Privacy Policy / Política de privacidad

MegaShipping — Advanced Shipping Rates (the "App"), operated by ecomm360, calculates shipping rates for Shopify stores from the merchant's own rules: postal code and zone pricing, weight, volumetric weight, pallets, product rules and delivery calendar. This policy explains what data the App accesses, why, and how it is protected. / Esta política explica qué datos usa la App, para qué y cómo se protegen.

1. Data we access / Datos que usamos

To price a shipment correctly, the App accesses, via the Shopify Admin API:

• Products, variants and collections: weight, dimensions (from the App's own metafields), vendor and collection membership. These decide which range and which rules apply.
• Inventory (read-only): only to read the weight recorded on each inventory item.
• Orders: order level only, and only to count how many deliveries are already booked for a given day or time slot, so the App can stop offering a slot that is full. We do not request the optional customer fields (name, email, phone, address) of protected customer data.
• Shipping settings and delivery customizations: to register the rate service and, in lite mode, to hide, rename or reorder the store's own rates.
• Published languages: to show the merchant's texts to each buyer in their language.

2. Data the checkout sends us / Datos que nos manda la pantalla de pago

Every time a buyer reaches the shipping step, Shopify calls the App with the destination (postal code, city, province and country) and the cart lines (quantity, price, weight and dimensions). The App uses them in memory to compute the price and returns the rates. No address, no cart and no buyer identity is written to our database. / Ni la direccion, ni el carrito, ni identidad alguna del comprador se guardan.

The only trace kept is a short quote log the merchant can read in the App, so they can answer the most common support question they get: «a customer says no shipping costs show up». Each entry holds the destination's postal code, province and country, the size of the cart (units, weight, total), the result and why. It holds no name, no email, no street address, no city and no IP, and it is deleted after 7 days or 200 entries per source —checkout, storefront calculator and simulator— whichever comes first. / Un diario corto de cotizaciones, sin nada que identifique a nadie, que se borra solo.

3. Data we store / Datos que almacenamos

• The merchant's configuration: carriers, postal codes, zones, ranges, rules, pallets, time slots, day rules, lite-mode rules and store settings. It contains no personal data.
• Delivery bookings: for each order, its Shopify order id plus the delivery date and time slot chosen. This is the only record linked to a customer order, and it contains no name, email or address. Its only purpose is to enforce the merchant's daily and per-slot capacity.
• A product cache: dimensions and collections per variant, refreshed every few hours, so the rate service answers within Shopify's time budget.
• A quote log: the last quotes served, with the destination's postal code, province and country, the cart size and the outcome. No name, email, street address, city or IP. Deleted after 7 days or 200 entries per source (checkout, storefront calculator and simulator), whichever comes first. Each source has its own allowance so that the calculator, which many more visitors use, cannot push out the checkout ones.
• Access tokens for the store, needed to call the Admin API.

The buyer's delivery choices (date, time slot, notes and any extra checkout field the merchant configures) are written as metafields on the cart and the order, that is, inside the merchant's own Shopify store. The App does not copy them to its database. / Se guardan en el pedido, dentro de Shopify.

4. Retention & deletion / Conservación y borrado

customers/data_request records the delivery bookings held for the orders requested in the App's server log, where support can retrieve them. The merchant does not have to wait for that: the same delivery choice is written on the order itself, inside their own Shopify store, so they can read it there and hand it to the customer;customers/redact deletes the delivery bookings of those orders; shop/redact (which Shopify sends 48 hours after uninstalling) deletes everything belonging to that store, tokens included. Uninstalling also deletes the tokens immediately. / Los tres webhooks de privacidad están implementados con lógica real, no como acuse de recibo.

One exception, in the merchant's favour: Shopify sends that notice even when the store has reinstalled the App in the meantime. In that case the data belongs to an active installation and is kept, so that uninstalling by mistake and reinstalling does not wipe the store's configuration two days later. It is deleted with the notice of the next uninstall. / Si la tienda volvió a instalar la app, no se borra: los datos son de una instalación activa.

5. Sub-processors / Subencargados

• Shopify — store data, checkout, and the metafields where the delivery choices live.
• ecomm360 hosting — application server and configuration database, located in the EU.

The App does not sell data, does not share it with advertisers and does not use it to train models. / No vendemos datos ni los cedemos con fines publicitarios.

6. Security / Seguridad

Every request is authenticated: the Shopify session token in the admin, the signed App Proxy on the storefront, HMAC on webhooks, and a secret token in the URL of the rate service (Shopify does not sign those calls). All data is scoped per store, so one store can never read another's configuration. Logs never contain tokens, and the health endpoint exposes no secrets.

7. Your rights / Tus derechos

Buyers should exercise their rights through the store they bought from: the merchant is the data controller and the App acts as processor on their behalf. Merchants can request access, correction or deletion of anything the App holds about their store by writing to the address below, and get it by uninstalling the App.

8. Contact / Contacto

ecomm360 — sat@ecommsistema.com · www.ecomm360.es

Last updated / Última actualización: 18-09-2026