Dragon Courier Shipping App
Privacy Policy
Effective date:
1. Introduction
Dragon Courier Shipping App ("the app", "we", "our") is a Shopify embedded application that connects your Shopify store to Dragon Courier, a Thailand-based international logistics provider. The app lets you create shipping labels, track parcels, manage re-shipments, and synchronise order data — all from your Shopify admin.
This Privacy Policy explains what information we collect when you install and use the app, how we use it, who we share it with, how we protect it, and the rights you and your customers have over that data.
By installing or using the app, you agree to the practices described in this policy.
2. Information We Collect
2.1 Merchant data (via Shopify OAuth)
When you install the app and complete OAuth authentication, Shopify provides us with:
| Field | Source | Purpose |
|---|---|---|
Store domain (shop) |
Shopify OAuth session | Identify your store; partition all data by tenant |
| Access token | Shopify OAuth session | Authenticate API requests to your store |
| Your first name, last name, email | Shopify OAuth session (the user who authorised the app) | Identify the authorised merchant user for support and audit |
| Shopify plan name | Shopify Admin GraphQL (shop.plan.publicDisplayName) |
Determine feature eligibility |
2.2 Store configuration data (you provide in Settings)
| Field | Encryption | Purpose |
|---|---|---|
| Dragon Courier Client ID | Plaintext (account identifier, not a secret) | Connect your Dragon Courier account |
| Dragon Courier Client Secret | AES-256-GCM encrypted (see §6.1) | Authenticate API calls to Dragon Courier |
| Supported markets (country list) | Plaintext | Determine which destination countries are eligible for label creation |
| Sender information (name, phone, email, address) | Plaintext | Populate the "from" fields on shipping labels |
| Per-location sender overrides | Plaintext | Allow different sender details per fulfillment location |
| Rate display template, surcharge settings | Plaintext | Configure checkout rate presentation (temporarily disabled — data retained) |
| Page size preference | Plaintext | UI pagination |
2.3 Order & shipment data (via Shopify webhooks and Admin API)
When orders are created, updated, or cancelled in your store, Shopify sends webhooks and the app caches the following:
Cached order records (per order):
- Order ID, order number, currency, total price, financial status, fulfillment status
- Customer email address
- Recipient shipping name (first / last), phone, street address (line 1 & 2), city, province, postal code, country code
- Line items (title, SKU, quantity, weight) as a JSON array
- Shipping charge paid at checkout
- Order creation timestamp
Shipment records (per label created):
- Order ID, order number, fulfillment order ID / name, Shopify fulfillment ID
- Dragon Courier shipment ID, tracking number, carrier, service type
- Label URL and label PDF data (base64)
- Parcel weight and unit
- Shipment status (pending / completed / failed), delivery status, error messages
- Destination country
- Recipient name (first / last), phone, street address, city, postal code
2.4 Technical data
- OAuth session tokens: Shopify access tokens and refresh tokens stored in the session table to maintain authenticated access between requests
- Diagnostic logs: server-side console output used exclusively for troubleshooting.
Logs may contain order/shipment identifiers, Dragon Courier API request paths, error messages, and —
when a shipping label is created — the recipient shipping details sent in the Dragon Courier
create_shipmentrequest (recipient name, phone, and delivery address). Logs do not contain payment card numbers, customer passwords, or Dragon Courier credentials in plaintext (the Client Secret is only ever handled in encrypted form, and authentication tokens are not written to logs). Diagnostic logs are retained by the hosting provider's log-rotation policy (typically 7–30 days) and are accessible only to the application's operators for support and security purposes.
2.5 Data we do NOT collect
We explicitly do not collect, store, or process:
- Payment card numbers (PAN), CVV, or expiration dates
- Bank account numbers or routing numbers
- Customer passwords or Shopify login credentials
- Government-issued identification numbers
- Health, biometric, or racial/ethnic data
- Browsing behaviour, cookies, or advertising identifiers (the app is embedded in Shopify admin and sets no tracking cookies)
- Data from your customers' devices or browsers
3. How We Use Information
We use the collected information exclusively to provide the app's functionality:
| Purpose | Data used |
|---|---|
| Create Dragon Courier shipping labels for your orders | Recipient name/phone/address, line items, weights, sender config |
| Fulfil orders in Shopify and trigger customer tracking emails | Tracking number, fulfillment order ID |
| Synchronise order and shipment status automatically via webhooks | Order ID, financial/fulfillment status, shipping address |
| Display shipment history, download label PDFs, and manage re-ships | Shipment records, label data |
| Detect shipping-country changes after checkout | Cached initial country code vs. current country code |
| Calculate and display shipping rates at checkout (temporarily disabled) | Rate config, price tables, exchange rates |
| Provide diagnostics and customer support | Server logs, error messages |
We do not use your data or your customers' data for advertising, marketing, analytics profiling, or any purpose unrelated to the app's shipping functionality.
4. Legal Basis for Processing (GDPR Article 6)
If you or your customers are located in the EU/EEA/UK, we process personal data under the following legal bases:
| Legal basis | Applies to |
|---|---|
| Contract performance (Art. 6(1)(b)) | Processing necessary to create shipping labels, fulfil orders, and deliver parcels — the core service you contracted when installing the app |
| Legitimate interest (Art. 6(1)(f)) | Caching order data via webhooks to provide automatic sync; storing diagnostic logs for security and troubleshooting; detecting country changes to prevent mis-shipments |
| Consent (Art. 6(1)(a)) | Not relied upon — the app does not use cookies, tracking pixels, or optional data collection |
5. Sharing with Third Parties
| Recipient | What is shared | Why | Data protection |
|---|---|---|---|
| Dragon Courier (Thailand logistics provider) | Recipient name, phone, street address, city, postal code, destination country; order line items and weights; sender details | Required to create the shipping label, pick up the parcel, and deliver it | TLS/HTTPS in transit; Dragon Courier acts as an independent data controller for the delivery |
| Shopify | Data read from and written to your store via Shopify's official Admin GraphQL API (orders, fulfillments, locations, markets, delivery profiles) | The app operates inside your Shopify admin and relies on Shopify's platform APIs | Governed by Shopify's own privacy policy and data processing agreement |
| Database hosting provider | All stored records (sessions, settings, shipments, cached orders, sender config) | Persistent storage required for app operation | Access restricted to the application service account; encrypted at rest by the provider |
| Server hosting provider | Application runtime, server logs (see §2.4) | Hosting the Node.js application | Access restricted to operators; logs contain no payment card data or plaintext credentials |
We do not sell, rent, trade, or disclose your data or your customers' data to any other party. We do not share data with advertising networks, data brokers, or analytics providers.
6. Data Storage & Security
6.1 Encryption of Dragon Courier credentials
Your Dragon Courier Client Secret is encrypted before it is written to the database:
| Property | Value |
|---|---|
| Algorithm | AES-256-GCM (authenticated encryption with associated data) |
| Key length | 256 bits (32 bytes) |
| Key derivation | PBKDF2 with SHA-256, 100,000 iterations |
| Key source | Derived from the SHOPIFY_API_SECRET environment variable — never hardcoded,
never committed to source control |
| IV (initialisation vector) | 16 bytes, cryptographically random per encryption operation
(crypto.randomBytes) |
| Auth tag | 16 bytes, verified on every decryption — tampered ciphertext is rejected |
| Storage format | Base64-encoded concatenation of IV ‖ authTag ‖ ciphertext |
The app fails fast if SHOPIFY_API_SECRET is not set — it will not start
with a missing or fallback encryption key.
6.2 Encryption in transit
- All communication between the app and Shopify uses TLS 1.2+ / HTTPS
- All communication between the app and Dragon Courier uses TLS 1.2+ / HTTPS
- Shopify webhook payloads are verified using HMAC-SHA256 signatures before processing; invalid signatures are rejected with HTTP 401
6.3 Access control
- The app requests only the minimum Shopify API scopes needed for its features (see
shopify.app.toml):read_orders,read_fulfillments,read_locations,read_shipping,write_shipping,write_products,read_markets,write_markets, and fulfillment-order read/write scopes - All data processing happens server-side; no customer PII is exposed to the browser beyond what Shopify admin already displays
- Label PDF downloads are proxied through the app's server — direct Dragon Courier URLs are never exposed to the client
- Database access is restricted to the application's service account; no interactive or third-party access is granted
6.4 Hosting & database
| Component | Production | Development |
|---|---|---|
| Application server | Node.js (Express) behind HTTPS reverse proxy | Vite dev server |
| Database | PostgreSQL (connection string via DATABASE_URL env var,
credentials masked in logs) |
SQLite (local file, not used in production) |
| Process management | PM2 with automatic restart on crash | — |
| Data residency | [Insert hosting region, e.g. "Singapore / AWS ap-southeast-1"] | Local machine |
While we apply industry-standard safeguards, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
7. Data Retention & Deletion
7.1 App uninstall (immediate)
When you uninstall the app from your Shopify store, the app/uninstalled webhook fires and we
immediately delete all records associated with your store from the following tables:
| Table | What is deleted |
|---|---|
Session |
OAuth tokens, merchant name/email, session state |
ShopSetting |
Dragon Courier credentials (encrypted), sender config, rate settings, supported markets |
Shipment |
All shipment records including recipient name, phone, address, tracking numbers, label PDFs |
ShopOrder |
All cached order records including customer email, shipping name/phone/address |
LocationSender |
Per-location sender overrides (name, phone, email, address) |
7.2 shop/redact (48 hours after uninstall)
Shopify sends a mandatory shop/redact webhook 48 hours after uninstall as a
safety net. Our implementation performs the same complete deletion as §7.1 across all
five tables listed above, ensuring no residual data remains even if the uninstall webhook failed or was
missed.
7.3 customers/redact (customer deletion request)
When a customer exercises their right to erasure, Shopify sends a customers/redact webhook.
Our implementation anonymises personal information on affected records while preserving
non-personal business data:
Shipment records — the following fields are set to null:
recipientName, recipientFirstName, recipientLastName,
recipientPhone, recipientAddress, recipientCity,
recipientPostalCode.
Cached order records — the following fields are set to null:
email, shippingName, shippingFirstName,
shippingLastName, shippingPhone, shippingAddress1,
shippingAddress2, shippingCity, shippingProvince,
shippingZip.
Retained (non-personal business records): tracking number, shipment status, parcel weight, destination country, order number, timestamps. These are kept for logistics audit and dispute resolution and contain no customer-identifiable information.
7.4 customers/data_request (customer data access request)
When a customer requests access to their data, Shopify sends a customers/data_request
webhook. Our implementation compiles all stored records for the requested orders
(shipment recipient details + cached order contact/shipping information) and makes them available in
server logs so that you (the merchant) can retrieve, format, and deliver the data to the customer as
required by applicable law.
7.5 Retention period
- Active installation: data is retained for as long as the app is installed on your store
- After uninstall: all data is deleted immediately (§7.1) and verified deleted within 48 hours (§7.2)
- Server logs: diagnostic console output is retained by the hosting provider's log rotation policy (typically 7–30 days). As described in §2.4, logs may include recipient shipping details recorded during label creation, but contain no payment card data or plaintext credentials
8. Your Rights
8.1 GDPR (EU / EEA / UK residents)
If you or your customers are located in the EU, EEA, or UK, you have the following rights under the General Data Protection Regulation:
| Right | How it is fulfilled |
|---|---|
| Access (Art. 15) | Customers: via customers/data_request webhook (§7.4). Merchants: contact us
directly |
| Rectification (Art. 16) | Update sender info in Settings; customer address corrections flow through Shopify order edits → webhook sync |
| Erasure (Art. 17) | Customers: via customers/redact webhook (§7.3). Merchants: uninstall the
app (§7.1–7.2) or contact us |
| Restriction of processing (Art. 18) | Contact us; we can disable specific processing (e.g. stop label creation) while retaining data |
| Data portability (Art. 20) | Customer data is provided in structured JSON format via the
customers/data_request webhook |
| Objection (Art. 21) | Contact us; we will cease processing unless compelling legitimate grounds override |
8.2 CCPA / CPRA (California residents)
If you or your customers are California residents, you have the following rights under the California Consumer Privacy Act (as amended by the CPRA):
| Right | How it is fulfilled |
|---|---|
| Right to know | Request disclosure of categories and specific pieces of personal information collected (§2) |
| Right to delete | Same as GDPR erasure — via customers/redact webhook or direct request |
| Right to correct | Same as GDPR rectification |
| Right to opt out of sale/sharing | Not applicable — we do not sell or share personal information as defined by CCPA |
| Right to non-discrimination | We do not deny service, charge different prices, or degrade quality for exercising privacy rights |
| Right to limit use of sensitive PI | We do not collect sensitive personal information as defined by CPRA (§2.5) |
8.3 How to exercise your rights
- Customer requests: Shopify automatically routes
customers/data_requestandcustomers/redactwebhooks to our app. No action is needed from you — processing is automatic. - Merchant requests: contact us at [email protected]
- Response time: we respond to all verified requests within 30 days (GDPR Art. 12) or 45 days (CCPA §1798.130), extendable by a further 30/45 days with notice
- Verification: we may request proof of identity or store ownership before processing
- Complaints: you have the right to lodge a complaint with your local data protection authority (EU/EEA/UK) or the California Attorney General (US)
9. International Data Transfers
Your store data is processed on servers located in Singapore / AWS ap-southeast-1. If you or your customers are located outside this region, personal data is transferred across borders.
For transfers from the EU/EEA/UK, we rely on:
- Adequacy decisions where the European Commission has determined the destination country provides adequate protection; or
- Standard Contractual Clauses (SCCs) incorporated into our agreements with hosting and database providers.
Dragon Courier operates in Thailand and receives recipient data solely for parcel delivery. Thailand's Personal Data Protection Act (PDPA, B.E. 2562) provides substantially similar protections to GDPR.
10. Children's Privacy
The app is a business-to-business tool intended for merchants operating Shopify stores. It is not directed at children under 13 (or under 16 in the EU/EEA), and we do not knowingly collect personal information from children. If you believe a child has provided personal information through the app, contact us at [email protected] and we will delete it.
11. Changes to This Policy
We may update this policy from time to time to reflect changes in our practices, technology, or legal requirements. When we do:
- We will revise the "Effective date" at the top of this page.
- For significant changes (new data categories, new third-party recipients, material changes to deletion timelines), we will notify merchants through an in-app banner or by email to the address associated with your Shopify account.
- The current version is always available at: https://dragoncouriertracking.com/PrivacyPolicy.
Continued use of the app after changes take effect constitutes acceptance of the updated policy.
12. Contact Us
Questions about this policy, your data, or a privacy request? Contact us at:
- Email: [email protected]
- App: Dragon Courier Shipping App → Settings → support resources
- Developer: Dragon Courier
- Mailing address: 3rd Floor, Crystal Garden, Sukhumvit Rd, Klongtoey, Bangkok 10110, Thailand
We respond to privacy inquiries within 30 days.