Privacy Policy

Introduction

TouchDrop ("we", "us", or "our") operates the TouchDrop platform, a direct-mail marketing automation service for Shopify merchants. This Privacy Policy explains how we collect, use, store, and protect your information when you use our platform, website, and Shopify application. By using TouchDrop, you agree to the practices described in this policy.

What Data We Collect

We collect the following categories of information:

Merchant Account Information

• Business name, email address, and contact details provided during registration
• Shopify store URL and OAuth access tokens for store integration
• Billing details for postage payments (Stripe); plan subscriptions are billed via Stripe or, for Shopify App Store installs, Shopify Managed Pricing

Customer Data (from Your Shopify Store)

• Customer names and mailing addresses used for direct-mail campaigns
• Order history and purchase data used for audience targeting (e.g., retention, winback, acquisition segments)
• Email addresses used for suppression and deduplication purposes only

Campaign & Usage Data

• Campaign configurations, artwork uploads, and template selections
• Print job statuses, delivery tracking, and QR code scan data
• Attribution and conversion metrics linked to campaigns

How We Use Your Data

For each purpose below, we state the legal basis we rely on under Article 6(1) of the GDPR (and equivalent provisions of the UK GDPR and Australian Privacy Act where they apply):

• To create, send, and track direct-mail postcard campaigns on your behalf — legal basis: performance of a contract (Art. 6(1)(b))
• To build and filter audience segments based on your Shopify customer and order data — legal basis: performance of a contract (Art. 6(1)(b))
• To process payments and manage your postage balance — legal basis: performance of a contract (Art. 6(1)(b))
• To apply suppression rules, validate addresses, and remove duplicate recipients — legal basis: performance of a contract (Art. 6(1)(b))
• To generate campaign reports, attribution analytics, and performance insights — legal basis: legitimate interests (Art. 6(1)(f)) in measuring and demonstrating campaign effectiveness
• To communicate with you about your account, campaigns, and platform updates — legal basis: performance of a contract (Art. 6(1)(b)) for account and service communications; consent (Art. 6(1)(a)) for optional marketing communications
• To improve our platform, troubleshoot issues, and provide customer support — legal basis: legitimate interests (Art. 6(1)(f)) in operating, securing, and improving the service

Where we rely on consent, you may withdraw it at any time (see Your Rights). Where we rely on legitimate interests, we balance those interests against your rights and you may object to the processing.

Data Storage & Security

We take the security of your data seriously and implement industry-standard measures to protect it:

• Sensitive data fields are encrypted at rest using industry-standard encryption
• All data in transit is protected using secure HTTPS connections
• Shopify OAuth tokens and API credentials are stored in encrypted form and never exposed to the frontend
• Our infrastructure is hosted on secure, managed cloud platforms with regular security updates
• Access to production systems is restricted and monitored

Third-Party Services

We share data with the following third-party service providers, strictly as needed to operate the platform:

Shopify

We connect to your Shopify store via OAuth to read customer, order, and product data required to build campaign audiences and track conversions. We only request the permissions necessary for our service.

Stripe

We use Stripe to process postage payments and, for direct signups, plan subscriptions. Merchants who install via the Shopify App Store are billed for their plan subscription through Shopify Managed Pricing. Your payment card details are handled entirely by Stripe (or Shopify) and are never stored on our servers. See Stripe's Privacy Policy.

SmartComm (Print Partner)

We share recipient names, mailing addresses, and postcard artwork with our Australian print partner, SmartComm, solely for the purpose of printing and posting your direct-mail campaigns. SmartComm does not use this data for any other purpose.

Intercom (In-App Support & Messaging)

We use Intercom to power the in-app help widget and respond to merchant support requests. When you are signed in, we share a limited, allow-listed set of account attributes with Intercom — your email, name, brand name, plan, integration connection status, postage balance, and aggregate campaign counts — so our team can help you faster. We never share your end customers' personal data (names, addresses, or recipient lists) with Intercom. The widget is suppressed entirely on internal admin pages. See Intercom's Privacy Policy. You may request deletion of your Intercom contact record at any time by contacting support@touchdrop.com.au; closing your TouchDrop account also removes your Intercom contact automatically.

Data Retention & Deletion

• Campaign data and analytics are retained for the duration of your active account to enable reporting and historical insights
• Customer data synced from your Shopify store is refreshed periodically and updated to reflect changes in your store
• If you uninstall the TouchDrop app or close your account, we will delete your stored data within 30 days of your request
• You may request deletion of specific data at any time by contacting us at support@touchdrop.com.au

Your Rights

As a merchant using TouchDrop, you have the right to:

• Access the personal and business data we hold about you
• Request correction of inaccurate information
• Request deletion of your data, subject to any legal obligations we may have to retain certain records
• Withdraw consent for data processing at any time by uninstalling the app or contacting us
• Export your campaign data and reports

To exercise any of these rights, please contact us at support@touchdrop.com.au.

California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) gives you the following rights:

• Right to know and access: request the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of third parties we disclose it to
• Right to delete: request deletion of personal information we have collected from you, subject to legal exceptions
• Right to correct: request correction of inaccurate personal information
• Right to opt out of sale or sharing: we do not sell personal information, and we do not share it for cross-context behavioural advertising as those terms are defined by the CCPA/CPRA
• Right to limit use of sensitive personal information: we do not collect sensitive personal information as defined by the CPRA
• Right to non-discrimination: we will not discriminate against you for exercising any of these rights

Categories of personal information we collect

In the last 12 months we have collected the following categories, as described in What Data We Collect above:

• Identifiers: merchant name, business name, email address, Shopify store URL; recipient names and mailing addresses from your store
• Commercial information: order history, purchase data, plan and billing records, postage transactions
• Internet or network activity: platform usage, campaign configurations, QR code scan and attribution events

We disclose these categories only to the service providers listed in Third-Party Services, for the business purposes described there. We do not sell or share any category of personal information.

How to make a request

Email support@touchdrop.com.au with "Privacy request" in the subject line. We will verify your identity using the email address associated with your account and respond within the timeframe the CCPA/CPRA requires. You may use an authorised agent to submit a request on your behalf.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we make material changes, we will notify you via email or through a notice on our platform. We encourage you to review this page periodically.

Contact Us

If you have questions about this Privacy Policy or how we handle your data, please reach out:

• Email: support@touchdrop.com.au