Privacy Policy

ShipShop — multi-courier shipping app. Last updated: 13 July 2026.

ShipShop ("we", "us") helps merchants ship their orders. This policy explains what data the ShipShop app accesses when you connect your Shopify store, why we use it, who we share it with, how long we keep it, and your rights. It applies to the ShipShop app and the ShipShop service at shipshop.in.

What we collect

When you install ShipShop and connect your store, and only for orders you choose to ship, we access:

• Order & recipient details — the customer's name, email, phone, shipping address, pincode, city, and state, and order details (weight, value, payment type). These come from Shopify's order webhook.
• Store & account details — your store domain and the access token we use to call Shopify's Admin API on your behalf.
• Product weight/dimensions — used only to calculate shipping rates and carrier serviceability.

We request the minimum Shopify permissions we use: read_orders and write_shipping. We do not access payment details, customer accounts beyond order recipients, or any data unrelated to shipping.

How we use it

Solely to provide the shipping service you asked for:

• Import your orders into ShipShop automatically.
• Calculate and compare courier rates, and show live rates at checkout.
• Print shipping labels and book shipments with the courier you select.
• Track shipments and send delivery notifications (including a delivery OTP to the buyer).

We do not use customer data for marketing, advertising, profiling, analytics about individuals, resale, or training AI models.

Who we share it with

To deliver a parcel, the recipient's name, phone, and address are sent to the licensed courier you choose (e.g. Delhivery, DTDC, Blue Dart, Xpressbees, India Post, SMARTR). These couriers act as delivery sub-processors. We do not sell personal data or share it with anyone for any purpose other than fulfilling your shipments and operating the service (e.g. our hosting and email/SMS providers).

How we protect it

• All traffic is served over HTTPS/TLS.
• Shopify webhooks are verified with HMAC-SHA256 signatures.
• Access to your data is scoped to your account and requires authentication.
• Secrets and API credentials are stored in server environment configuration, never in source code.

Retention & deletion

We retain shipping records for as long as your order history exists, so shipments can be tracked and reconciled. When you uninstall the app, we stop accessing your store (Shopify's shop/redact webhook). On a customer-erasure request, we anonymise that customer's recipient data (Shopify's customers/redact webhook). We honour the mandatory Shopify compliance webhooks: customers/data_request, customers/redact, and shop/redact.

Your rights

Depending on your region, you may have rights to access, correct, or delete personal data. Store owners can request their customers' data or erasure through Shopify, which we honour via the compliance webhooks above. For any privacy request or question, contact us at support@shipshop.in.

Changes

We may update this policy; material changes will be reflected here with a new "last updated" date.