Privacy policy

Effective 1 July 2026 · applies to trackchat.in, app.trackchat.in and the TrackChat Shopify app

In short: TrackChat processes your store's order and customer data only to run the features you switch on — shipping, WhatsApp and email messaging, cart recovery and support tickets. Personal fields are automatically purged after 90 days, everything is erased when you uninstall, and we never sell data.

1. Who we are

TrackChat is an independent product operated by zsellr (OPC) Private Limited (GSTIN 06XXXXXXXXXXXXX), Sector 15 Part 2, Gurgaon, Haryana 122001, India — the "data fiduciary" under India's Digital Personal Data Protection Act, 2023, and a "data processor" for your customers' personal data, which you (the merchant) control.

2. What we collect

Merchant account details (your name, email, and — for the web dashboard — a salted password hash or Google sign-in identifier); Shopify store and session tokens; order, product and fulfilment data read from your store; the customer name, shipping address, phone number and email needed to create a shipment and send order updates; WhatsApp and email message content with delivery states (only if you use the Inbox); abandoned-checkout details used for recovery reminders; support-ticket content including customer-submitted photos/videos; courier tracking events; and payment-status metadata from Razorpay payment links (never card numbers). Your courier, WhatsApp, Razorpay and Zoho API credentials are stored encrypted with AES-256-GCM.

3. How we use it

Strictly to run the features you enable: generating AWBs and shipping labels on your own Delhivery / Blue Dart accounts, sending the WhatsApp (Meta Cloud API) and Zoho email messages you configure, recovering abandoned carts, running support tickets (including AI-generated chat summaries shown only to you), syncing conversions to Google Ads if connected, and showing you analytics. No advertising, profiling, cross-store analysis or sale of personal data — ever. TrackChat makes no automated decisions with legal or similarly significant effects.

4. WhatsApp messaging & consent

Transactional updates (order confirmed, shipped, out for delivery, delivered) are sent to the customer who placed the order. Marketing messages — such as cart-recovery reminders — are only sent when the customer's Shopify SMS marketing consent is SUBSCRIBED; TrackChat blocks marketing templates without that opt-in and records the consent basis on every single send. Messages respect Meta's 24-hour customer-service window, and customers can opt out at any time (e.g. by replying STOP), which we honour automatically.

5. Retention & deletion

Personal fields are purged on a rolling 90-day schedule: recipient phone numbers in the notification log, raw courier payloads containing addresses, and idle WhatsApp conversations are automatically erased by a daily retention job. When a customer redaction request arrives (Shopify's customers/redact webhook) we erase that customer's phone, chat and shipment payload data; when you uninstall, Shopify's shop/redact webhook (sent ~48 hours later) triggers erasure of your store's data set. Export anything you need before uninstalling. Every redaction and data request is recorded in a compliance audit log.

6. Security

All traffic runs over HTTPS/TLS — between your browser, Shopify, our servers, and every courier/messaging API. API credentials are encrypted at the application layer with AES-256-GCM before touching the database; the managed PostgreSQL database and its backups are encrypted at rest. Access is limited to the app's own service credentials, and access to personal data is logged.

7. Your rights

Access, correction, portability and erasure requests: info@trackchat.in. Grievance officer (India, DPDP Act 2023): Grievance Officer, zsellr (OPC) Private Limited, Gurgaon, Haryana, India — info@trackchat.in. We acknowledge within 72 hours and resolve within 30 days.