Privacy Policy

Introduction

KSA Drop ("we," "us," "our," or "Company") operates the KSA Drop Order Sync application (the "App"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our App in connection with Shopify's platform.

1. Information We Collect

1.1 Order Data

When you authorize the App, we collect and store the following order information from your Shopify store:

• Order number, date, and status (financial and fulfillment)
• Customer name, email, and phone number
• Billing and shipping addresses
• Order total, currency, and line item details (product SKU, quantity, price)
• Payment method (normalized: COD, Prepaid, or Unknown)
• Order tags and custom metadata

1.2 Connection Data

We store:

• Your Shopify store domain
• OAuth tokens (access token + refresh token) used to read your orders
• Your configured sync filters (status, tags, payment method preferences)

1.3 Session & Interaction Data

We do not use cookies or tracking scripts. The App authenticates using Shopify's session tokens (JWT) within the Shopify Admin iframe, and we do not log or store interaction details beyond error logs for debugging.

2. How We Use Your Information

We use the collected information only to:

• Sync orders to your KSA Drop fulfillment account
• Filter orders based on your configured preferences (status, tags, payment method)
• Display order statistics and trends in the App's dashboard
• Respond to your support requests
• Comply with legal obligations (GDPR, CCPA)

We do not:

• Sell, rent, or lease your data to third parties
• Use your data for marketing or advertising
• Share order data beyond your authorized KSA Drop account
• Process payment information (this is handled by Shopify)

3. Data Retention

We retain order data as long as your KSA Drop account is active and the App is installed. When you uninstall the App:

• Immediately: Syncing stops; OAuth tokens are invalidated
• Within 48 hours: Your order customer data is anonymized (names replaced with "[redacted]", addresses cleared)
• 48+ hours: On Shopify's shop/redact webhook, all order records and connection data are deleted

This ensures your data is removed promptly after uninstall, in compliance with GDPR and Shopify's data retention policies.

4. Data Security

We implement industry-standard security measures:

• HTTPS only: All communication is encrypted in transit
• HMAC validation: Shopify webhooks are verified using HMAC-SHA256
• Session tokens: App Bridge session tokens are validated server-side (HS256 HMAC)
• Database encryption: Sensitive fields (tokens, addresses) are encrypted at rest
• Access control: Only authorized connections can read/write order data
• No public exposure: The App is embedded in Shopify Admin only (iframe-restricted via CSP)

5. GDPR & Data Rights

If you are a merchant in the EU, you have the following rights:

5.1 Right to Access

You can request a copy of your order data by contacting us (see section 8).

5.2 Right to Erasure ("Right to be Forgotten")

You can request deletion of your data by uninstalling the App. We will anonymize customer data immediately and delete all records within 48 hours.

5.3 Right to Rectification

Order data is read-only from Shopify; corrections must be made in your Shopify Admin. We will update our records on the next sync.

5.4 Right to Data Portability

Your order data can be exported from your KSA Drop account dashboard. Contact us for assistance.

5.5 Right to Restrict Processing

You can restrict processing by pausing sync in the App's Settings or uninstalling the App.

6. Customer PII & GDPR Compliance

Shopify's customers (your shoppers) are subject to Shopify's own privacy policies. We process their personally identifiable information (PII) only as a data processor on your behalf, in accordance with Shopify's Data Processing Addendum (DPA).

When a customer requests their data or deletion under GDPR:

• customers/data_request: Shopify notifies us; we log the request for your review
• customers/redact: Shopify notifies us; we anonymize the customer's PII from affected orders
• shop/redact (uninstall): We anonymize all customer PII and delete the connection after 48 hours

We do not sell or share customer data with any third party.

7. Children's Privacy

The App is intended for business use by merchants and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If we become aware that a child has provided us with personal information, we will take steps to delete such information and terminate the child's account.

8. Contact & Support

If you have questions about this Privacy Policy, wish to exercise your rights, or need to report a data breach:

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by updating the "Last updated" date at the top of this page and, where required, by obtaining your consent. Your continued use of the App after changes constitutes your acceptance of the updated Privacy Policy.

10. Third-Party Links & Integrations

The App integrates with:

• Shopify: Order data is read from Shopify and synced to your KSA Drop account via our API
• KSA Drop Fulfillment Platform: Synced orders are stored in your KSA Drop account under your control

We are not responsible for the privacy practices of these third parties. Please review their privacy policies independently.

11. Shopify's Role

This App is a third-party application built for Shopify's platform. Shopify is the data controller for your store data; we are a data processor. Shopify's Privacy Policy governs their collection and use of data. See https://www.shopify.com/legal/privacy for details.

12. Compliance & Certifications

KSA Drop is compliant with:

• GDPR (EU): General Data Protection Regulation
• CCPA (California): California Consumer Privacy Act
• Shopify Partner Standards: Including GDPR webhook compliance