Privacy Policy & Data Handling

1. Data Tada Alerts Stores for Shopify Merchants

We practice strict data minimization. When you install and use Tada Alerts on your Shopify store, we store only the operational metadata required to evaluate alert rules and deliver notifications:

• ✓ Store & Auth Metadata: Your Shopify store domain (*.myshopify.com), granted OAuth scopes, subscription status, and your Shopify Admin API access token (encrypted at rest using AES-256-GCM).
• ✓ Order Risk & Volume Metadata: Order IDs, order names (e.g. #1001), financial status, Shopify fraud risk level/score, and customer IP address (used solely to detect unusual order bursts / bot attacks within a 10-minute window). We do not store customer names, phone numbers, or credit card details.
• ✓ Inventory & Velocity Metadata: Product/variant IDs, product titles, available stock counts, and aggregated daily unit sales counts (no personal data).
• ✓ Shipment Tracking Metadata: Fulfillment tracking numbers, carrier codes, and checkpoint timestamps (processed via our global carrier tracking network to detect stalled shipments).
• ✓ Notification Channel Credentials: Connected Telegram chat IDs, Discord webhook URLs / bot channel IDs, Slack webhook URLs / bot channel IDs, and custom webhook endpoints/secrets (all encrypted at rest using AES-256-GCM).

2. Mandatory Shopify GDPR Webhooks & Data Retention

Tada Alerts verifies every webhook signature via HMAC-SHA256 and implements all mandatory Shopify privacy and lifecycle webhooks:

• • app/uninstalled: Immediately clears your Shopify access token and deletes all encrypted notification channel credentials. Remaining store operational history is automatically purged after our 30-day retention window.
• • customers/data_request: Acknowledges and reports any minimal order ID / IP records associated with the requested order IDs.
• • customers/redact: Immediately anonymizes/removes customer IP metadata associated with the specified orders.
• • shop/redact: Permanently deletes all store records, rules, alerts, deliveries, shipments, and usage counters for the store.

3. Sub-Processors & Third-Party Integrations

Depending on the features and channels you configure, Tada Alerts transmits alert payloads only to the destinations you explicitly connect:

• • Messaging Platforms (Merchant-Configured): Telegram Bot API, Discord API/Webhooks, Slack API/Webhooks, or your Custom Webhook endpoint.
• • Carrier Tracking: our global carrier tracking network API (receives only tracking numbers and carrier codes to check transit stagnation).
• • Billing: All paid plan subscriptions are processed exclusively through the native Shopify Billing API.

4. Contact & Data Requests

For privacy inquiries, GDPR data access/deletion requests, or security questions regarding tadaapp.online or Tada Alerts, please contact our team at [email protected].