Privacy Policy
Effective date:
Last updated:
This Privacy Policy explains how Bellhaven Labs (“we”, “us”) handles information in connection with the ShipSignal Shopify app (“the App”) and this website, bellhavenlabs.com. ShipSignal is in early development; this policy describes what the App does today and what we will do as planned features are released. We will update this policy before any change in how we handle data takes effect.
1. Who we are
Bellhaven Labs, operated by Beiry Fernandez. Contact: help@bellhavenlabs.com.
For personal information about a merchant's customers, the merchant is the controller and we act as a processor (service provider) on the merchant's behalf.
2. Information the App accesses from Shopify
When a merchant installs ShipSignal, the App accesses data through Shopify's APIs only to the extent of the permissions (scopes) the merchant grants.
Today
- Session data: shop domain, access token, granted scopes, and basic information about the staff user who installed the App (name and email address).
- Shop information: shop name.
Planned (as features are released)
- Orders: order ID/name, line items, created date and order status.
- Customer email address on the order, used only to send that customer pre-ship progress and delay updates.
- Products: read and write access so merchants can tag products as made-to-order, preorder or backorder and store a lead time on the product (as a metafield).
- Fulfillment status: read access to fulfillment status, to detect when an order ships so updates stop.
The Shopify access scopes we plan to request are read_orders, read_products and write_products, plus read access to fulfillment status. We do not request read_customers; the customer email address comes from the order itself.
We never access or store payment card data.
3. How we use information
- To authenticate merchants and operate the App inside Shopify admin.
- To calculate estimated ship dates and send pre-ship progress emails and delay notices to the merchant's customers on the merchant's behalf (planned).
- To provide support and respond to requests.
- To maintain the security and reliability of the App.
We do not sell personal information, use it for advertising, or use it for any purpose other than providing the App.
4. Sharing and sub-processors
We share information only with service providers needed to run the App:
| Provider | Purpose | Location |
|---|---|---|
| Shopify | E-commerce platform the App runs on | Per Shopify's policies |
| A US-based hosting provider | Hosting and database for the App | United States |
| A US-based transactional email provider | Sending customer update emails (planned) | United States |
App data is stored in the United States. We will name our hosting and email providers here once they are chosen. We may also disclose information if required by law.
5. Retention and deletion
- Order records: we will delete each order record 90 days after the order is fulfilled or cancelled.
- Uninstall: when a merchant uninstalls the App, Shopify sends a
shop/redactrequest about 48 hours later. When it arrives, we will delete all data we hold for that shop. - Shopify privacy webhooks: we will honor Shopify's mandatory privacy webhooks:
customers/data_request: within 30 days, we will provide the merchant with any data we hold about the requesting customer.customers/redact: within 30 days, we will delete data we hold about the specified customer.shop/redact: we will delete all data we hold about the shop.
- Backups: the only backups are our hosting provider's automatic database backups, kept for 30 days or less. Deleted data ages out of backups within that window.
6. Security
We use reasonable measures to protect information, including encrypted connections (HTTPS), limiting access to data to what the App needs, and requesting only the Shopify permissions required. Data is stored with our hosting provider in the United States. No method of transmission or storage is completely secure.
7. Your rights
Depending on where you live, you may have rights to access, correct, delete or export your personal information, or to object to its processing.
- Merchants can contact us directly at the email below.
- Customers of a shop using ShipSignal should contact that shop first; the shop can submit a request through Shopify, which we will honor. You may also email us and we will work with the shop.
8. This website
bellhavenlabs.com is a static website served by Cloudflare Pages (Cloudflare, Inc.). We run no analytics and set no cookies, and the site loads no third-party fonts or scripts. Cloudflare may process standard request data, such as IP address, to deliver and protect the site, as described in Cloudflare's privacy policy.
9. Changes to this policy
We will post any changes on this page and update the date above. For material changes, we will notify merchants who have installed the App.
10. Contact
Questions or requests: help@bellhavenlabs.com