Privacy policy

Last updated: October 13, 2026

1. Who we are

Shipkin is an app for Shopify stores that creates shipments and labels with the store's own contracts with its carriers (Correos, the Spanish postal service, MRW and Correos Express), marks orders as fulfilled with their tracking number and keeps their delivery status up to date.

Owner: Alejandro Gomariz Núñez. Contact: alexgproyects@gmail.com.

2. Our role

• For the data of the store's customers (buyers), Shipkin is a data processor: it processes that data only on the store's behalf and to prepare its shipments. The store is the data controller. What Shipkin may do with that data is set out in the data processing agreement (in Spanish), which the store accepts inside the app.
• For the store's own data (its account, its carrier contracts and its sender address), Shipkin is the data controller.

3. What data we process and why

Buyer data. When the store creates a shipment or a return, Shipkin reads the recipient's name, company, address, phone number and email from the Shopify order and sends them to the carrier chosen for that shipment (Correos, MRW or Correos Express) to register it and generate the label. We do not store them. For each order we only keep its number, the carrier, the shipment status in the carrier's own words, the tracking codes and, if the carrier rejects the shipment, its error message, which may quote the rejected value (for example, the postal code). Also the destination zone (same province, mainland, Balearic Islands…) and the shipping amounts (what it cost with the store's rates and what the buyer paid), excluding VAT. Before creating the label, Shipkin checks the address (that the postal code matches the province and that it has a number and a phone) without storing it. If the shipment crosses customs (between mainland Spain or the Balearic Islands and the Canary Islands, Ceuta or Melilla), Shipkin also reads the items in the order (description, quantity, weight and value) and sends them to Correos for the customs declaration (CN23), again without storing them. If the store ships the order cash on delivery, Shipkin reads the amount still owed, passes it to the carrier so it is collected on delivery, and keeps that amount with the shipment. And if the store turns on MRW's notices, MRW uses the recipient's email to send them the tracking and the delivery notice.

Buyer notices. If the store turns it on in Settings and the shipment was created with customer notifications, when the carrier cannot deliver the parcel or leaves it at a pickup office, Shipkin emails the buyer on the store's behalf so they can collect it or arrange another delivery. To do so it reads the buyer's email and name from the Shopify order at that moment, without storing them. If the carrier says the buyer was absent, the email asks them whether they were at home; if they answer, Shipkin stores only that answer (yes or no) with the shipment, so the store can raise it with the carrier.

Store data. The store domain and the access Shopify grants to the app, the details of its carrier contracts and its access credentials (for Correos ID, MRW and Correos Express), stored encrypted, the sender address, its contract rates, the subscribed plan and the number of labels created each month. Also the email address we use to alert the store if a carrier rejects its credentials, stops responding or has stalled shipments: the one it enters in Settings or, if it enters none, the store's email in Shopify. These alerts can be turned off in Settings. If the store turns it on, each shipment has a public tracking page, at an address that is hard to guess, showing the store name and email, the order number, the status, what the carrier says and the tracking code, without any buyer data. And the messages the store sends us from the app's help page, together with the latest logged failures of its carriers. And the record that it accepted the data processing agreement: which version and on what date.

Technical log. Every call to the carriers (operation, order number or tracking code, result and duration), without buyer contact data, to support the store and monitor the reliability of the service.

Website survey. If you answer the survey on our website (in Spanish), we keep your answers (where your store runs, which carriers you ship with, whether you have your own contract, how many shipments you make, whatever you write to us and, if you came through one of our links, which one) to decide what to build, and we add them to everyone else's to say on the website how many answers we have. We do not ask for the store name. If you leave your email, we use it only to tell you that Shipkin can be installed and, if you are one of the first 50 Shopify stores to answer (founding stores), to offer you their terms. To slow down automated answers we count how many arrive from the same connection during one hour, without storing its address. Shipkin is the controller of this data.

We do not use the data for advertising, we do not build profiles and we do not sell it.

4. Legal basis

• Buyer data: the store's instructions (Article 28 GDPR); the store processes it to perform the purchase contract.
• Store data: performance of the contract to use the app (Article 6(1)(b)) and our legitimate interest in the security and reliability of the service (Article 6(1)(f)).
• Website survey: your consent (Article 6(1)(a)), which you can withdraw at any time by writing to us.

5. Who we share it with

The carriers the store chooses. The store has its own contract with them and decides which one each shipment goes with; Shipkin sends them the data on its instructions.

• Correos (Sociedad Estatal Correos y Telégrafos, S.A., S.M.E.), if the store has a contract with Correos, to carry out the shipment. Correos processes the data under its own privacy policy.
• MRW, if the store has a contract with MRW, to carry out the shipment: the MRW franchise the store has its contract with and, where applicable, the MRW network (FITMAN, S.L., the brand's franchisor). They process the data under their own privacy policy.
• Correos Express (Correos Express Paquetería Urgente, S.A., S.M.E.), if the store has a contract with Correos Express, to carry out the shipment. It processes the data under its own privacy policy.

Shopify, the platform the store and the app run on: Shipkin marks the order as fulfilled there, with its tracking.

The providers Shipkin hires to operate: Google Cloud, which hosts the app on servers in Madrid, and, once email alerts are active, an email provider. The current list, with what each one receives, is at Quién más toca los datos (in Spanish).

We do not share the data with anyone else unless required by law.

6. How long we keep it

• Shipments, while the app is installed. When the store uninstalls it, Shopify asks us to delete its data 48 hours later and we delete it from the database. We only keep the record that it accepted the data processing agreement (its domain, the version and the date).
• The log of calls to the carriers, 90 days.
• The email you leave in the website survey, 12 months at most. The answers, without the email, for as long as they help us decide what to build.
• Backups, which are encrypted: 14 days on the server and 30 off it. Deleted data stays in those backups until they expire. Our hosting provider may take up to 180 days to remove from its systems what we delete.
• If a buyer asks the store to erase their data, Shopify notifies us and we delete the shipments of their orders.
• If a buyer asks the store for their data, Shopify notifies us and we give the store, on the app's help page, what we hold about their orders.

7. Security

All connections are encrypted (HTTPS). Carrier credentials and the access Shopify gives us to each store are stored encrypted, backups too, and access to the data is limited to what is needed to provide the service.

8. Your rights

If you bought from a store that uses Shipkin, contact that store to exercise your rights: it is the controller of your data and we will help it respond. If you are a store, or you answered the survey on our website, you can ask us for access, rectification, erasure, restriction or portability of your data, or object to its processing, by writing to alexgproyects@gmail.com. You can also lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

9. Cookies

The app runs inside the Shopify admin and does not set analytics or advertising cookies.

10. Changes

If we change this policy, we will publish the new version here with its update date.