Privacy Policy

1. Who we are and our role

ECOM HUSTLER PROJECT LLC ("FLUXO", "we") provides the FLUXO software. Contact for anything related to privacy and data protection: ecomhustlerprojectllc@gmail.com.

For the data of a store's customers (orders, names, addresses, phone numbers), the store (the merchant) is the data controller and FLUXO acts as a data processor on the merchant's behalf and on its instructions, which include the logistics provider the merchant has chosen to ship its orders. Our obligations as a processor are set out in the Data Processing Agreement (/dpa).

For the account data of the people who use FLUXO (logistics staff and store users), FLUXO is the data controller.

2. Data we process

• Order data received from the merchant's Shopify store through the FLUXO app: order number, products and quantities, totals, currency, payment method (including cash on delivery), order notes and tags.
• Customer data contained in those orders, needed to deliver them: name, shipping address, phone number and email address.
• Shipping data created in FLUXO: carrier, tracking number, shipping label, delivery status, cash-on-delivery amount and reconciliation, delivery attempts and incidents.
• Product and inventory data of the store: product names, variants, SKUs, stock levels and cost prices.
• Account data of FLUXO users: name, email address, role, login and activity records.
• Marketing consent: whether a customer has agreed to receive the merchant's offers on WhatsApp, when and how, and any later opt-out.
• Technical data: IP address, browser and device information, and anonymous usage statistics of the FLUXO interface.

3. Why we process it

• Importing the merchant's orders into the portal of its logistics provider.
• Checking that shipping addresses exist, so parcels are not returned.
• Creating shipping labels with the carrier and following the parcel until delivery.
• Writing fulfillment and tracking information back to the merchant's Shopify store.
• Contacting the customer about the delivery when the merchant enables it (order confirmation calls, WhatsApp messages about delivery, failed delivery or parcels held at the depot).
• Reconciling cash-on-delivery payments and preparing invoices between the logistics provider and the merchant.
• Sending the merchant's marketing messages on WhatsApp (offers, new products), in the customer's language, when the merchant enables it and only to customers who have given their consent.
• Providing, securing and improving the FLUXO service, and handling support requests.

We do not sell personal data and we do not share it with advertisers. Marketing messages are sent only on the merchant's behalf, only to customers who have agreed to receive them, and every message lets the customer stop them with one tap (opt-out button) or by replying STOP; the choice is applied immediately and permanently. Service messages about an order (confirmation, delivery, parcels held at the depot) are not marketing.

4. Shopify permissions requested by the app

The FLUXO app asks Shopify only for the access it uses:

• read_orders, write_orders
• read_fulfillments, write_fulfillments
• read_merchant_managed_fulfillment_orders, write_merchant_managed_fulfillment_orders
• read_products, read_inventory, write_inventory, read_locations
• read_returns, write_returns
• read_customers, write_customers

5. Who receives the data

We share data only with the service providers below, and only the data each one needs:

6. Where data is stored and which law applies

FLUXO is used by logistics providers and stores in many countries. We apply the standard of the EU General Data Protection Regulation (GDPR) to every merchant and every customer, wherever they are. Where the law of the merchant's or the customer's country gives more rights or requires additional steps, we apply that law as well.

FLUXO data is stored in the European Union. When a provider listed above processes data outside the EU, the transfer relies on the European Commission's Standard Contractual Clauses or on an adequacy decision (such as the EU-US Data Privacy Framework). Data sent to FLUXO from outside the EU is protected to the same standard.

7. How long we keep it

• For orders received through the FLUXO Shopify app, the customer's personal data is removed automatically 6 years after the order is closed (delivered, returned, cancelled or rejected): name, phone, email, street address, coordinates, the original Shopify order payload, notes, call transcripts and message texts. Order numbers, products, amounts, tracking numbers and dates are kept for accounting.
• For the same orders, shipping labels are deleted 30 days after delivery, return or cancellation, and raw carrier responses after 90 days.
• When a merchant uninstalls the app, Shopify sends us a shop/redact request and we delete the store's access token and the personal data of all its orders. Requests to delete a single customer (customers/redact) are carried out on the orders indicated.
• Marketing contacts (phone number, name, country, language and consent) are kept while the consent is valid. When the customer opts out (button, STOP or in Shopify) the name is deleted at once; only the phone number with the dates of consent and opt-out is kept, as proof and so that we never write to them again. Shopify deletion requests (customers/redact) also delete the marketing contact.
• Account data of FLUXO users is kept while the account is active and deleted on request when the account is closed.
• Backups are kept for a short rolling period by our database provider and then overwritten.

8. How we protect it

• All connections use HTTPS (TLS). Data is encrypted at rest (AES-256) by our database provider, including daily backups.
• Shopify access tokens and carrier credentials are additionally encrypted by FLUXO (AES-256-GCM) with a key kept outside the database.
• Each logistics provider and each store sees only its own data: the separation is enforced in the database (row-level security) and in every server action.
• Staff access to customer data is limited to the people who need it for the service, with individual accounts, strong passwords and access logs.
• Every request from Shopify (installation, webhooks) is verified with Shopify's HMAC signature; tests are carried out on test stores with test data, never on real customer data.
• We have a written data-loss prevention and security incident response procedure. If a breach affects personal data, we inform the affected merchants and Shopify without undue delay, and in any case within 72 hours.

9. Rights of customers and users

Customers can stop marketing messages at any time with the opt-out button in the message or by replying STOP on WhatsApp. They can also exercise their rights of access, rectification, erasure, restriction, portability and objection by contacting the store they bought from; the store is the controller and we help it respond. Requests sent by Shopify on behalf of a customer (customers/data_request, customers/redact) are handled automatically.

FLUXO users can exercise the same rights by writing to ecomhustlerprojectllc@gmail.com. Everyone has the right to lodge a complaint with the data protection authority of the country where they live or work (for example the AEPD in Spain, the Garante in Italy, the CNPD in Portugal).

10. Changes

If this policy changes, we update this page and the date at the top. Significant changes are notified to merchants in advance.