Privacy Policy

1. Introduction

This Privacy Policy describes how Local Delivery Premium (“we”, “our”, or “the App”), operated by Locate Technologies, collects, uses, stores, and protects information when you use our Shopify application. By installing or using the App, you agree to the practices described in this policy.

Local Delivery Premium is a delivery and pickup scheduling application for Shopify merchants. It enables merchants to offer their customers the ability to select a preferred delivery or pickup date, time slot, and location during checkout.

2. Information We Collect

2.1 Customer Data (from Shopify Orders)

When a merchant installs our App, we receive the following customer information from Shopify orders via the Shopify Admin API:

Data Type	Specific Fields
Name	Customer first name and last name
Email	Customer email address
Phone	Customer phone number
Address	Shipping address (street, city, province, postal code, country)
Order details	Order ID, order total, subtotal, shipping fee, currency, and order status

2.2 Delivery Scheduling Data (from Checkout Widget)

When a customer uses our checkout widget to schedule a delivery or pickup, we collect the following information:

• Selected delivery or pickup date
• Selected time slot
• Selected location
• Fulfillment method (delivery or pickup)
• Cart token (a Shopify-generated identifier for the shopping session)
• Customer postal or zip code (if postcode validation is enabled by the merchant)

2.3 Merchant Data

When a merchant installs the App, we store the following information:

• Shopify store domain (e.g., yourstore.myshopify.com)
• Shopify API access token (used to communicate with the Shopify Admin API on behalf of the merchant)
• OAuth session data (session ID, access scope, and expiration)

2.4 Merchant Configuration Data

Merchants configure the App through our admin dashboard. This configuration data includes:

• Delivery and pickup location details (name, address, contact information, operating hours, and time slots)
• Checkout settings (date and time formats, display preferences, and currency)
• Delivery rules (postcode restrictions, order limits, blackout dates, and cart value thresholds)
• Product settings (which products are enabled for delivery or pickup)
• Locate2u integration credentials (only if the merchant chooses to enable route optimization)

3. How We Use Your Information

3.1 Customer Data

We use customer data solely to provide the App’s core delivery and pickup scheduling functionality:

• Names and addresses — to display delivery orders to merchants in the order calendar, enable route planning, and facilitate order fulfillment.
• Email addresses — to associate orders with customers in the delivery management system.
• Phone numbers — to display contact information to merchants for delivery coordination.
• Order details — to synchronize and manage delivery orders within the App dashboard, including order status tracking and fulfillment.

3.2 Delivery Scheduling Data

Delivery and pickup selections made by customers are used to:

• Schedule the delivery or pickup for the associated order.
• Display scheduled orders on the merchant’s order calendar.
• Enforce order limits and capacity constraints per location.
• Tag Shopify orders with delivery or pickup details (date, time, location, and method) when the merchant enables auto-tagging.

3.3 Merchant Data

Merchant data is used to:

• Authenticate API requests to Shopify on the merchant’s behalf.
• Maintain the merchant’s session and App access.
• Provide the delivery scheduling service according to the merchant’s configuration.

4. Third-Party Data Sharing

We do not sell, rent, or trade customer personal data to any third party. Data is only shared with the following parties as described below:

4.1 Shopify

We communicate with the Shopify Admin API to read order data, update order tags, and manage fulfillment. This communication is essential for the App to function and is governed by Shopify’s own privacy policy and terms of service.

4.2 Locate2u (Optional, Merchant-Initiated)

If a merchant enables the Locate2u integration for route optimization, the following data is sent to Locate2u’s API:

• Customer name
• Delivery address
• Customer phone number and email address
• Order number and scheduled delivery date and time
• Order notes

This integration is entirely opt-in. Merchants must manually enable it and provide their own Locate2u API credentials. No data is shared with Locate2u unless the merchant explicitly configures and activates this integration.

4.3 Infrastructure Providers

We use the following infrastructure providers to host and operate the App:

• Cloudflare — application hosting and request processing (Cloudflare Workers).
• Supabase — database storage (PostgreSQL).

These providers process data on our behalf under their respective privacy policies and security commitments. They do not use your data for their own purposes.

5. Data Storage and Security

We take the security of your data seriously. The following measures are in place to protect your information:

• Encryption in transit: All data is transmitted over HTTPS with TLS encryption. All API communications between the App, Shopify, and our infrastructure are fully encrypted.
• Encryption at rest: Data stored in our Supabase database is encrypted at rest using AES-256 encryption.
• Access token security: Shopify API access tokens are stored securely in the database and are never exposed to the frontend application or end users.
• Webhook verification: All incoming Shopify webhooks are verified using timing-safe HMAC-SHA256 comparison to prevent tampering and unauthorized requests.

6. Data Retention

We retain data only for as long as necessary to provide the App’s services. The table below outlines our retention periods:

Data Type	Retention Period
Order data (customer names, emails, addresses, phone numbers, and order details)	Retained while the merchant has the App installed. Deleted upon merchant request or when Shopify sends a shop/redact webhook after app uninstallation.
Delivery scheduling selections	Retained while the merchant has the App installed. Deleted under the same conditions as order data.
Merchant configuration (locations, settings, and rules)	Retained while the merchant has the App installed. Fully deleted when Shopify sends a shop/redact webhook after app uninstallation.
Session and authentication data	Retained while the merchant has the App installed. Deleted when Shopify sends a shop/redact webhook.

When a merchant uninstalls the App, Shopify sends a shop/redact webhook within 48 hours. Upon receiving this webhook, we permanently delete all data associated with that merchant’s store, including all orders, delivery selections, locations, settings, products, delivery rules, and session data.

7. Your Rights Under GDPR and Applicable Privacy Laws

We support the following data rights in compliance with the General Data Protection Regulation (GDPR) and other applicable privacy regulations:

7.1 Right of Access

You have the right to request a copy of the personal data we hold about you. When Shopify sends a customers/data_request webhook on your behalf, we compile the relevant data from our records and make it available to the merchant for disclosure to you.

7.2 Right to Erasure

You have the right to request the deletion of your personal data. When Shopify sends a customers/redact webhook, we redact all personally identifiable information from associated order records — including names, email addresses, phone numbers, and addresses — and delete any delivery scheduling selections associated with the customer.

7.3 Right to Data Portability

Merchants can export their order and location data from the App at any time through the App’s built-in export functionality.

7.4 Data Deletion on App Uninstallation

When a merchant uninstalls the App, all associated data is permanently deleted from our systems upon receiving Shopify’s shop/redact webhook. This includes data across all database tables: orders, delivery selections, delivery rules, products, locations, checkout settings, integration settings, and sessions.

7.5 How to Exercise Your Rights

To exercise any of these rights, you may:

• Contact us directly at hello@locate2u.com.
• Submit a request through Shopify’s built-in privacy tools (available to customers of merchants using our App).

We will respond to all valid data requests within 30 days of receipt.

8. Cookies and Tracking

The App does not use cookies, tracking pixels, or any browser-based tracking technologies. We do not track or monitor customer browsing behavior. The App uses Shopify session tokens for merchant authentication, which do not rely on third-party cookies.

9. Children’s Privacy

The App is not directed at children under the age of 13 (or 16 in the European Union). We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected data from a child, we will promptly delete that data from our systems.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. When we make changes, we will update the “Last Updated” date at the bottom of this page. We encourage you to review this policy periodically.

11. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us:

• Email: hello@locate2u.com
• Company: Locate Technologies