Privacy policy
This policy explains what Shopify Amazon Fulfillment processes when you visit this website, connect a store, or use the app to coordinate Amazon Multi-Channel Fulfillment. It describes the information involved, why it is used, and how to ask for access or deletion.
1. Scope and responsibilities
This policy covers the app, its supporting services, this marketing website, and product-support correspondence. In this policy, we and us mean the team providing Shopify Amazon Fulfillment. Our contact address is contact@ixlu.com.
For customer order information, the merchant generally determines why the information is collected and which fulfillment services to use. The app processes that information to carry out the merchant’s configured workflow. We also handle limited information for our own website delivery, account security, and support. If you bought something from a connected store, that merchant remains your first contact for the purchase and its privacy notice also applies.
2. Information the service processes
Information comes from your authorized Shopify store, your connected Amazon seller account, settings and actions entered by store staff, and messages you choose to send us. The fields available depend on the permissions granted and the workflow enabled.
- Store and connection information: shop domain, installation and authorization status, Shopify access credentials, Amazon seller and region identifiers, and the credentials needed to maintain an authorized connection.
- Product and inventory information: product and variant identifiers, seller SKUs, mappings, fulfillment locations, source countries, inventory snapshots, reservations, buffers, and allocation settings.
- Order and recipient information: order and customer references, items and quantities, payment status, tags and relevant risk indicators, recipient name, delivery address, and email or telephone details where provided for fulfillment.
- Fulfillment and operational records: Amazon order references, service selections, shipment and package quantities, tracking numbers, status changes, exception reasons, action history, and reconciliation records.
- Website and support information: technical requests received by the hosting service, and the name, email address, store URL, message, or attachments you choose to send in a support inquiry.
3. How information is used
We use information to provide and maintain the connected services, follow the merchant’s instructions, resolve operational problems, protect authorized access, and respond to privacy or support requests. Fulfillment information is not used for advertising or unrelated customer profiling.
Order checks can automatically evaluate payment status, stock, destination, tags, and configured rules to determine whether an order should proceed, wait, or be reviewed. These are operational checks within the merchant’s workflow; the app also provides manual release and exception review controls.
- Connect accounts, verify capabilities, and associate the right Shopify variants with Amazon seller SKUs.
- Calculate inventory publication budgets, obtain fulfillment previews, and configure eligible checkout delivery options.
- Submit eligible fulfillment requests, check uncertain results, request cancellations, and return shipment quantities and tracking to Shopify.
- Investigate failures, reconcile in-flight orders, maintain action records, and handle verified information requests.
4. Shopify and Amazon authorization
The Shopify permissions requested by the app support reading orders, products, inventory, locations, and assigned fulfillment work; updating inventory and fulfillment; and managing the dedicated locations or carrier-rate connection you configure. Payment status is read to evaluate orders. The app does not request full payment-card numbers or card security codes for fulfillment.
Amazon authorization allows the service to access the seller account and perform the permitted inventory and MCF operations. Authorization credentials are exchanged and kept on the server; you should not paste refresh tokens, account passwords, or developer secrets into website forms or support messages. Permissions may be limited or revoked through the relevant platform, which can stop synchronization and fulfillment updates.
6. Website visits, cookies, and contact forms
The marketing website does not include advertising pixels, analytics scripts, or tracking cookies. Its product examples use sample data and do not access a visitor’s Shopify store or Amazon account. The hosting provider may process IP addresses, browser details, requested URLs, and similar technical information to deliver and protect the site.
The contact form validates your entries and prepares a draft in your own email application. It does not submit entries to a website server or save them in browser storage. We receive the message only if you choose to send it. Your email provider handles that message under its own policies.
These website practices are separate from the authentication needed inside the installed app. Shopify sessions and the short-lived browser state used during Amazon authorization help confirm the authorized store and prevent unauthorized account connections.
7. Security and access controls
The app uses server-side credential handling, encrypted storage for Amazon credentials and sensitive address or fulfillment payloads, authenticated store access, and checks that keep operations within the relevant store. Customer matching can use a keyed identity hash instead of retaining a plain-text email in an order index. These measures reduce exposure but do not make every operational record anonymous.
Access credentials and sensitive payloads are kept out of ordinary merchant-facing responses. Operational records use references and redacted details where possible. No storage or transmission method is completely secure. Please protect staff access to your Shopify and Amazon accounts and contact us promptly if you suspect unauthorized use.
8. Data retention
Retention varies with the information involved, the configured service, active fulfillment responsibilities, and applicable legal or provider requirements. Sensitive delivery and execution payloads are subject to configured expiry and cleanup rather than being intended for indefinite use. Expiry of a payload is different from deletion of every related order reference.
Inventory, mapping, reconciliation, and action records may remain available to explain previous operations, investigate errors, and avoid duplicate fulfillment. Connection credentials follow their authorization and removal lifecycle. Support correspondence is handled for the inquiry and related support needs. Contact us for the retention or deletion arrangements that apply to your store.
9. Uninstallation and deletion
Uninstalling removes the installation’s access through Shopify and stops work that depends on that authorization. It does not automatically cancel Amazon requests already accepted, erase the merchant’s Shopify or Amazon records, or mean that all locally stored business records are immediately deleted.
The service receives Shopify privacy notifications and has customer-data redaction handling. Access requests that need review or an export should also be directed to contact@ixlu.com. For a store-wide deletion request, contact us so the records involved and any remaining fulfillment obligations can be checked. Do not rely on uninstallation alone as confirmation that all business data has been removed.
Deletion or redaction can remove sensitive payloads and customer fields while leaving limited order references, action records, or markers that prevent deleted information from being retrieved again. Information already held by Shopify, Amazon, or another provider is subject to that provider’s own retention and request process.
10. Your privacy requests
Depending on the law that applies to you, you may be able to request access to, correction of, or deletion of personal information; restrict or object to certain processing; request a portable copy; or withdraw consent where processing relies on consent. Applicable rights, exceptions, and response periods depend on the circumstances. Nothing in this policy limits rights that the law gives you.
Send requests to contact@ixlu.com. We may need information sufficient to verify your identity or authority and identify the records, but we will not ask you to send account passwords or access tokens. Store customers should normally start with the merchant, because the merchant can identify the order and make the relevant request through Shopify. You may also contact an applicable data-protection authority where you have that right.
- Identify whether you are a store owner, authorized staff member, or store customer.
- Include the relevant store domain and a limited order or account reference where needed; avoid sending unnecessary customer information.
- Explain the information or action requested so we can determine the appropriate scope and response.
11. International processing
Connected services and infrastructure can operate in countries other than the merchant’s or recipient’s country. Choosing an Amazon fulfillment source is an operational setting and does not, by itself, establish where every copy of service data is stored or processed.
Where cross-border processing is subject to legal requirements, the relevant obligations and safeguards depend on the parties and services involved. Contact us if you need details about a particular processing arrangement before connecting your store. This policy does not promise a specific hosting country or data-residency option.
12. Updates and contact
We may update this policy when the product, information practices, or applicable requirements change. The date at the top identifies the current version. Where additional notice or consent is required, that requirement continues to apply; merely visiting this page does not replace it.
For privacy questions, security concerns, or information requests, email contact@ixlu.com. The Terms of Service explain the operational responsibilities that accompany use of the app.