Privacy policy

Effective 12 August 2026

Shippy Whippy provides Australia Post shipping-rate tools to Shopify merchants. This policy explains the personal data we process when a merchant installs or uses the app, why we process it, and how we protect and delete it. By installing or using Shippy Whippy, a merchant instructs us to process this data only to provide and secure the service described here.

Data we process

• Merchant and installation data: shop domain, shop identity and configuration, Shopify installation sessions and authorised staff account details supplied by Shopify. We use these to authenticate the app, provide onboarding and support, and keep each merchant's data separate.
• Shipping-rate requests: fulfilment origin, destination country and postcode, aggregate item quantity and weight, and Shopify delivery-group product references. The app uses these values transiently to calculate rates. It does not retain the buyer's name, street address, email, phone number, customer ID, product ID or variant ID in shipping-calculation telemetry.
• Completed-order attribution: selected shipping service code, aggregate shippable quantity and weight, event time, attribution method and a secret-keyed one-way order identifier. The app discards customer identity and contact/address fields and does not store raw order payloads or raw Shopify order IDs for this feature.
• Merchant carrier settings: enabled services, labels, descriptions, price adjustments, origin package profiles and any carrier-account credentials a merchant chooses to connect. Carrier secrets are separately encrypted.
• Operational data: limited security, error and performance information needed to operate the service. Customer addresses and raw carrier payloads are excluded from application logs.

How we use data

We process data only to install and authenticate the app; calculate and display shipping options; apply merchant shipping rules; diagnose service health; attribute privacy-minimised rate calculations to completed orders; secure the service; and respond to merchant support requests. We do not sell personal data, share it for behavioural advertising, build customer profiles, or make automated decisions that have legal or similarly significant effects on a customer.

Service providers and disclosure

We disclose only the data needed for these purposes to Shopify, Australia Post or another carrier selected by the merchant, and our contracted hosting, database, security and email providers. These providers process data on our behalf or under their own applicable terms. We may also disclose information when required by law or to protect the rights and security of merchants, customers or the service. Data may be processed in countries other than the merchant's country, subject to applicable contractual and technical safeguards.

Retention and deletion

Detailed shipping-calculation and completed-order attribution records are kept for no more than 90 days. Merchant configuration and installation data are kept while the app is installed and only as long afterward as needed for legal, security or support obligations. Shopify's mandatory customer-data request, customer-redaction and shop-redaction webhooks are supported. A shop-redaction request deletes the remaining shop configuration, sessions, credentials, shipment records and related telemetry. Backups expire under the hosting provider's controlled retention schedule.

Security

Data is encrypted in transit with HTTPS and at rest by the production hosting provider. Carrier credentials are encrypted separately. Shopify webhook signatures are verified, dashboard access is authenticated, and access is limited to people and systems that need it to operate or secure the service. No internet service can guarantee absolute security, but we maintain controls appropriate to the limited data we process.

Choices and requests

Customers should first contact the Shopify merchant with whom they placed an order. Merchants can uninstall the app and can ask us about access, correction, deletion or other applicable privacy rights. We respond to Shopify privacy webhooks and merchant requests as required. The app does not use consent-based advertising, data sales or significant automated decision-making, so it does not override a customer's consent or opt-out choice.

Changes and contact

We may update this policy when the service or legal requirements change. The effective date above identifies the current version. For privacy questions or requests, email help@shippywhippy.com. Shippy Whippy is operated from Newcastle, New South Wales, Australia.