estimated delivery timelines.
• Provide the merchant with an order-tracking dashboard inside Shopify Admin.
• Generate aggregate analytics (page views, delivery performance).

We do not sell, rent, or share personal data with third parties for marketing or advertising purposes.

3. Data Retention

• Tracking data — delivered orders and their associated events are automatically purged 30 days after delivery.
• Session data — Shopify OAuth sessions are managed by Shopify's session storage framework and are removed when the app is uninstalled.
• Merchant settings — branding and notification configurations are deleted when the merchant uninstalls the app.

4. Data Sharing & Third-Party Services

• Shopify — we operate within the Shopify platform and use Shopify APIs to read order data. Shopify's own privacy policy governs data they process.
• Geocoding — destination city/country pairs are sent to the Nominatim geocoding service (OpenStreetMap) to obtain map coordinates. Only city and country are sent; no personal information is transmitted.
• Email delivery — customer notification emails are sent through our email service provider. Only the recipient email address (obtained from Shopify at send time, not stored) and the email content are shared with this provider.

5. GDPR & Data Protection Rights

We comply with the General Data Protection Regulation (GDPR) and Shopify's mandatory data protection requirements. Our app implements all required GDPR compliance webhooks:

• Customer data request — we respond to requests for customer data by providing all data associated with the requesting customer.
• Customer data erasure — we delete all customer-related data upon receiving a redaction request.
• Shop data erasure — upon app uninstallation, we delete all shop-related data including settings, orders, events, and analytics.

If you are a European resident, you have the right to access, rectify, or erase your personal data, as well as the right to restrict or object to processing. To exercise these rights, please contact us using the details below.

6. Data Storage & Security

All data is stored in a PostgreSQL database hosted on secure cloud infrastructure. Data is transmitted over HTTPS (TLS encryption). Access tokens are managed by Shopify's session framework and are never exposed to the client.

7. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify merchants of material changes through the app or via the email associated with their Shopify account. Continued use of the App after changes constitutes acceptance of the updated policy.

8. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at:

Email: mehdi.rossi92@gmail.com