Privacy policy

Effective 12 August 2026 · Applies to the Waslio Shopify app and the waslioconnect.com website

Waslio ("the app", "we") is a delivery-dispatch application for Shopify stores, operated by Waslio ("the developer"). This policy explains what data the app receives, why, and what happens to it. When a merchant installs Waslio, the app processes data on the merchant's behalf to provide delivery dispatch and tracking.

Information the app collects

When installed on a Shopify store, Waslio accesses:

• Store information — store domain, store contact email, and the permissions granted at install (read/write orders, fulfillments).
• Order information — order numbers, delivery addresses, order tags, payment status, and delivery-slot attributes, for orders the merchant dispatches (or has auto-dispatch evaluate).
• Customer information within orders — the recipient's name, shipping address, coordinates and phone number. This is collected solely to arrange the delivery.
• Courier account credentials — API keys the merchant enters for their own courier accounts (noon Send, Careem Express, Quiqup, and others). These are encrypted with AES-256-GCM before storage and are never logged or shared.
• Delivery events — courier status updates, rider name/phone and rider location during an active delivery, and optional customer delivery ratings.
• Support messages — messages a merchant sends through the in-app support chat, with their reply-to email.

How information is used

• To create delivery tasks with the couriers the merchant has connected — the recipient's name, address, coordinates and phone number are transmitted to the selected courier so the rider can complete the delivery.
• To show live delivery status to the merchant and, via an unguessable tracking link, to the order's recipient.
• To update the order's fulfillment status in Shopify and optionally tag orders and trigger Shopify's customer notification emails.
• To produce the merchant's own delivery analytics.
• To remember a confirmed map pin for an address so future deliveries to the same address are accurate ("pin memory").

We do not sell or rent any data, use customer data for advertising, or contact a store's customers for any purpose other than displaying their delivery tracking page.

Sharing

• Couriers — delivery details are shared with the courier the merchant (or the merchant's routing rules) selected for that order. Each courier processes that data under its own privacy policy.
• Infrastructure — the app is hosted on DigitalOcean (EU region) with its database on Neon (EU region). Both act as data processors.
• No other third parties receive personal data.

Retention & deletion

• Delivery records are retained while the app is installed so merchants keep their history and analytics.
• On receipt of Shopify's customers/redact webhook, the customer's personal fields in delivery records for that customer are erased.
• On shop/redact (48 hours after uninstall), all of the store's data — settings, encrypted courier credentials, deliveries, analytics — is deleted.
• On customers/data_request, we provide the merchant the delivery data held for that customer.

Security

All traffic is encrypted in transit (TLS). Courier credentials and map-provider keys are encrypted at rest with AES-256-GCM. Tracking pages use random, unguessable tokens and never display the full delivery address or payment details.

The waslioconnect.com website — cookies & analytics

This section covers visitors to our marketing website (waslioconnect.com), separately from the Shopify app above. We only load analytics and recording tools after you consent via the cookie banner; if you decline, none of them run.

• Google Analytics 4 (Google Ireland Ltd.) — measures traffic, page views and referral sources so we can improve the site. IP addresses are anonymised. Set only with your consent. See Google's privacy policy.
• Microsoft Clarity (Microsoft Corp.) — aggregate heatmaps and session replays that help us see where visitors get stuck. Loaded only with your consent; Clarity masks input fields by default. See Microsoft's privacy statement.
• Crisp live chat (Crisp IM SARL, France) — powers the chat widget so you can message us. It stores a functional identifier to keep your conversation, and processes the messages and contact details you choose to share. See Crisp's privacy policy.
• Hosting — the website is served by Netlify; standard server logs (IP, user-agent, timestamps) are processed to deliver and secure the site.

You can withdraw analytics consent at any time by clearing this site's cookies/site data in your browser (which re-shows the banner), or by using your browser's cookie controls. We don't use advertising or cross-site tracking cookies, and we don't sell website-visitor data.

Project enquiries

When you send a project brief through our website, we collect the business context, goals, service interests, indicative budget, timing and contact details you choose to provide. We use this information to assess the project, respond to you and arrange an initial conversation. Sending a brief does not subscribe you to marketing emails or book a meeting automatically.

Briefs are processed and stored through Netlify Forms, with email notifications to the Waslio team. We may include the referring website and campaign identifiers to understand where enquiries come from. The form's written answers and contact details are not sent to website analytics. Please do not include passwords, payment details or confidential customer information. You can ask us to correct or delete your enquiry by emailing support@waslioconnect.com.

Your rights

Merchants and their customers may request access, correction or deletion of personal data by emailing the address below. If you are a store's customer, we may direct your request to the store (the data controller) as required.

Contact

Data controller for the app and the website: Waslio.
Privacy contact: support@waslioconnect.com

We will update this page when our practices change; material changes are noted in the changelog.