Privacy policy

Last updated 22 October 2026.

AK: Royal Mail Click and Drop is a Shopify app that sends a store's orders to the store's own Royal Mail Click & Drop account and writes tracking numbers back to Shopify. I built it and I run it. This page says what it reads, what it keeps, why, where, for how long, and how to have all of it deleted.

What the app reads

From your store: your orders (order number, items, quantities, weights, prices, taxes, shipping charges, tags, notes, payment and fulfilment status), the fulfilment orders that say which location ships what, your products' types, HS codes and countries of origin (and any metafields you choose for customs), and your locations' names. For each order it sends, it also reads the customer's name, delivery address, email and phone, because a parcel can't be addressed without them.

From Click & Drop, with the API key you give it: the state of the orders it sent (printed, despatched) and their tracking numbers; for an Online Business Account, the labels, manifests and return labels you ask it for.

What it does with your customers' details

It passes them to Royal Mail, through your own Click & Drop account, in the same moment it reads them, and that is all. It does not store a customer's name, address, email or phone, it does not write them to its logs, and nothing else ever receives them. In Shopify's phone app, a label, return label or manifest you ask for is held in the app's memory, not on disk, until your phone's browser opens it through a link that works once, for 5 minutes at most. You choose in Settings whether the email and phone go to Royal Mail for its delivery messages. Royal Mail then holds that order under your agreement with Royal Mail, as it does for any order you create in Click & Drop.

What it keeps, and why

• For each order it selects: its Shopify ids and number, its Click & Drop order number, its state and the reason for it, the service, package format and weight it was sent with, and its tracking number. That is the list on the Orders page, and it is how the daily check finds an order that didn't arrive.
• For each order in Click & Drop: three short keyed fingerprints of what was sent (one for the address with the email and phone, one for the items, one for the note). They let the app see that an order changed in Shopify after it was sent, so the change can reach Click & Drop. They are not the details themselves and can't be turned back into them, and they are deleted with the order's row.
• Your settings and shipping rules (and, if you use return labels, your own return address).
• Your Click & Drop API key, encrypted, and its last four characters in the clear so the app can show which key is connected.
• If you use sample mode: the practice orders' numbers, dates and weights, and no names or addresses.
• A record of each notification Shopify sends the app about your store (what kind, when, and the order or part it names, with no customer details), for 30 days: the app finishes from it any notification it could not act on when it arrived.

When it's deleted

When you uninstall the app, its work for your store stops at once. Everything it holds for your store stays for 48 hours and is then deleted, when Shopify tells the app to (and within 7 days if that message never comes). If you reinstall within those hours, nothing is deleted. The app's database is copied every night, encrypted, so it can be recovered after a fault; each copy is deleted after 14 days. A Click & Drop key you disconnect, the orders of a customer Shopify asks the app to forget, and everything erased after an uninstall are also removed from the earlier copies after the next night's copy is made. Shopify's API terms give an app 30 days after an uninstall to delete a store's data.

When Shopify passes on a customer's request to be forgotten, the app deletes what it holds about that customer's orders (the rows above) for the orders Shopify names.

Where it's kept, and who else sees it

On a server I rent from Contabo, in the European Union. No one I choose sees it. I don't sell or share data, and the app uses no advertising or analytics services. The only other companies involved are Shopify, where your store and your plan live, Royal Mail, which receives your orders through your own Click & Drop account, and Contabo, which rents me the server. The server's logs record your store's address, ids, states and counts, and no customer details. These public pages set no cookies and load nothing from other sites.

The app's page on the Shopify App Store uses Google Analytics, through the tracking Shopify offers app developers, to count visits to that page, Install clicks and installs, with the App Store search and position that led to them. For an install, Shopify includes the store's name and myshopify address. Shopify runs that page under its own privacy policy. Nothing from inside the app (your orders, their states or tracking numbers) goes to Google Analytics.

Your requests

To get a copy of what the app holds for your store, or to have it deleted without uninstalling, write to me from the store owner's email address. I carry out the request and confirm when it's done.

If something goes wrong

If your store's data is exposed, I tell Shopify and I tell you directly.

Contact

An independent developer in Pakistan. Write to me at support@aislekit.app.