Privacy Policy

Expedly - Facturare & AWB · Last updated: August 21, 2026

Expedly - Facturare & AWB ("Expedly", "the App", "we") is a Shopify application operated by SC COVERED SRL, Str. Principala nr. 98, Strei, Hunedoara, Romania ("we", "us"). The App helps Shopify merchants generate courier shipping labels (AWB) with Sameday, FAN Courier and Cargus, offer parcel-locker delivery (easybox, FANbox, Ship & Go), synchronize delivery statuses back into Shopify, issue invoices through the merchant's invoicing provider and reconcile cash-on-delivery payments.

1. Information we collect

When a merchant installs the App, we access and process through the Shopify API:

Store information — store name, domain, contact email, currency, plan type.
Order information — order number, totals, payment method, shipping method, order attributes (including the parcel locker chosen by the customer), fulfillment status.
Customer delivery information — recipient name, phone number, shipping address and email address. These fields are required by Romanian couriers to create a shipping label (AWB) and to send delivery notifications, and are processed strictly for that purpose.
Product information — titles, quantities and weights, used to prefill parcel weight and invoice lines.

We do not collect payment card data, passwords or any data unrelated to shipping and invoicing. Customer personal data is used exclusively to create shipping labels, delivery notifications and invoices requested by the merchant — never for advertising, profiling or resale.

2. How we use the information

Creating AWBs with the couriers the merchant connected (Sameday, FAN Courier, Cargus) — recipient name, phone, address and locker are transmitted to the selected courier, acting as an independent controller.
Issuing invoices through the merchant's invoicing provider (SmartBill, Oblio or FGO), when enabled.
Sending transactional delivery emails ("your parcel is waiting in the locker", locker selection reminders) through our email provider (Resend), only when the merchant enables these features.
Showing delivery statuses, attention queues and reports inside the merchant's Shopify admin.
COD reconciliation — matching courier settlement reports with orders.

3. Legal basis

We process data as a processor on behalf of the merchant (the controller) under Art. 6(1)(b) GDPR — processing necessary for the performance of the delivery contract with the customer — and the merchant's instructions given by configuring the App.

4. Data sharing

Couriers — Sameday, FAN Courier, Cargus (Romania): recipient details needed on the shipping label.
Invoicing providers — SmartBill, Oblio, FGO (Romania): billing details on the invoice, when enabled.
Infrastructure — Railway (hosting, EU-West region, Netherlands), PostgreSQL database; Resend (email).

We never sell or rent personal data. We do not use it for advertising.

5. Data retention & deletion

Shipping and invoice records are kept while the App is installed, so the merchant has a working history.
When the App is uninstalled, all shop data — including cached orders, customer details and courier credentials — is deleted automatically.
We honor Shopify's GDPR webhooks: customers/redact (customer data deleted/anonymized), shop/redact (full shop wipe) and customers/data_request.

6. Security

All traffic is encrypted in transit (TLS 1.2+).
Courier and invoicing credentials are encrypted at rest with AES-256-GCM.
Customer email addresses stored for delivery notifications are encrypted at rest.
Access tokens are short-lived (Shopify expiring offline tokens) and stored encrypted in our database.
Data is hosted in the European Union (Railway EU-West, Netherlands).

7. Your rights

Customers can exercise GDPR rights (access, rectification, erasure, restriction, portability, objection) through the merchant they bought from; we support the merchant in fulfilling them. Merchants can contact us directly for any privacy request.

8. Contact

SC COVERED SRL · Str. Principala nr. 98, Strei, Hunedoara, Romania
Email: support@trackwise.studio