ParcelPilot for Aramex NZ/AU ("the app", "we") is operated by ParcelPilot, Dunedin, New Zealand. This policy explains what the app collects from your Shopify store, why, who it is shared with, and how to have it removed. We are based in New Zealand and follow the New Zealand Privacy Act 2020 and, for Australian merchants, the Australian Privacy Principles.
What we collect
From your store: your store address and an access token Shopify gives the app when you install it; your Shopify locations; and, for the orders you choose to ship, the order number, items and weights, and the delivery contact (name, company, address, phone and email).
From you: your AramexConnect client ID and secret (kept encrypted), your branch and parcel preset settings, and any bug report or suggestion you send us.
From Aramex: consignment and label numbers, prices, and tracking status for the parcels you book.
We do not collect payment card details, and we do not sell personal information or use it for advertising.
How we use it
To get prices, create shipments, print labels, and track deliveries with Aramex on your behalf.
To update the order in Shopify (fulfilment and delivery progress) and, if you switch it on, to show live shipping rates at checkout.
If you switch it on, to copy each new order's delivery contact into your own AramexConnect address book. This is off by default.
To give support, fix bugs and keep the service secure.
Who it is shared with
Aramex (AramexConnect): the delivery contact and parcel details needed to quote and book a shipment, sent using the credentials you provide. Aramex handles that data under its own terms and privacy policy. A contact copied into your address book stays in your Aramex account; we cannot delete it from there, but you can.
Shopify: the app reads and writes order and fulfilment data in your store through Shopify's APIs.
Hosting: the app runs on Fly.io in Sydney, Australia. Data is encrypted in transit, and the database volume is encrypted at rest.
We share nothing else with third parties, except where the law requires it.
Rural postcode list
To tell whether an address attracts Aramex's rural surcharge, the app records, from the price results it receives, only a country, a postcode and a yes/no. This list is pooled across all stores to make the app more accurate. It contains no store, customer or address information.
Website help assistant
If you use the question box on our public website, what you type is sent to Anthropic (the maker of the Claude AI model) to write an answer. We do not store your questions or the answers, and the assistant cannot see any store or account data. It records only how many questions were asked, to apply usage limits, and your IP address is held in memory for a few minutes for the same purpose. Please do not enter personal or payment details. Anthropic handles that text under its own terms and privacy policy.
What we keep, and for how long
We store the order number, Aramex consignment/label/tracking numbers, price and status for each booking. We do not keep customer names, phone numbers, emails or addresses in our own database; they are read from Shopify when needed. Short error messages from Aramex may quote an address, and are removed when a customer redaction request arrives.
Your Aramex credentials are encrypted with AES-256-GCM and are never shown again after you save them.
When you uninstall the app we revoke its access straight away. Shopify then sends us a redaction request, after which all data for your store (bookings, branches and credentials, settings, and reports) is deleted. We act on customer redaction and data requests from Shopify as they arrive.
Your rights
You and your customers can ask us what we hold, and ask for it to be corrected or deleted. Customers should contact the store they ordered from; the store can pass the request to us through Shopify, or you can email us. We will respond within 30 days.
Security
Access is limited to your store through Shopify's authentication. Connections use HTTPS. Credentials are encrypted. No system is perfectly secure, and if we learn of a breach affecting you we will tell you promptly.