Privacy Policy

1. Information we collect

When you install Koombiyo Delivery through the Shopify App Store, we collect:

From your Shopify store

• Store domain and shop name
• OAuth access token, used to call the Shopify Admin API on your behalf
• Order data needed to create a shipment: order number, customer name, delivery address, phone number, and order total

Information you provide directly

• Your Koombiyo API key and password, entered on the API Settings page (stored encrypted, never sent to your browser after saving)
• Pickup address, phone, and GPS coordinates entered when scheduling a pickup

Automatically collected

• Shipment waybill numbers and delivery status returned by Koombiyo's API

2. How we use your information

We use collected information solely to provide the Koombiyo Delivery service:

• Creating and managing shipments through Koombiyo's delivery network
• Syncing fulfillment status between Koombiyo and your Shopify store
• Scheduling pickup requests and tracking their status
• Generating Proof of Delivery documents
• Displaying your delivery dashboard

We do not use your data for advertising, marketing profiling, or any purpose unrelated to operating this app.

3. Data sharing & disclosure

Koombiyo Delivery (koombiyodelivery.lk)

Order details (customer name, address, phone, COD amount, description) are sent to Koombiyo's API to create shipments and pickup requests — this is the core function of the app. Koombiyo's own privacy practices govern their handling of this data.

We do not share your data with

• Advertising or analytics networks
• Data brokers or resellers
• Any third party other than Koombiyo, as described above

4. Data retention

We keep data only for as long as it's needed to operate the app:

• Session and access tokens are deleted immediately when you uninstall the app
• Your Koombiyo API credentials are stored encrypted for as long as the app is installed and connected
• The most recent dispatch record (used for support/troubleshooting) is overwritten each time you ship a new order — we do not keep a historical archive of past shipments

When you uninstall the app, we receive a Shopify app/uninstalled webhook and delete your session immediately.

5. GDPR & merchant rights

We respond to Shopify's mandatory compliance webhooks:

• customers/data_request — we can provide any customer data we hold on request
• customers/redact — we remove the identified customer's name, address, and phone number from our records
• shop/redact — we clear all retained shipment data for your store

Your rights as a merchant

You may request access to, correction of, or deletion of any data we hold about your store at any time by contacting SALES@KOOMBIYODELIVERY.COM. We will respond within 30 days.

6. Security

• All data is transmitted over HTTPS/TLS
• Your Koombiyo API credentials are encrypted at rest (AES-256-GCM) and never sent to your browser
• Shopify webhook payloads are verified using HMAC signatures before processing

No method of electronic storage is 100% secure, but we follow industry-standard practices to protect your data.

7. Children's privacy

This app is a business-to-business service for Shopify merchants. It is not directed at, and does not knowingly collect data from, individuals under 18.

8. Changes to this policy

We may update this policy from time to time. We will update the "Last updated" date above when we do, and notify merchants of material changes via the Shopify admin or email where required by law.

9. Contact us