Privacy policy

Last updated: 9 November 2026

This policy explains how WS SOLUTIONS LLC (“we”), 5830 E 2nd St, Casper, WY 82609, United States, processes personal data in the Trackrobin Shopify app and on trackrobin.com. Contact: privacy@trackrobin.com.

1. Roles

For data about the merchant's customers (order and shipping data), the merchant is the controller and we act as processor on the merchant's instructions. For data about merchants using the app and visitors of trackrobin.com, we are the controller.

2. Data we process

• Merchant account data: shop domain, store name, staff email, app settings, plan and billing status (billing is handled by Shopify).
• Order and shipping data from Shopify: order number, products, customer name, email, phone, shipping country and city, tracking numbers, carrier events.
• Tracking page usage: lookups, clicks on recommended products, return and claim requests and reviews submitted by customers.
• Email events: whether a shipping email was delivered, opened or clicked, and unsubscribes.
• Website: technical logs (IP address, browser) kept for security for up to 30 days. We do not use advertising cookies.

3. Purposes and legal bases

We process data to provide the app (contract with the merchant, Art. 6(1)(b) GDPR), to send shipping notifications on the merchant's behalf, to keep the service secure and to comply with legal obligations (Art. 6(1)(c) and (f) GDPR). Marketing emails to merchants are only sent with consent.

4. Subprocessors

• Google Cloud (hosting and database, EU region Belgium)
• Shopify (app platform and billing)
• Brevo (sending shipping emails)
• 17TRACK (carrier tracking data: tracking numbers only)
• Optional, only if the merchant enables them: Twilio (SMS), DeepL (translation of tracking events), Klaviyo, Omnisend, PayPal, Google Sheets, helpdesk tools.

Where data leaves the EU/EEA, transfers rely on the EU-US Data Privacy Framework or Standard Contractual Clauses.

5. Retention

Shipment data is deleted automatically 24 months after its last update, orders that never received a tracking number after 3 months, and logs of sent emails, lookups and clicks after 12 months. All data of a store is deleted within 48 hours after Shopify's shop-redact request (sent 48 hours after uninstalling). Customer data is deleted on Shopify's customer-redact request. Database backups are encrypted and kept for 7 days.

6. Your rights

You can request access, correction, deletion, restriction, portability or object to processing. Customers of a store should contact the store first; we will support the merchant. You can also complain to a data protection authority. Every shipping email contains an unsubscribe link.

7. Security

Data is encrypted in transit and at rest, access is limited to what the service needs, and Shopify access tokens are stored server-side only.

8. Changes

We will announce material changes in the app and update the date above.