Privacy Policy

• Provider: Curious Objects LLP, Sharjah Media City, Sharjah, Dubai.
• Privacy contact: hello@curiousobjects.dev

Roles under data-protection law:

• For data belonging to a merchant’s store and its customers, the merchant is the data controller and Parceler is a data processoracting on the merchant’s instructions.
• For data you give us directly (e.g. support enquiries, billing), the Company is the controller.

The App requests only the Shopify access scopes it needs to function:

* Protected Customer Data is only accessed if and when the merchant has approved Protected Customer Data Access in the Shopify Partner Dashboard. Until then, the App falls back to non-protected and sample data and does not read customer name, email, or shipping address.

We do not access payment card details, passwords, or store data unrelated to shipments.

• Display shipment status, route, timeline, and estimated/actual delivery dates.
• Match fulfillments to their order and line items for the merchant’s reference.
• Maintain the authenticated session between the App and the store.
• Provide support and resolve issues you report.

We process each data type only for the purpose listed above and do not sell personal data.

• Session and shipment data are stored in our hosted database on Render.
• Data in transit is encrypted via HTTPS/TLS. Data at rest is protected by access controls and our hosting provider’s encryption.
• Access to production data is restricted to authorized personnel on a need-to-know basis.

• We retain store and shipment data only while the App is installed.
• When the App is uninstalled, or upon a valid deletion request, we delete or anonymize the associated data within 30 days, except where retention is required by law.
• Shopify also sends us a shop/redact webhook 48 hours after uninstall, on which we erase the shop’s stored data.

We share data only with service providers necessary to run the App:

We do not sell or rent personal data to third parties.

If data is transferred outside the merchant’s region (e.g. EU → US), we rely on Standard Contractual Clauses.

The App implements Shopify’s GDPR/CCPA webhooks:

• customers/data_request: when a customer requests their data, we provide the store owner with the shipment data we hold about that customer.
• customers/redact: we delete the personal data we hold for the specified customer.
• shop/redact: we delete all data we hold for the store after uninstall.

Depending on jurisdiction (GDPR, UK GDPR, CCPA/CPRA, etc.), individuals may have the right to access, correct, delete, port, or restrict processing of their personal data, and to object to it.

• Customers should direct requests to the merchant (the controller). We assist the merchant in fulfilling them.
• Merchants may contact us at hello@curiousobjects.dev to exercise rights over data we hold.

The App is not directed to children and does not knowingly process children’s personal data.

We may update this Policy from time to time. Material changes will be communicated via the App listing, and the “Last updated” date above will change.

Questions or requests: hello@curiousobjects.dev, Curious Objects LLP, Sharjah Media City, Sharjah, Dubai.