Privacy Policy

Introduction

Bifrost Tech (Private) Limited ("we," "us," "our," or "Bifrost Tech"), a private limited company incorporated in Pakistan with registered office at B-310 Post Office Society, Sector 13A, Gulzar E Hijri, Karachi, Pakistan, operates the "pak-shipping-recon" application (the "App") available through the Shopify App Store.

This Privacy Policy explains how we collect, use, store, and protect information when merchants and their customers interact with our App, accessible at https://pak-shipping-recon.bifrosttech.io.

By installing or using our App, you agree to the practices described in this Privacy Policy.

Information We Collect

Merchant Store Information

When you install our App on your Shopify store, we collect:

• - Shopify store domain (e.g., yourstore.myshopify.com)
• - Store owner name and contact email
• - OAuth access tokens for authorized API scopes
• - Subscription status and billing information (managed through Shopify Billing API)

Order Data

To provide reconciliation services, we access and store:

• - Order numbers and reference IDs
• - Tracking numbers and courier information
• - Customer name and city (for order matching)
• - Shipping address (city, province)
• - Order total, cash-on-delivery (COD) amount
• - Product weight and quantity (from Shopify variants)
• - Fulfillment details (tracking, carrier, status)
• - Order line items (variant ID, quantity, product title, weight snapshot)

Courier Invoice Data

Merchants upload courier billing files that contain:

• - Consignment/tracking numbers
• - Origin and destination cities
• - Weight declarations
• - Shipping charges (base, fuel, GST, withholding tax)
• - COD amounts
• - Delivery status

Merchant Configuration

• - Service Level Agreement (SLA) rate cards
• - Zone mappings
• - Product weight categories
• - Custom reconciliation preferences

Information We Do NOT Collect

We explicitly do NOT collect or store:

• - Customer email addresses
• - Customer phone numbers
• - Payment card information or financial credentials
• - Product images or detailed product descriptions
• - Customer personal identification documents

How We Use Information

We use collected information solely to:

• - Match Shopify orders with courier invoice entries by consignment number
• - Calculate expected shipping charges based on your SLA rates
• - Detect discrepancies between courier billing and expected amounts
• - Identify potential weight-based overcharging (weight fraud detection)
• - Track quota usage for subscription enforcement
• - Generate reconciliation reports for your records
• - Provide customer support
• - Comply with legal obligations under Pakistani law and Shopify Partner Program requirements

Data Storage and Security

Storage Location

All data is stored on servers located in Germany, hosted through our infrastructure provider. Data is stored in PostgreSQL databases with row-level security (RLS) ensuring strict tenant isolation between merchants.

Security Measures

• - HTTPS/TLS encryption for all data transmission
• - Row-level security (RLS) policies preventing cross-merchant data access
• - Access tokens encrypted at rest
• - HMAC signature verification for all Shopify webhooks
• - Regular security audits and dependency updates

Data Retention

• - **During active subscription:** Data retained for as long as the App remains installed
• - **After uninstallation:** All merchant data permanently deleted within 48 hours, in compliance with Shopify's GDPR requirements
• - **Historical reconciliation reports:** Retained during active subscription; deleted upon uninstall
• - **Audit logs:** Retained for 90 days for security purposes

Data Sharing

We do NOT sell, rent, or trade your data with third parties. Data is shared only with:

Shopify

We interact with Shopify's API to fetch order data and manage billing. This is governed by Shopify's own Privacy Policy and API terms.

Service Providers

We use the following third-party services strictly for infrastructure:

• - **Hosting provider:** For server and database hosting (Germany-based)
• - **No analytics, tracking, or marketing services** are integrated

Legal Requirements

We may disclose information if required by:

• - Valid legal process under Pakistani law
• - Court orders from courts of competent jurisdiction in Karachi, Pakistan
• - Regulatory requirements from Pakistani authorities

Your Rights

Right to Access

You may request a copy of all data we hold about your store by emailing info@bifrosttech.io.

Right to Deletion

You may request deletion of your data at any time by:

• - Uninstalling the App (automatic deletion within 48 hours)
• - Emailing info@bifrosttech.io for expedited deletion

Right to Rectification

You may request correction of inaccurate data by contacting info@bifrosttech.io.

Right to Portability

You may request an export of your data in machine-readable format (CSV/JSON).

GDPR Compliance

For European Union customers, we comply with GDPR requirements through Shopify's mandatory GDPR webhooks:

• - 'customers/data_request' — Merchants may request customer data on behalf of their customers
• - 'customers/redact' — Customer data deletion requests
• - 'shop/redact' — Full store data deletion 48 hours after uninstall

Cookies and Tracking

Our App uses only functional cookies required for authentication (Shopify session tokens). We do NOT use:

• - Advertising cookies
• - Analytics tracking
• - Cross-site tracking
• - Third-party marketing pixels

Children's Privacy

Our App is intended for business use by Shopify merchants. We do not knowingly collect information from individuals under 18 years of age.

International Data Transfers

Data is stored on servers in Germany. By using our App, you consent to transfer of data to Germany for processing. Adequate safeguards are in place through our infrastructure provider's compliance with GDPR standards.

Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via:

• - Email to registered merchant email
• - Notification within the App dashboard
• - Updated "Last Updated" date at the top of this policy

Contact Us

For privacy inquiries, data requests, or complaints:

Bifrost Tech (Private) Limited

B-310 Post Office Society Sector 13A
Gulzar E Hijri
Karachi, Pakistan

Privacy/Legal Contact: info@bifrosttech.io
General Support: support@bifrosttech.io
Website: https://bifrosttech.io/

Governing Law

This Privacy Policy is governed by the laws of the Islamic Republic of Pakistan. Any disputes arising from or related to this policy shall be subject to the exclusive jurisdiction of the courts of Karachi, Pakistan.

This policy is designed to comply with the Shopify Partner Program requirements and applicable data protection laws.