Last updated: 12 October 2026
TrackChat is a Shopify application that helps merchants create courier shipments, print shipping labels, and communicate with their customers over WhatsApp and email. This policy explains what personal data the app handles, why and on what legal basis, who it is shared with, and how it is deleted. It covers the TrackChat Shopify app. The trackchat.in website has its own privacy policy at trackchat.in/legal/privacy.
TrackChat is a product of the zSellr group, which is two companies:zSellr (OPC) Private Limited and zSellr Enterprises LLP. The TrackChat Shopify app is published on the Shopify App Store and operated by zSellr Enterprises LLP (“zSellr”, “we”, “us”), which is responsible for the app data described in this policy. zSellr (OPC) Private Limited operates the trackchat.in website. Group office: 1572, 3rd Floor, Sector 15 Part 2, Gurugram, Haryana 122001, India.
For personal data belonging to a merchant’s shoppers, the merchant (the Shopify store that installs TrackChat) is the data controller — the “data fiduciary” under India’s Digital Personal Data Protection Act, 2023 — and we act as their data processor: we process that data only to provide the app’s features to that merchant, on the merchant’s instructions. For data about the merchant’s own account and use of the app, we act as controller and data fiduciary.
Contact for any privacy question or request: info@trackchat.in. Our Grievance Officer is reached at the same address (see section 10).
We do not buy data, and shoppers do not sign up with us. Personal data reaches TrackChat in three ways:
| Data | Purpose |
|---|---|
| Order references and shipment records (order number, line items, waybill/AWB number, courier, status, COD amount, freight cost, and the raw courier response, which can contain the shopper’s name, phone and delivery address) | Creating shipments, printing labels, tracking, and pushing tracking back to Shopify |
| WhatsApp conversations and messages: the phone number, name and message text of each person the merchant chats with through TrackChat (customers, and anyone else the merchant messages, such as a supplier), and Meta media IDs for the photos, videos, voice notes and documents they send | The merchant’s WhatsApp inbox, order notifications, the return/replacement assistant, packing-list sharing, and chat history |
| After-delivery feedback (only when the merchant turns it on): the order, the customer’s name and phone, their one-tap answer, anything they write back, Meta media IDs and fingerprints (SHA-256) of the photos they send, the result of the photo check, and any thank-you discount code issued | Asking how a delivered order was, opening a ticket for an unhappy customer, and sending a one-time discount code to a customer who shares a photo of their product. The fingerprint only detects the same photo being reused for another order. Personal details are removed after the standard retention period below |
| Delay updates (only when the merchant turns it on): the pending order, the customer’s name, phone and email, how many updates were sent and when, and whether each channel delivered | Telling a customer on WhatsApp and by email that their order is delayed, on the schedule the merchant sets, and stopping once it ships. Personal details are removed after the standard retention period below |
| Notification log: recipient phone, template used, delivery status, and the consent basis of each WhatsApp order message and cart-recovery reminder | Proving what was sent, troubleshooting failures, and message-consent accountability |
| Cash-on-delivery confirmation reminders: the order and the WhatsApp number its confirmation request was sent to | Sending up to three reminders within 24 hours while a COD order is neither confirmed nor cancelled |
| Support tickets: shopper name, phone, email, the issue description and chat transcript, an AI-generated summary, references to the media they sent, and the refund amount | Handling returns, replacements and refunds |
| Email conversations: shopper email address, name, subject, message bodies and attachment metadata | The merchant’s email support inbox and ticketing |
| Abandoned-checkout records: shopper name, phone, email, cart contents and value, recovery link, and the customer’s Shopify SMS and email marketing-consent status | Sending the merchant’s abandoned-cart recovery reminders on WhatsApp and, if a mailbox is connected, by email — only where there is a marketing basis (section 4) |
| Payment state read back from Shopify: whether an order is paid or still owing, and whether it is cash on delivery | Showing the merchant which orders are unpaid; when the merchant asks, having Shopify email the customer Shopify’s own invoice for the balance; and confirming on WhatsApp once Shopify reports the payment. TrackChat is not a payment service: it never takes, holds or moves money. Customers pay in the merchant’s own Shopify checkout, and refunds the merchant issues from a ticket are created in Shopify, to the original payment method. |
| A return-to-origin (RTO) risk estimate for each unpaid or cash-on-delivery order, worked out from that order alone each time the order list is shown: order value, whether the delivery address, PIN code and phone number look complete and valid, and the basket size. The estimate is not stored, and no profile of the shopper is built or kept. | Shown to the merchant beside the order to help them decide whether to confirm a cash-on-delivery order before shipping. TrackChat never cancels, holds or changes an order on the basis of this estimate — the merchant decides. Where Delhivery’s RTO predictor is enabled for the service and the merchant has connected a Delhivery account, the order’s phone number, PIN code, value and item titles are sent to Delhivery, under the merchant’s account, to obtain its score. |
| Ad-audience files, generated only when the merchant asks for one: the name, email, phone and PIN code of the store’s own customers, grouped by delivery outcome over a period the merchant chooses (180 days by default) — for example “never took delivery” or “repeat buyer” | Letting the merchant upload their own customer list to Google Ads Customer Match or Meta Custom Audiences. TrackChat does not upload these files anywhere itself, and every export is recorded in the store’s data-access log. |
| Merchant data: Shopify store domain and name, the app’s Shopify access token, and the Shopify staff user ID of the person using the app; warehouse contact details; app settings; and, for the web dashboard, the login name, email, a salted password hash or Google sign-in ID, and profile-photo link | Authenticating the app and the dashboard, per-store configuration, and label return addresses |
| Data-access log: which staff member (Shopify user ID, or email where Shopify provides one) viewed, printed, exported or messaged which kinds of customer field — field names only, never the values | Security and accountability for access to customer data; the merchant can review it in Settings |
| Product catalogue index (titles, handles, images, prices, variants) | Answering catalogue questions in WhatsApp without querying Shopify on every message |
| Merchant-supplied third-party credentials (courier API keys, WhatsApp access token and app secret, Zoho Mail OAuth tokens, Google Ads OAuth tokens) | Connecting to the services the merchant has chosen to use |
| Compliance audit log: event type, the Shopify customer and order IDs named in a privacy request, counts of records affected, and the outcome | Recording every deletion, data-access request and purge we perform |
We do not use shopper data for our own advertising or marketing, we do not sell personal data, and we do not share one merchant’s data with another merchant. Every record is scoped to the store it belongs to. TrackChat does not record visitors’ IP addresses in its database; our hosting and content-delivery providers keep standard request logs (IP address, time, requested address) for security and troubleshooting.
Messages are sent from the merchant’s own WhatsApp Business number and, for email, from the merchant’s own connected mailbox.
Order and shipping updates are transactional (utility) messages sent to the customer who placed the order. The merchant is responsible for obtaining their customers’ consent before sending them marketing messages. For order messages and cart-recovery reminders, TrackChat sends a marketing message only when the customer’s Shopify marketing consent for that channel is “subscribed” or, for cart-recovery reminders, when the merchant has chosen to switch on a setting that treats the contact details entered at the store’s checkout as their basis — in which case the merchant is responsible for that basis meeting applicable law and WhatsApp’s policies. An unsubscribe recorded in Shopify always blocks these messages, consent is checked before every send, and for WhatsApp the basis used is recorded in the notification log. Templates a merchant sends from the inbox, or that a button automation sends, are the merchant’s responsibility to send only where they have the customer’s consent. Customers can withdraw marketing consent through the store, and can block or report the sending number in WhatsApp at any time.
TrackChat passes data to the services below. Which ones receive data depends on what the merchant has connected — for example, nothing is sent to Blue Dart unless the merchant connects a Blue Dart account. Each of these providers processes the data under its own privacy terms.
| Provider | What it receives |
|---|---|
| Shopify | The source of order, customer and product data, and the platform the app runs inside. Data is also written back (fulfillments and tracking, order tags, cancellations, returns, draft orders, order edits, refunds and invoices). |
| Meta — WhatsApp Business Cloud API | Phone number and message content, including media, for every WhatsApp message sent or received; inbound media is fetched from Meta by media ID when it is viewed. |
| Delhivery | Consignee name, phone, full address, pincode, item description and COD amount when a shipment or return pickup is created; pickup/warehouse details; and, where its RTO predictor is enabled, the order’s phone number, PIN code, value and item titles. |
| Blue Dart | The same consignee details (name, address, pincode, mobile) when a merchant uses Blue Dart to generate a waybill. |
| Google — Gemini API | Shopper message text, support-email sender names, subjects and bodies, chat transcripts, product names and supplier replies, used to write the WhatsApp assistant’s answers to general questions, classify support email, summarise tickets, match catalogue searches and read replies to shared packing lists; and, where a merchant turns on after-delivery feedback with a thank-you code, the photos a customer sends back, with the store’s own product image, to check the photo shows the product ordered. TrackChat uses a paid (billing-enabled) Gemini API key; under Google’s terms for paid services, this content is not used to improve Google’s products. Without a key the app falls back to non-AI handling. |
| Zoho Mail | The merchant’s connected support mailbox — inbound and outbound support email, including shopper email addresses and message bodies. Only when the merchant connects a mailbox. |
| Google Ads API | Used only to read the merchant’s own ad spend into the dashboard. No shopper personal data is sent. Only when the merchant connects an ads account. |
| Google — Fonts and Sign-In | The app and website load typefaces from Google Fonts, which receives the viewer’s IP address. Merchants who sign in to the web dashboard with Google share their name, email and profile photo with us through Google. |
| Railway | Application hosting and the PostgreSQL database in which the above records are stored. |
| Cloudflare | Delivers the trackchat.in website and web dashboard: it receives visitors’ IP addresses, and the dashboard’s traffic — including customer data shown to the merchant — passes through it. |
| Postal PIN-code lookup (api.postalpincode.in, a public directory built on India Post data) | Only the six-digit PIN code typed into a warehouse address, to fill in its city and state. No personal data. |
If a merchant sets up a “Call a webhook” button automation, the order number, customer name and phone number are sent to the web address the merchant chooses; that destination is the merchant’s responsibility. TrackChat shares data with no payment provider. We will update this list, and notify merchants, at least 30 days before a new sub-processor handles shoppers’ personal data.
A purge runs automatically every day and removes shopper personal data older than the retention window, which is currently 90 days. It:
Some records are kept for as long as the app is installed, because the merchant needs them as business records: shipment metadata (order number, waybill, courier, status, cost, product title); support tickets, so return and refund history stays complete; and abandoned-checkout records, so recovery results stay accurate. A customer redaction request removes the customer’s details from tickets and abandoned-checkout records sooner (section 7), and all of them are deleted after uninstall. The data-access log is kept for 365 days and holds field names, never customer data values. The compliance audit log is kept as evidence of each deletion and holds counts and Shopify IDs, not contact details or message content. Media that shoppers send on WhatsApp is stored by Meta, not by TrackChat — we keep only the media ID — and is subject to Meta’s own retention.
Before maintenance or a data fix we take a backup copy of the database. Backups are stored encrypted with access restricted to our operator and are deleted after 30 days, so data erased under section 7 is also gone from backups within 30 days.
TrackChat implements Shopify’s uninstall webhook and its mandatory privacy webhooks:
Every redaction, access request and purge is written to an internal compliance audit log so deletions are accountable. Shoppers should direct requests to the merchant they bought from, since the merchant is the controller; merchants can contact us at info@trackchat.in and we will assist.
All third-party credentials that a merchant stores in the app — courier API keys, the WhatsApp access token and app secret, Zoho Mail OAuth tokens and Google Ads OAuth tokens — are encrypted at rest with AES-256-GCM and are never written to the database in plaintext. Traffic to Shopify and to every provider listed above is over HTTPS. Incoming webhooks are verified — Shopify webhooks by HMAC and WhatsApp webhooks by Meta’s request signature, with unverified payloads ignored — and links to WhatsApp media are signed and expire within a day, so they cannot be used as an open proxy to a store’s files. Staff views, prints and exports of customer details are logged (field names only). Production data is accessed by a single operator and kept separate from development data.
If we become aware of a personal-data breach affecting a store’s data, we notify Shopify within 24 hours and the affected merchants within 72 hours of confirming it.
No system is perfectly secure. We do not hold any security certification, and we make no certification claim.
The app is hosted on cloud infrastructure and uses providers that operate globally, so personal data may be processed outside the country where the shopper or merchant is located — for example by Meta, Google, Cloudflare and Zoho. Where such transfers occur, we rely on the transfer terms offered by those providers.
Depending on where they live, shoppers may have the right to access, correct, delete, or restrict the processing of their personal data, to object to it, and to withdraw consent; under India’s DPDP Act they may also have their grievances redressed and nominate someone to exercise their rights. Because the merchant is the controller of that data, shoppers should make those requests to the merchant’s store; the merchant can fulfil them through Shopify, which relays them to us through the privacy webhooks described in section 7, or by contacting us.
Merchants may at any time request a copy, correction or deletion of the data we hold for their store, or simply uninstall the app, which triggers deletion as described above.
Grievance Officer (India, DPDP Act 2023): Grievance Officer, zSellr Enterprises LLP (zSellr group), 1572, 3rd Floor, Sector 15 Part 2, Gurugram, Haryana 122001, India — info@trackchat.in. We acknowledge every request or complaint within 72 hours and resolve it within 30 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India or, outside India, to your local data-protection authority.
TrackChat is a business tool for merchants and is not directed at children. We do not knowingly collect data from children.
We may update this policy as the app changes. The “Last updated” date above always reflects the current version. Material changes will be communicated to merchants.
zSellr Enterprises LLP, a zSellr group company with zSellr (OPC) Private Limited — 1572, 3rd Floor, Sector 15 Part 2, Gurugram, Haryana 122001, India —info@trackchat.in (privacy requests and the Grievance Officer)