VertexFlow← Back to Dropship Pulse

Privacy Policy

Last updated: May 3, 2026

Introduction

VertexFlow Oü (“we”, “our”, or “us”) operates the Dropship Pulse Shopify application (“App”). This Privacy Policy explains how we collect, use, and protect your information when you use our App. We comply with the General Data Protection Regulation (GDPR) and applicable data protection laws.

Data Controller: VertexFlow Oü, Estonia, European Union.

Contact: privacy@vertexflow.co

What Data We Collect

The App connects to your Shopify store via the Shopify Admin API with read-only access. We collect the following categories of data:

  • Merchant Information: Shop domain, shop creation date, plan type, owner email, currency, and installed-at timestamp.
  • Order Metadata: Order IDs, creation dates, total prices (in minor units), refund amounts, financial status, and payment gateway names. We do not collect customer personal data (names, addresses, phone numbers).
  • Fulfillment Metadata: Fulfillment IDs, status, creation and delivery timestamps, carrier names, and tracking numbers. Origin country and city when available.
  • Product Information: Product IDs and basic catalog data for identification purposes only.

All data access is read-only. We never modify your Shopify store data.

How We Use Your Data

  • Carrier Identification: We parse tracking number prefixes to identify carriers (e.g., YunExpress, 4PX, Cainiao, ePacket, DHL eCommerce) and fallback to the carrier name provided by Shopify.
  • Dropship Score Calculation: We calculate a performance grade (A/B/C/F) based on fulfillment speed, refund rate, and carrier performance relative to benchmarks.
  • Carrier Benchmarks: We aggregate anonymized fulfillment data across merchants to compute carrier route benchmarks (average delivery days, on-time rates). Your individual data is never exposed to other merchants.
  • Shipment Tracking Verification: We use tracking numbers to query delivery status from third-party tracking services for accuracy.

Third-Party Processors

  • Cloudflare Workers & D1: Application hosting and database storage. Data is processed within the European Union. Cloudflare Privacy Policy
  • Shopify: OAuth authentication, API data source, and webhook delivery. Shopify Privacy Policy
  • 17TRACK: Shipment tracking verification for carrier benchmark seed data. Only tracking numbers and carrier slugs are shared. 17TRACK Privacy Policy

Data Retention & Deletion

We retain your data only while the App is installed and for a short period after removal:

  • App Uninstallation: When you uninstall the App, Shopify triggers a GDPR webhook. Within 48 hours, we delete your merchant profile and all associated order and fulfillment metadata from our database.
  • Self-Service Erase: You can request immediate data deletion from the App's Settings page at any time without uninstalling.
  • Aggregated Benchmarks: Anonymized, aggregated carrier benchmarks (average delivery times, on-time rates) are retained indefinitely as they cannot be traced back to individual merchants.

Shopify API Scopes

The App requests the following Shopify API access scopes:

  • read_orders: Access order data for fulfillment speed and refund analysis.
  • read_all_orders: Access full order history (beyond 60 days) for accurate long-term scoring.
  • read_fulfillments: Access fulfillment data for carrier identification and delivery tracking.
  • read_third_party_fulfillment_orders: Access fulfillments created by third-party dropshipping services (e.g., 4PX, YunExpress).
  • read_products: Access product data for catalog identification.

All scopes are read-only. The App never writes to your Shopify store.

Webhook Data Handling

The App receives real-time data from Shopify via webhooks. All webhook payloads are verified using HMAC signature validation to ensure authenticity. Webhook data is processed immediately and stored in our database as described above.

Webhooks we subscribe to:

  • orders/create — New order ingestion
  • orders/updated — Refund tracking
  • fulfillments/create — Tracking capture and carrier identification
  • fulfillments/update — Delivery status updates
  • products/create, products/update — Product catalog sync
  • app/uninstalled — Session cleanup and data scheduling for deletion
  • GDPR webhooks — shop/redact, customers/redact, customers/data_request

Your Rights (GDPR)

Under the GDPR, you have the following rights:

  • Access: Request a copy of your personal data.
  • Rectification: Request correction of inaccurate data.
  • Erasure: Request deletion of your personal data.
  • Restriction: Request restriction of processing.
  • Portability: Receive your data in a structured, machine-readable format.
  • Object: Object to processing based on legitimate interest.
  • Withdraw Consent: Withdraw consent at any time.

To exercise these rights, contact us at privacy@vertexflow.co. We will respond within 30 days.

Data Transfers

VertexFlow Oü is based in Estonia, European Union. Data is processed within the EU via Cloudflare's European infrastructure. Where data is transferred outside the EEA, appropriate safeguards (including standard contractual clauses) are in place to ensure GDPR-compliant processing.

Security

We implement appropriate technical and organizational measures to protect your data, including HMAC-verified webhook authentication, encrypted data transmission (TLS), and access controls. No method of transmission is 100% secure, but we follow industry best practices to protect your information.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the “Last updated” date. Your continued use of the App after changes constitutes acceptance of the updated policy.

Contact Us

For questions about this Privacy Policy or our data practices: