Privacy Policy

This Privacy Policy explains how the R+L Carriers Shipping app for Shopify ("the App") processes information when providing freight rate quoting services for Shopify merchants.

The App is intended for use by Shopify merchants. It is not intended for, or directed to, consumers or the merchants’ customers or end users. By installing, accessing or using the App merchants acknowledge and agree to any terms and conditions governing the use of the App including the R+L Carriers Application Terms and Shopify Terms of Service.

Information We Process

• Shopify order identifiers and shipping context required to associate rate quotes with orders.
• Shipment attributes such as destination city, state/province, postal code, country, freight class, pallet counts, weights, service codes, and accessorial selections.
• Merchant configuration data, including carrier credentials and shipping preferences.
• The App does not store customer names, street addresses, phone numbers, email addresses, or payment information.

Precise geolocation data (latitude/longitude), when used, is processed transiently in memory only for distance-based routing or pickup eligibility and is not persisted.

How We Use Information

• Generate freight rate quotes during checkout or draft order workflows.
• Apply merchant-configured shipping rules and accessorial logic.
• Maintain limited operational logs for troubleshooting and reliability.

The App does not use data for marketing, profiling, analytics unrelated to shipping, or resale.

Data Minimization

The App follows strict data-minimization principles aligned with Shopify App Store requirements and GDPR. Address data is normalized to non-identifying location fields (city/state/postal/country only where operationally required). No customer contact information is stored. Derived routing outcomes are retained instead of raw address or geolocation data.

Retention

Operational logs related to rate quoting and webhook processing are retained for up to 30 days and are then automatically deleted. Uninstalling the App triggers deletion of all shop-specific configuration and operational logs.

GDPR Requests

The App processes Shopify-mandated GDPR webhooks, including SHOP_REDACT, CUSTOMERS_DATA_REQUEST, and CUSTOMERS_REDACT.

Because the App does not retain customer-identifiable personal data, customer data and redaction requests are acknowledged in accordance with Shopify requirements without disclosure or retention of personal information.

Security

The App uses Shopify-scoped API tokens stored securely. Data is protected using industry-standard controls including encryption in transit (TLS), role-based access with least privilege, and environment-specific safeguards. Webhooks are verified using HMAC signatures to prevent tampering, and operational access is audited.

Legal Basis

• Performance of contract: providing freight rate quotes and shipping options for the merchant’s Shopify orders.
• Legitimate interests: maintaining reliability and troubleshooting via limited operational logs.
• Legal obligations: fulfilling Shopify-mandated GDPR webhooks and privacy requirements.

Data Subject Rights

European/UK/Switzerland Privacy Rights. Individuals in the European Economic Area (EEA), Switzerland, and the United Kingdom, are entitled to the following privacy rights:

• Right to Know. You may have the right to know the personal information we collect and processes about you.
• Access Rights. You may have the right to ask us whether we process any of your personal information and, if so, to receive access to such personal information.
• Rectification. You may have the right to have your personal information corrected/rectified in case of inaccuracy or incompleteness.
• Erasure. You may have the right to have your personal information erased, which means the deletion of your personal information by us.
• Restriction of Processing. You may have the right to obtain the restriction of the processing of your personal information, which means that we suspend the processing of your personal information for a certain period of time.
• Data Portability. You may have the right to request we provide you with your personal information in a structured, commonly used and machine-readable format and to have such data transmitted directly to another controller, where technically feasible.
• Right to Object. You may have the right to object to the processing of your personal information, which means you may request we no longer process your personal information. This only applies in case the “legitimate interests” ground.
• Automated Decision Making. You may have the right to object to having us use your personal information to conduct automated decision making. However, we do not engage in such activity.
• Withdrawing Consent. You may also withdraw your consent at any time if we are solely relying on your consent for the processing of your personal information. However, this will not impact our legal basis to process such personal information prior to the withdrawal of your consent.

You may have the right to submit a complaint to a data protection authority responsible for overseeing our compliance with data protection law in your jurisdiction. Please see a list of potentially applicable regulatory authorities: For data protection authorities in the EU, please see here. For the data protection authority in Switzerland, please contact the Federal Data Protection and Information Commissioner here. For the data protection authority in the UK, please contact the Information Commissioner’s Office here.

California Privacy Rights. Under the California Consumer Privacy Act of 2018 and the California Privacy Rights Act of 2020 (“CCPA”), California residents are entitled to certain data privacy rights:

• Right to Know (Specific Pieces of Personal Information). You have the right to know the specific pieces of your personal information that we have collected about you.
• Right to Know (Categories of Personal Information). You have the right to know (i) the categories of personal information we have collected from you; (ii) the categories of sources from which the personal information is collected; (iii) the categories of your personal information we have sold or disclosed for a business purpose; (iv) the categories of third parties to whom your personal information was sold or disclosed for a business purpose; and (v) the business or commercial purpose for collecting or selling your personal information.
• Right to Delete. You have the right to request that we delete your personal information that we have collected and retain.
• Right to Correct. You have the right to request that we correct inaccurate personal information that we have collected and retain.
• Nondiscrimination. You have the right not to be subject to discrimination for asserting your rights under the CCPA.

Submit a Privacy Request

Merchants can initiate requests through Shopify or by contacting our support; the App acknowledges requests and fulfills applicable actions within required timelines (typically within 30 days).

Recipients & Subprocessors

To deliver the service, the App exchanges shipment context with carriers (e.g., R+L Carriers APIs) and uses infrastructure providers (hosting, database, logging) under appropriate contractual safeguards. Data is shared only for the purposes described in this Policy.

International Transfers

If data is processed outside your jurisdiction (e.g., outside the EEA/UK), appropriate safeguards are applied such as Standard Contractual Clauses or equivalent mechanisms, in accordance with applicable law.

Cookies & Tracking

The App does not use cookies for marketing or behavioral profiling. Any session or functional storage used in the embedded admin is limited to providing the service and is strictly necessary for operation.

Roles

For customer/order data handled through Shopify, the merchant acts as the controller and the App acts as a processor. For App configuration and operational telemetry, the App may act as the controller. Merchants are solely responsible for obtaining all required enduser consents before collecting, using, or disclosing personal information through the App, in compliance with applicable data protection laws.

Uninstall & Redaction Timelines

Uninstalling the App triggers shop-level deletion in line with Shopify’s requirements. Customer data requests and redactions processed via Shopify webhooks are completed within the required window (typically within 30 days).

Contact

For privacy-related questions, contact your Shopify merchant administrator or reach the R+L Carriers support team at pluginsupport@rlcarriers.com.

You may also write to our Privacy Team at 600 Gillam Road, Wilmington, Ohio 45177.