Privacy Policy — BirdSystem Fulfillment

Last updated: 4 June 2026

This Privacy Policy explains how BirdSystem ("we", "us", "BirdSystem") collects, uses, shares, and protects information when a merchant installs and uses the BirdSystem Fulfillment app (the "App") on their Shopify store.

1. Who we are

BirdSystem operates a cross-border logistics and warehouse fulfillment network. The App connects a merchant's Shopify store to that network so orders can be imported, routed to a warehouse, shipped, and updated with tracking information.

2. Information we access and collect

When the App is installed and authorized, we access the following data from the merchant's Shopify store through the Shopify API, strictly to provide fulfillment:

• Order data — order and fulfillment-order details, line items, quantities, and SKUs.
• Customer data needed to deliver — recipient name, shipping address, and (where present) contact details used by the carrier for delivery.
• Product & inventory data — product/variant information and inventory locations, to identify the correct item and warehouse.
• Market data — store markets, to offer the correct delivery service per market.
• Store & app data — shop domain and the API access token (stored encrypted) used to communicate with the store.

We do not access storefront browsing data, and we do not access or store payment card / financial account numbers.

3. How we use the information

• Import paid orders and route them to the appropriate fulfillment warehouse.
• Pick, pack, and dispatch orders through our logistics network and carriers.
• Write the carrier tracking number back to the Shopify order and update its fulfillment status.
• Operate, secure, debug, and support the App.

We do not sell personal information, and we do not use it for advertising.

4. How we share information

We share information only as needed to fulfill orders:

• Carriers / postal operators — recipient name and shipping address required to deliver the parcel.
• Warehouse / logistics partners within the BirdSystem network performing the fulfillment.
• Service providers (e.g. cloud hosting) under appropriate confidentiality and data-processing terms.
• Legal requirements — where required by applicable law.

5. International transfers

Because this is a cross-border fulfillment service, order and recipient data may be transferred to and processed in countries other than the customer's own, including where our warehouses and carriers operate. We apply appropriate safeguards for such transfers.

6. Data retention and deletion

• We retain order and fulfillment data only as long as needed to provide the service and to meet legal, tax, and customs record-keeping obligations.
• We honor Shopify's mandatory data webhooks: customers/data_request, customers/redact, and shop/redact.
• On customers/redact we remove the affected customers' personal data from the relevant order records; on shop/redact (sent about 48 hours after uninstall) we remove the shop's personal data.
• On app uninstall (app/uninstalled) we stop processing and clean up access credentials.

7. Your rights

Depending on your location, you may have rights to access, correct, or delete personal data, or to restrict or object to its processing. Shopify merchants and their customers can exercise data-request and deletion rights through Shopify, which we fulfill via the data webhooks above.

8. Security

• API access tokens are stored encrypted.
• All data is transmitted over HTTPS/TLS.
• OAuth and all webhooks are verified using HMAC signatures; OAuth additionally uses a nonce for CSRF protection.

9. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above.

10. Data requests

Requests to access or delete personal data are handled through Shopify's standard data request and account/shop deletion flows, which this app honors via the data webhooks listed in section 6.