Privacy Policy

Introduction

IPK Logistics ("we", "our", "the app") is a Shopify embedded application that helps merchants manage warehouse operations including bin locations, inbound stock, order-by-order picking, picking rounds, packing, and optional Shopify fulfillment. This Privacy Policy explains what data we collect, how we use it, how long we keep it, and what happens when you uninstall the app.

Data We Collect

Merchant and Staff Data (from Shopify OAuth)

When you install the app, Shopify provides us with session data for authentication purposes:

• Store domain (e.g. your-store.myshopify.com)
• Staff user first name, last name, and email
• Staff user ID
• OAuth access token and refresh token

This data is managed by the Shopify session storage system and is used solely for authenticating API requests on your behalf.

Operational Data (created by app usage)

As you use the app, we store operational data needed to run the service — including your shop configuration and trial/billing status, picking rounds, order references, quantities ordered and picked, packing quantities and states, container assignments, and fulfillment attempts. Fulfillment attempts include line quantities, Shopify fulfillment IDs when available, status, timestamps and error details. Order references include Shopify order IDs and order names.

Inbound and Supplier Data

We store supplier names and optional contact details, purchase order references, expected dates, payment terms, quantities, costs, tax rates, shipping costs, carrier and tracking details. Receiving and putaway records include quantities, variant references, physical locations and timestamps. Supplier contact details and staff session data are distinct from end-customer information.

Product Data

During picking and fulfillment, the app reads product information (titles, SKUs, barcodes, images) from Shopify in real time. This data is displayed in the app but is not stored as catalog fields in our database. Operational records do store variant references, quantities and putaway locations.

Tracking Information

When you choose Shopify fulfillment, outbound tracking details are sent to Shopify. Inbound purchase orders separately store their tracking number and shipping carrier. Pack-only completion does not send a Shopify tracking update.

Data We Do NOT Collect

We do not access, collect, or store any personal data belonging to your customers — including names, emails, phone numbers, addresses, or payment information.

Our Shopify API permissions are limited to order processing and product management. We do not request or use any customer data scopes.

How We Use Your Data

We use your data exclusively to provide the app's core functionality — authentication, subscription management, supplier purchase orders, receiving, putaway, bin locations, picking, verified packing, optional Shopify fulfillment, and container tracking.

We do not sell, share, or transfer your data to any third parties. We do not use your data for analytics, marketing, or any purpose beyond delivering the service.

Data Retention

• Active operational data (picking rounds, fulfillments, containers): retained for 6 months from creation under our operational retention policy. For historical data requests, contact support. The catalog and location CSV export is separate from operational history.
• Shop configuration: retained as long as the app is installed. After uninstallation and Shopify redaction, the shop configuration record and usage-charge records are retained for billing audit, including subscription and trial information, while associated operational records are removed.
• Session data: deleted when the app uninstall webhook is processed.

What Happens When You Uninstall

When you uninstall IPK Logistics:

1. On the uninstall webhook: Authentication sessions, including stored staff session data and API credentials, are removed.
2. On shop redaction: The separate Shopify shop redaction webhook removes operational records, including picking, packing and fulfillment records, containers, supplier purchase orders, receiving and putaway records, and suppliers. This is separate from uninstall; it is not a guaranteed 48-hour deadline from removal.
3. Kept for audit: The shop configuration and usage-charge records remain, including subscription and trial information.
4. Remains in your Shopify store: Bin location metafields on your products belong to you and are not deleted. They survive app uninstallation.

GDPR Compliance

We implement all mandatory Shopify compliance webhooks:

• Customer data requests and erasure: Since we do not store any customer personal data, there is nothing to return or delete.
• Shop data erasure: Upon request, we permanently delete all operational data associated with your store.

Cookie Policy

This website uses cookies only when they are needed to provide the site or to remember your cookie choices. Google tags are initialized with Consent Mode defaults that deny analytics and advertising storage unless you choose to enable them.

Cookies we use

• ipk_cookie_consent - remembers your cookie preferences, including the consent version and the time you made your choice. Duration: up to 180 days.
• ipk_platform - remembers the selected commerce platform experience when platform selection is used. Duration: up to 365 days.

Optional categories

• Necessary - required for consent storage, platform selection, security, and basic site delivery. This category is always enabled.
• Analytics - helps us understand aggregate website usage. This is denied by default in Google Consent Mode and only becomes granted after you accept analytics cookies.
• Marketing - allows advertising measurement or retargeting pixels. This is denied by default in Google Consent Mode and only becomes granted after you accept marketing cookies.

Third-party services

We use Google tags with Consent Mode v2. The Google tag is initialized with advertising and analytics storage denied by default, and the state is updated only after you make a choice in the cookie banner. Meta Pixel and other optional marketing pixels only load after you accept the relevant optional category.

Links to websites such as the Shopify App Store or the IPK Logistics hub may take you to other websites with their own cookie and privacy practices.

Managing your choices

The cookie banner lets you Accept all, Reject all, or Manage preferences. Analytics and marketing are never pre-selected. You can reopen Cookie Preferences from the footer at any time.

Data Security

• All data is encrypted in transit (HTTPS/TLS) and at rest
• API tokens are stored securely with automatic rotation
• All webhook requests are verified using cryptographic signatures