Privacy Policy

Last updated: February 2026

ShipLab ("we", "our", "us") is a Shopify application provided by Extmag. This Privacy Policy explains what data we collect, how we use it, and your rights regarding that data.

1. Data We Collect

When you install and use ShipLab, we access the following data from your Shopify store:

• Store information — store name, domain, and Shopify plan
• Order data — order details, shipping addresses, line items, and fulfillment status
• Product data — product titles, weights, dimensions, and attributes
• Location data — warehouse addresses configured in your Shopify admin
• Customer segments and metafield definitions — for price rule conditions (we do not access individual customer personal data)

2. How We Use Your Data

We use the collected data exclusively to provide ShipLab's shipping functionality:

• Shipping label creation — order and address data is sent to carriers to generate shipping labels
• Rate calculation — product weight, dimensions, and destination addresses are used to calculate real-time shipping rates at checkout
• Price rules — product attributes, customer segments, and order data are used to apply your configured pricing rules
• Shipment tracking — tracking numbers are synced back to your Shopify orders

3. Third-Party Data Sharing

We share data with the following categories of third-party service providers ("data processors") solely for the purpose of delivering ShipLab's shipping functionality:

3.1 Shipping Carriers

When you create shipping labels or request rates, order and address data is transmitted to the carrier APIs you have configured (e.g., UPS, DHL Express). The data shared includes:

• Sender and recipient names, addresses, phone numbers, and email addresses
• Package dimensions, weight, and declared value
• Customs and invoice information for international shipments
• Product descriptions and quantities

Each carrier processes this data under their own privacy policies and data processing terms. You can review their policies at:

• UPS Privacy Notice
• DHL Privacy Notice

3.2 Infrastructure Providers

Your data is stored on servers hosted by Hetzner Online GmbH (Germany/EU). All data is processed within the European Union.

3.3 Customer Support

Our support team may access your store data (orders, addresses, shipping configurations) solely to resolve technical issues you report. All support personnel are bound by Non-Disclosure Agreements (NDA) and Data Processing Agreements (DPA) that require them to:

• Access data only when necessary to resolve a specific support request
• Never copy, export, or store customer data on personal devices
• Delete any temporarily accessed data after the support case is resolved

We do not sell, rent, or share your data with any other third parties for marketing or advertising purposes.

4. Data Storage and Security

• All data is stored on secure servers with encrypted connections (TLS/SSL)
• Access tokens are encrypted at rest
• All API communication uses HTTPS
• Data is isolated per store — no store can access another store's data

5. Data Retention

We retain your data for as long as the app is installed on your store. When you uninstall ShipLab, we process any pending billing charges and then your data is scheduled for permanent deletion within 48 hours, in accordance with Shopify's data protection requirements.

6. Your Rights

You have the right to:

• Access — request a copy of the data we store about your store
• Correction — request correction of inaccurate data
• Deletion — request deletion of your data at any time
• Portability — request your data in a machine-readable format

These rights are available under GDPR (EU), CCPA (California), and other applicable data protection laws.

7. GDPR Compliance

ShipLab fully supports Shopify's mandatory privacy webhooks:

• Customer data request — we respond with any customer data we hold
• Customer data deletion — we delete or anonymize customer data upon request
• Shop data deletion — we permanently delete all shop data within 48 hours of receiving the request

8. Cookies

ShipLab runs as an embedded Shopify application and does not set any cookies in your customers' browsers. Session management is handled entirely through Shopify's App Bridge session tokens.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated revision date. Continued use of ShipLab after changes constitutes acceptance of the updated policy.

10. Contact

If you have questions about this Privacy Policy or wish to exercise your data rights, contact us at:

Email: support@extmag.com
Website: https://extmag.com