Política de Privacidad

1. Introduction

NoCodeRoi, LLC, doing business as Logistimate ("Logistimate", "we", "us", or "our"), operates a Shopify application for returns and exchanges, shipment tracking and late-delivery (SLA) detection. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our Shopify app, our dashboard, the returns portal and branded tracking pages we run for stores, and related services.

Our role. For the account information of the merchants who install our app, we decide how that information is used. For the personal data of a store's customers (order, shipment and return details), we act on behalf of the store as its service provider (a "processor"): we use that data only to provide our services to the store and to follow the store's and Shopify's instructions, including data and erasure requests. The store's own privacy policy also applies to its customers.

Company Details:
NoCodeRoi, LLC (d/b/a Logistimate)
651 N Broad St, Suite 201, Middletown, DE 19709, USA
Email: [email protected]
Delaware File Number: 7565048

2. Information We Collect

2.1 Information from Shopify

When a store installs our app, we receive the following data from the store through Shopify:

• Store Information: Store name, domain, email, currency, timezone, and whether the store uses Shopify customer accounts
• Order Data: Order numbers, order dates, ordered items and prices, customer names, email addresses, phone numbers, shipping addresses
• Fulfillment Data: Tracking numbers, courier/carrier names, fulfillment status, shipment dates
• Refund Records: The refunds and store credit our app issues through Shopify (amounts and Shopify identifiers)

2.2 Returns and Exchanges

When a store uses Logistimate Returns, its customers use our returns portal. We collect:

• Order lookup: The order number and email address the customer enters. We email a one-time sign-in link to the email address on the order.
• Return details: The items being returned, the reason, the outcome the customer chooses (refund to the original payment method, store credit, a replacement or an exchange), and any notes
• Photos: Photos of returned items, when the store asks for them
• Courier pickup: When the store offers courier pickup and the customer chooses it, the pickup address, phone number and preferred pickup dates
• Return shipping: A tracking number the customer provides when they ship the return themselves

2.3 Courier API Credentials

To track shipments, a store provides courier API credentials (e.g., API keys, usernames, passwords). These credentials are encrypted using Fernet encryption before storage, are never returned by our API, and are only decrypted by our background workers when making courier API calls.

2.4 Tracking Data from Couriers

We collect tracking information from courier APIs including:

• Tracking status updates and timestamps
• Delivery facility locations
• Estimated delivery dates
• Delivery confirmation details

2.5 Merchant Account Data

The names, email addresses and roles of the store's team members who sign in to our dashboard. Subscriptions are billed through Shopify; we never receive payment card details.

2.6 Usage Data

We automatically collect:

• Log data (IP addresses, browser type, access times)
• App usage metrics (features used, pages viewed)
• Error logs and debugging information. Error logs exclude the query part of web addresses, so sign-in links are never written to them.

3. Legal Basis for Processing (GDPR)

We process personal data under the following lawful bases:

• Contract Performance (Art. 6(1)(b)): Processing necessary to provide the returns, tracking and SLA monitoring services a store signed up for
• Legitimate Interest (Art. 6(1)(f)): Improving our service, preventing fraud, and ensuring security
• Legal Obligation (Art. 6(1)(c)): Retaining billing records for tax and accounting compliance
• Consent (Art. 6(1)(a)): Where applicable

For the personal data of a store's customers, the store determines the legal basis, and we process that data on the store's behalf under our agreement with it (Art. 28).

4. How We Use Your Information

We use collected data for the following purposes:

• Returns and Exchanges: Run the store's returns portal, email customers their sign-in link and updates about their return, arrange courier pickups, and create refunds, store credit, replacement orders and exchange payments through Shopify
• Refunds and Store Credit: Refunds are issued through Shopify to the original payment method. Store credit is issued as a Shopify refund to the customer's Shopify store-credit account; we do not create gift cards or discount codes as refunds. We keep a record of each refund (amounts and Shopify identifiers) so that a refund is never sent twice.
• Shipment Tracking: Track shipments, calculate SLA breach predictions, send alerts
• Branded Tracking Pages: Display shipment status to the store's customers on its branded tracking pages
• Courier Integration: Make API calls to courier services using the store's credentials to retrieve tracking updates and book return pickups
• Insights: When AI insights are enabled for a store, we generate them from aggregated delivery statistics (for example, on-time rates by courier and city), which contain no names, email addresses, addresses or tracking numbers
• Analytics: Monitor app performance, identify bugs, improve our services
• Billing: Calculate usage per month based on the store's subscription plan
• Customer Support: Respond to inquiries and troubleshoot issues
• Compliance: Meet legal obligations, prevent fraud, enforce our Terms of Service

5. Data Sharing and Disclosure

5.1 Service Providers

We share data only with the following service providers, and only as needed to run our services:

• Shopify: The platform our app runs on. Orders, refunds, store credit and replacement orders are read and created through Shopify's API.
• Supabase: Database, sign-in and file storage (including return photos), hosted on AWS in Frankfurt, Germany
• Hetzner Online GmbH: Our application servers, in Germany
• Redis Ltd (Redis Cloud): Background job queue and short-lived caches, hosted on AWS in Frankfurt, Germany
• Postmark (ActiveCampaign, LLC): Transactional email, such as sign-in links, return updates and data-request exports (United States)
• Cloudflare: Network delivery and protection for our websites and API
• CloudSignal: Real-time notifications inside our dashboard. These notifications contain no customer names, email addresses, addresses or tracking numbers.
• Couriers the store connects (for example UPS, DHL and local carriers): we send tracking numbers to retrieve tracking status, and, for a return pickup the customer requested, the customer's name, pickup address and phone number
• Anthropic: Only when AI insights are enabled for a store, and only the aggregated statistics described in Section 4

5.2 We DO NOT

• Sell your data to third parties
• Use customer data for advertising or marketing outside of our service
• Share data with data brokers or analytics companies

5.3 Legal Requirements

We may disclose information if required by law, subpoena, or to protect our rights, safety, or the rights of others.

6. Data Retention

• Active Stores: We retain a store's order, shipment and return data for as long as the store has our app installed, unless it is erased earlier as described below
• Customer Erasure: When Shopify asks us to erase a customer, we remove their name, email address, phone number and addresses from the store's orders, shipments and returns, and delete their return photos. We keep the financial records of refunds and replacements (amounts and Shopify identifiers, without the customer's personal data), because the store needs them for its accounts. Erased orders are marked so that a later sync from Shopify does not restore their personal data.
• After Uninstall: About 48 hours after a store uninstalls the app, Shopify asks us to delete the store's data. We then delete the store's orders, shipments, returns, photos, tracking pages and settings. We keep the store's subscription record and a minimal record of the store (with its name, email address and access tokens removed) so that a later reinstall works.
• Billing Records: Subscription and charge records, which contain no customer personal data, are retained for 7 years for accounting and tax compliance. Usage records keep a one-way hash of each tracking number so that a parcel is never billed twice; anyone who already holds the tracking number could match it.
• Logs: Operational and error logs are kept for 30 days and then deleted automatically
• Backup Data: Database backups are retained for up to 90 days and then permanently deleted

7. Data Security

We implement industry-standard security measures:

• Encryption in Transit: All data is transmitted over HTTPS/TLS
• Encryption at Rest: Our database and file storage are encrypted at rest by our provider. Store access tokens and courier credentials are additionally encrypted using Fernet symmetric encryption.
• Database Security: PostgreSQL with Row Level Security (RLS) policies that keep each store's data separate
• Access Control: Role-based access for team members (owner, admin, viewer)
• Returns Portal: Sign-in links expire after 30 minutes and portal sessions after 60 minutes. Links in return status emails let the customer view their return for up to 30 days. Return photos are stored privately and shown only through links that expire within minutes.
• Infrastructure: Hosted on secure cloud infrastructure in Germany (see Section 5.1)

However, no method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

8. Your Data Rights (GDPR & CCPA)

8.1 Rights for EU Customers (GDPR)

If you are in the European Union, you have the right to:

• Access: Request a copy of your data
• Rectification: Correct inaccurate data
• Erasure: Request deletion of your data ("right to be forgotten")
• Restriction: Limit how we process your data
• Portability: Receive your data in a structured, machine-readable format
• Object: Object to processing based on legitimate interests

8.2 Rights for California Residents (CCPA)

California residents have the right to:

• Know what personal information we collect and how we use it
• Delete personal information (with exceptions for legal obligations)
• Opt-out of the sale of personal information (we do not sell data)
• Non-discrimination for exercising privacy rights

8.3 How to Exercise Your Rights

To exercise any of these rights, email us at [email protected] with the subject line "Data Request". We will respond within 30 days.

If you are a customer of a store that uses Logistimate, please contact the store first: the store decides how your data is used, and Shopify forwards its data and erasure requests to us automatically. We will also help the store answer a request you send to us.

8.4 Right to Lodge a Complaint

If you believe we have not adequately addressed your data protection concerns, you have the right to lodge a complaint with a supervisory authority. For Israeli residents, this is the Israeli Privacy Protection Authority (PPA). EU residents may contact their local Data Protection Authority (DPA).

9. Shopify Data Requirements

As a Shopify app, we comply with Shopify's API Terms of Service and handle privacy requests via the following webhooks:

• customers/data_request: We email the store's owners and administrators a structured (JSON) export of the data we hold about the customer, including links to the customer's return photos that expire after 7 days, so the store can answer the customer
• customers/redact: We erase the customer's personal data as described in Section 6
• shop/redact: We delete the store's data as described in Section 6, within 30 days

10. Cookies and Tracking

Our websites, dashboard, returns portal and tracking pages use cookies only for:

• Session Management: Keep team members signed in to the dashboard, and keep a customer signed in to the returns portal (a session cookie that lasts about 60 minutes)
• Preferences: Remember language settings

We do not use advertising or third-party analytics cookies. You can control cookies through your browser settings. Disabling cookies may limit functionality.

11. International Data Transfers

We store and process data in the European Union (Germany): our database, file storage, application servers and job queue are located there. Some service providers process data outside the EU, such as Postmark (email delivery, United States), Cloudflare (global network), Anthropic (aggregated statistics only, United States) and couriers in the countries where they operate. We ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) for EU data transfers
• Encryption in transit and at rest
• Compliance with GDPR and applicable data protection laws

12. Children's Privacy

Our service is not intended for users under 18 years of age. We do not knowingly collect personal information from children. If you believe we have collected data from a child, contact us immediately.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or through the app. Continued use of our service after changes constitutes acceptance of the updated policy.

14. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us:

• Email: [email protected]
• Address: 651 N Broad St, Suite 201, Middletown, DE 19709, USA
• Data Protection Officer: [email protected]