Privacy Policy
Who we are
KiteLane makes Kite Pickup Delivery Date, a Shopify app that lets shoppers pick a date and time slot for delivery or pickup. This policy is operated by Sidharth Sharma, sole proprietor, trading as KiteLane, at Hyderabad, Telangana, India. Email support@kitelane.com.
It covers merchants who install the app, shoppers buying from a store that uses it, and visitors to kitelane.com. It does not cover what a merchant does with their own customers' data.
What we access
When you install the app on your Shopify store, Shopify authorises us to read:
- Your store details, products and collections
- Your orders, including order history for the last 60 days, and shipping information
- Your locations, locales, and checkout and account configuration
- Your theme, and cart and checkout validations. The app is a theme app block and does not edit your theme files
- Your own details as store owner, and shopper name, email, phone, address and device data
We do not access payment details or passwords. Shopify never gives an app those.
What we actually keep
Authorisation is not use. Per order we store the order ID, line items, delivery date, delivery time, delivery method and order creation date, plus your app settings. We do not store shoppers' names, email addresses, phone numbers or postal addresses. Where you have switched on the Google Calendar integration the shopper's name passes through us into the event on your own calendar, described below, and is not retained here.
A shopper types a postal code into the widget so the app can tell them whether you deliver. Where you switch on zip code or checkout validation, the app reads the delivery address on the order to check it against the rules you set. Neither is kept after the check.
Google Calendar
Connecting a Google account is optional and stays off until you turn it on. You grant four scopes and nothing wider: openid and email, to show you which account is connected; calendar.calendarlist.readonly, so you can pick one of your existing calendars; and calendar.events, so we can add to it. We never read the events already in your calendars, and we cannot delete a calendar.
When a shopper schedules an order we add one event to the calendar you chose, carrying the order number, delivery method, customer name, delivery date and time, totals and line items. We store your Google account email, the calendar you picked, and the OAuth tokens, encrypted. Disconnect in the app's settings, or at myaccount.google.com/permissions, and we revoke the grant with Google and erase the tokens.
KiteLane's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell it, use it for advertising, or use it to develop or train artificial intelligence or machine learning models.
How we protect it
Security procedures are in place to protect the confidentiality of your data. We use encryption in transit, meaning HTTPS on every connection to the app, to this site and to the Shopify and Google APIs, and encryption at rest for the database behind it. Google access and refresh tokens get a layer of their own: AES-256-GCM encryption before they are written to the database, with the key held outside it, so the database never holds a usable token. Access to production is restricted to the proprietor and protected by two-factor authentication. If a breach ever affects your data we will tell you without undue delay.
How we use it
To run the app, bill you, support you and keep the service secure. For our own analytics we use aggregate order counts per store only, never the order records. We do not sell your data and do not market to your shoppers.
Our role. For shopper data the merchant is the controller and we are the processor, so a shopper wanting their data should ask the store they bought from. For merchant data we are the controller. Our Data Processing Agreement applies automatically on install; ask us for a copy.
Who we share with
We do not sell your data. We share it only with the providers that run the service: Shopify, cloud hosting, our support desk, transactional email, error monitoring, and Google Analytics for this website. Where you have connected Google Calendar, the scheduling details described above also go to Google, at your instruction. Ask and we will name the current ones. We give 30 days notice before adding or replacing one.
How long we keep it
We keep your order records and settings for as long as your store has the app installed. Uninstalling revokes any Google connection straight away. Shopify then sends a deletion request 48 hours later and we delete your store's data from our database. The only copy that outlives that is in our routine backups, deleted on a rolling 30 day cycle.
Deleting your data
Shopify requires three requests of every app and all three are implemented. customers/data_request and customers/redact return nothing, because we hold no shopper personal data. shop/redact, sent 48 hours after you uninstall, deletes your store's data from our database. Shopify's window is 30 days and that is the window we work to.
Google Calendar has its own switch. Disconnect it in the app's settings and we revoke the grant with Google and erase the stored tokens immediately. You can also revoke it yourself at myaccount.google.com/permissions. Events already written to your calendar belong to you, so delete them in Google Calendar if you want them gone.
Your rights
Ask us to access, correct, erase, restrict or port your data, to object to processing, or to withdraw consent. We honour these for everyone, wherever you live. Email support@kitelane.com and we respond within 30 days. In the UK or EU you may also complain to your supervisory authority. Our Grievance Officer for India is Sidharth Sharma, reachable at support@kitelane.com.
We have not sold or shared personal information in the preceding twelve months.
Cookies
kitelane.com runs Google Analytics 4 on every page, which sets cookies and collects your IP address, location, device and pages viewed. There is no consent banner, and analytics loads before you make any choice. You can opt out with Google's browser add-on. No ad pixels, no session recording, no heatmaps.
Children
The app is a business tool for Shopify merchants. It is not for anyone under 18, and we do not knowingly process a child's data.
Changes
We update the date above and give merchants 30 days notice before a material change takes effect.
Contact
Sidharth Sharma, sole proprietor, trading as KiteLane, at Hyderabad, Telangana, India. Email support@kitelane.com. Our listing is at apps.shopify.com/kite-pickup-delivery-date.