iShip for Shopify: privacy policy
Last updated 27 October 2026
The iShip app for Shopify (“the app”) is operated by ISHIP SERVICE CO., LTD. (“iShip”, “we”). It creates shipments with iShip for a Shopify store’s orders, fulfils those orders with the tracking number, and keeps the delivery status up to date. This policy explains what the app collects, why, who receives it, and how long it is kept. It is written to meet Thailand’s Personal Data Protection Act B.E. 2562 (PDPA) and Shopify’s requirements.
1. Our role
For the store’s customers, the merchant who installs the app is the data controller and iShip processes their data on the merchant’s instructions, only to deliver their orders. For the merchant’s own details, iShip is the data controller.
2. What the app collects
About the store
- The store’s myshopify domain and the access token Shopify issues when the app is installed.
- The settings the merchant enters: their iShip API token (stored encrypted), the sender name, phone and address printed on labels, parcel defaults, and automation choices.
About orders and their customers
- When an order is shipped, the app reads from Shopify the order number, items, weights, amounts, payment method and the recipient’s name, phone number and shipping address.
- The app does not read customers’ email addresses, payment card details, or any customer who is not the recipient of an order.
What the app keeps
- Per order: the Shopify order ID and number, its shipping state, the iShip tracking number, courier and delivery status.
- Recipient details are read from Shopify each time they are needed and are not copied into the app’s database, with two exceptions: address corrections the merchant types for an order, and the last error message returned by iShip, which can include the recipient’s name.
3. Why we use it
Only to provide the app: creating the parcel and its shipping label, fulfilling the Shopify order, notifying the customer through Shopify if the merchant has chosen to, and updating the delivery status. The legal basis is the performance of the contract between the merchant and their customer, and between the merchant and iShip. We do not use this data for advertising, profiling or analytics, and we do not sell it.
4. Who receives it
- iShip, where the parcel is created in the merchant’s iShip account under the iShip terms of service.
- The courier chosen for the parcel, which receives the recipient’s name, phone and address to deliver it.
- Our hosting provider, which runs the server the app is on and has no access to its contents beyond operating it.
We disclose data to authorities only when Thai law requires it.
5. How long it is kept
- Order records are kept while the app is installed, so the merchant can reprint labels and track parcels.
- When the app is uninstalled, the store’s access token is deleted at once.
- 48 hours after uninstalling, Shopify asks the app to erase the store; the app then deletes the store’s settings, iShip token and all order records.
- When a customer asks the merchant to erase their data, Shopify tells the app which orders are affected, and the app deletes the stored corrections and error messages for those orders.
- Parcels created in iShip are kept by iShip as shipping and accounting records, as required by law and the iShip terms of service.
6. How it is protected
- All traffic to and from the app uses HTTPS.
- Each store’s iShip API token is encrypted with AES-256-GCM before it is stored.
- The app asks Shopify only for the access it needs: reading orders and fulfilling them.
- Access to the server and its backups is limited to the iShip staff who operate the app.
7. Your rights
Under the PDPA you may ask to access, correct, delete or receive a copy of your personal data, object to or restrict its use, and withdraw consent where consent is the basis. Customers of a store should first contact the merchant they bought from; the merchant can act through Shopify, which passes the request to the app. You may also contact us directly, and we answer within 30 days. You have the right to complain to Thailand’s Personal Data Protection Committee.
8. Changes
We will update this page if the app starts handling data differently, and change the date at the top.
9. Contact
ISHIP SERVICE CO., LTD. (บริษัท ไอชิพ เซอร์วิส จำกัด)44/247 Soi Chaloem Phra Kiat Rama 9 Soi 87, Prawet, Bangkok 10250, Thailand
44/247 ซอยเฉลิมพระเกียรติ ร.9 ซ.87 แขวงประเวศ เขตประเวศ กรุงเทพฯ 10250
Phone / โทร: 094-413-4565
LINE: @iShip