Privacy Policy
Last updated 31.08.2026
Droply is a fulfilment service for merchants who sell online. This policy explains exactly what our Shopify app reads from a connected store, what we keep, and for how long.
Who we are
Droply ("we").
Unit 903D, 9/F., Cameron Commercial Centre, 458-468 Hennessy Road, Causeway Bay, Hong Kong
Contact: teamdroply@gmail.com
What the app accesses, and why
When a merchant connects their store, the app requests these permissions and no others:
| Permission | Why we need it |
|---|---|
| read_products | To list the products the merchant sells, so we can price them and match them to incoming orders. |
| read_orders | To receive new orders automatically, so the merchant does not have to send them to us manually. |
| read_fulfillments · write_fulfillments | To write the tracking number back to the order once a parcel ships. |
| read/write_merchant_managed_fulfillment_orders | To mark only the lines we actually ship as fulfilled, and leave the rest untouched. |
What we store
- Store details. The store domain, its display name, and the access token issued at install.
- Catalogue. Product titles, images, variant titles, SKUs and weights.
- Orders. Order number, date, status, order total and currency, the items ordered, the delivery method, and the buyer's name and city.
- Shipping. Tracking numbers and carrier names.
- Merchant users. Name, email address, and a hashed password for people who log into our portal.
What we do not collect
We do not request the read_customers permission, and we cannot read it. From the end buyer we store only name and city. That is the minimum needed to route a parcel and to let the merchant recognise the order.
We do not store buyer email addresses, phone numbers, full street addresses, or any payment details. We never see card data.
Who else processes this data
- Railway, for hosting and the database.
- Shopify, the source of the order and catalogue data.
- An exchange-rate provider, to convert currencies. No personal data is sent to it; we request a published rate and nothing else.
We do not sell personal data, and we do not use it for advertising.
How long we keep it
- Personal data is deleted on request, within 30 days.
- Financial records (amounts, dates and order numbers, with no personal details attached) are retained where we are legally required to keep accounting records.
- When a merchant uninstalls the app, we delete the access token and the catalogue, and remove buyer names and cities from stored orders.
Requests to see or delete data
A merchant can raise a request through their Shopify admin, and Shopify forwards it to us automatically. We act on it within 30 days. A buyer should contact the store they bought from; that merchant can then raise the request with us.
You can also write to us directly at teamdroply@gmail.com
Changes
If this policy changes in a way that affects what we collect, we will update the date at the top and notify connected merchants.