1. Introduction
This Privacy Policy describes how BoxPack IQ ("we," "us," or "our") collects, uses, stores, and protects information
through BoxPack IQ ("the App"), a Shopify application that helps merchants optimize box and package selection for
their orders. By installing and using BoxPack IQ, you ("Merchant" or "you") agree to the practices described in
this policy.
BoxPack IQ is a merchant-facing tool embedded within the Shopify admin. It does not interact directly with your
end customers or collect data from your storefront visitors.
2. Information We Collect
When you install and use BoxPack IQ, we access and store the following data from your Shopify store:
2.1 Store Information
- Shop name and domain
- Store address
- Store email address
- Timezone settings
2.2 Product Data
- Product titles and SKUs
- Product handles
- Product dimensions (length, width, height, weight)
- Product images
2.3 Order Data
- Order numbers
- Line items and quantities
- Customer names
- Customer email addresses
- Customer phone numbers
- Shipping addresses
3. How We Use Your Information
We use the collected data exclusively for the following purposes:
- Box optimization: Analyzing product dimensions and order contents to recommend the best-fit box sizes for each order.
- Packing slips and box labels: Generating packing documentation using order and customer information.
- Usage tracking and billing: Monitoring usage to manage subscription plans through Shopify's billing system.
- App functionality: Maintaining store settings and product data to provide a seamless packing experience.
4. Data Retention
Important: Order data is automatically deleted after 90 days. This includes order numbers, line items,
customer names, email addresses, phone numbers, and shipping addresses. This automated cleanup ensures that we do not
retain order-level data longer than necessary to provide our service.
- Order data: Automatically deleted 90 days after creation.
- Product data: Retained for as long as BoxPack IQ is installed on your store.
- Store information: Retained for as long as BoxPack IQ is installed on your store.
- Upon uninstallation: All data associated with your store is permanently deleted when you uninstall the App. This deletion is triggered automatically via Shopify's shop/redact webhook.
5. Data Storage and Security
We take the security of your data seriously and employ the following measures:
- Encryption at rest: Shopify access tokens are encrypted using AES-256-GCM encryption.
- Encryption in transit: All data transmitted between your browser, our servers, and Shopify is protected via HTTPS/TLS.
- Database security: Data is stored in MongoDB with TLS-encrypted connections.
- Access control: Access to merchant data is restricted to authorized personnel and automated systems required to operate the App.
6. Third-Party Sharing
We do not sell, rent, or share your data with any third parties. The only external party that
receives or has access to your data is Shopify, which is necessary for the App to function as an
embedded Shopify application. Data exchanged with Shopify is governed by
Shopify's Privacy Policy.
7. Cookies and Tracking
BoxPack IQ does not use cookies or tracking technologies. The App operates as an embedded application within the
Shopify admin panel and relies on Shopify's authentication mechanisms. No additional cookies are set by BoxPack IQ.
8. GDPR Rights (European Economic Area)
If you are located in the European Economic Area (EEA), you have the following rights under the General Data Protection Regulation (GDPR):
- Right of access: You may request a copy of the personal data we hold about your store and customers.
- Right to rectification: You may request that we correct inaccurate data.
- Right to erasure: You may request deletion of your data at any time. Note that uninstalling the App automatically deletes all stored data.
- Right to data portability: You may request your data in a structured, machine-readable format.
- Right to restrict processing: You may request that we limit how we process your data.
- Right to object: You may object to data processing based on legitimate interests.
We also comply with Shopify's mandatory GDPR webhooks for customer data requests and deletions. To exercise any of
these rights, please contact us at the email address listed below.
9. CCPA Rights (California Residents)
If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with the following rights:
- Right to know: You may request details about the categories and specific pieces of personal information we collect.
- Right to delete: You may request deletion of personal information we have collected. Uninstalling the App triggers automatic deletion of all data.
- Right to opt-out of sale: We do not sell personal information to third parties.
- Right to non-discrimination: We will not discriminate against you for exercising your privacy rights.
10. Data Processing Basis
We process your data based on the following legal grounds:
- Contractual necessity: Processing is necessary to provide the box optimization service you have requested by installing the App.
- Legitimate interest: Processing is necessary to maintain and improve the App's functionality.
- Consent: By installing BoxPack IQ and approving the requested Shopify permissions, you consent to our data practices as described in this policy.
11. Children's Privacy
BoxPack IQ is a business tool designed for Shopify merchants. We do not knowingly collect personal information
from children under the age of 16. The App is intended for use by authorized business personnel only.
12. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational,
or regulatory reasons. If we make material changes, we will notify you by updating the effective date at the top of
this page. Your continued use of BoxPack IQ after any changes constitutes acceptance of the updated policy.
13. Contact Us
If you have any questions about this Privacy Policy, wish to exercise your data rights, or need to report a
privacy concern, please contact us: