1. Who we are
SferaFlow is a Shopify app made by DB Ecom Group LLC ("we", "us"). It checks cash on delivery orders before they ship, books parcels with your courier, prints labels and tracks parcels.
For your customers' data, you (the merchant) decide what happens with it. We only use it to run SferaFlow for you.
2. What we keep
From your Shopify orders:
- Order number, cash on delivery amount and the items (product name, SKU, quantity, price, image link)
- Your customer's name, phone, email and shipping address
- Where the order came from: UTM tags, landing page and referring site
About you and your store:
- Store name, domain, email, owner name, country, currency, time zone and plan
- Your login: email, name and password. We keep the password only as a secure hash.
- For each login: IP address and browser, so we can keep your account safe
- Your courier settings: sender details and courier login. The login is encrypted.
What you add in the app: customers you don't ship to, notes, and your decisions on held orders.
From our website form: if you send the "other couriers" form on sferaflow.com, we keep your email, store address, parcels per month and your note, so we can reply.
We do not read your products, inventory or customer accounts in Shopify. We do not change or cancel your Shopify orders.
3. Why we use it
- To book parcels with your courier, print labels and mark orders as fulfilled in Shopify
- To show you where each parcel is
- To check orders before they ship (see below)
- To show your reports, like returns and money saved
- To email you: password reset, store confirmation, plan limit warnings and data requests
- To find and fix errors in the app
Order checks. SferaFlow compares a new order with past orders in your stores: returned parcels, the same product ordered twice, many orders in a short time and your list of customers you don't ship to. If a rule matches, SferaFlow holds the parcel and tells you why. You can let it go with one click, except for customers on your own "don't ship" list. You can turn the checks off.
Checks only use data from stores in your SferaFlow account. We never share your customers with other merchants or use them to check other merchants' orders.
4. Who else gets data
We do not sell data. We do not use your customers' data for ads. These services help us run SferaFlow:
- Your courier (X-Express): the name, address, phone, cash on delivery amount and a short item description for each parcel you send. Not the email.
- Shopify: order fulfillment and tracking, and billing for your plan.
- Railway: hosts the app and the database.
- Resend: sends our emails to you.
- Upstash: short-lived counters with IP addresses, to stop abuse.
We may also share data if the law requires it.
5. Public tracking page
Anyone with a tracking number can see the parcel status, the dates and the store name. The page does not show the customer's name, address, phone, items or amount. The city is shown only after someone enters the parcel's ZIP code or phone number.
6. How we protect data
- All traffic uses HTTPS.
- Shopify access keys and courier logins are encrypted in our database.
- Each store only sees its own data, and every request is checked.
- Our error logs hide names, phones, emails, addresses and IP addresses.
7. How long we keep it
- While the app is installed: orders, parcels and check results stay, because the checks need past orders.
- When you uninstall: we stop access to your store at once. About 48 hours later Shopify tells us to delete the store's data, and we delete all of it: orders, parcels, customers, check results, settings and logs.
- When a customer asks Shopify to delete their data: we delete that customer's risk data and replace their name, phone, email and address on old parcels with "[REDACTED]".
- Error logs: deleted after 30 days.
- Your login account: stays so you can log in to your other stores. Email us and we delete it.
- Website form: email us and we delete it.
8. Your rights and your customers' rights
You can ask us to see, fix, export or delete your data. Email support@sferaflow.com.
If one of your customers asks for their data through Shopify, we email you a list of what we keep about them, and we help you answer. Deletion requests from Shopify are handled on their own, as described above.
9. Cookies
- In the app: only cookies we need: your login, your language and a short cookie during Shopify install.
- On the sferaflow.com home page: we use the Meta Pixel to see if our ads work and Google Analytics to count visits. They are not used in the app, in help or on the tracking page.
10. Changes
When we change this policy, we update it on this page and change the date at the top. For big changes we also tell you in the app or by email.