Privacy Policy

This Privacy Policy describes how DATACART ("we", "us", or "the App") collects, uses, retains, and protects personal and store data when you install, access, or utilize the App in connection with your Shopify-supported store.

1. Information We Collect from Shopify

When you authorize and install DATACART, we receive access to specific store permissions via Shopify's official GraphQL and REST Admin APIs in accordance with our declared scopes:

• Store & Account Details: Your Shopify myshopify.com domain, store display name, currency, timezone, and primary contact email to authenticate and provision your account.
• Product & Catalog Information: Product IDs, variant titles, inventory levels, SKUs, and retail prices strictly to calculate inventory velocity, stockout alerts, and gross margins.
• Orders & Fulfillment Metrics: Order numbers, line items, customer shipping destination/city, delivery statuses, and payment states to facilitate automated COD verification, calculate true net profits, and analyze courier performance.

2. WhatsApp Transactional Automation

DATACART provides automated order verification notifications. We do not store personal private chats. All automated messages transmitted to buyers (e.g. 1-tap confirmation, delivery tracking, OTPs) are strictly transactional and dispatched exclusively to the recipient phone number designated on the corresponding Shopify checkout order.

3. GDPR & Mandatory Shopify Webhooks

DATACART strictly complies with the European Union General Data Protection Regulation (GDPR) and mandatory Shopify data protection mandates:

• Customer Data Requests (customers/data_request): We facilitate merchant export requests for buyer order history upon request.
• Customer Redaction (customers/redact): Personal buyer details are expunged from operational tables upon receiving a redaction webhook.
• Shop Redaction (shop/redact): If you uninstall DATACART, all store tokens, credentials, and cached records are permanently expunged within 48 hours.

4. Data Retention & Security Standards

We implement bank-grade 256-bit SSL/TLS 1.3 encryption across all client-server communications and database storage. Sensitive API credentials and session secrets are encrypted using one-way SHA-256 cryptographic salts. We do not sell, broker, or monetize merchant catalog or customer contact records.

5. Data Protection Officer & Inquiries