Privacy Policy

Effective May 16, 2026

This Privacy Policy describes how KAK Sourcing & 3PL Fulfillment ("KAK", "we", "us", "our") collects, uses, and protects information when a Shopify merchant installs the KAK WMS app and when KAK provides fulfillment services on behalf of that merchant.

1. What information we access

When a merchant installs KAK WMS on their Shopify store, the app receives an OAuth access token from Shopify and uses it to access:

Orders: order numbers, line items, quantities, totals, fulfillment status, shipping addresses, customer name and contact information attached to the order.
Inventory: product variants, SKUs, stock levels per location.
Products: titles, variants, SKUs, prices.
Locations: the merchant's configured fulfillment locations.
Fulfillments: status of existing fulfillments and ability to create new ones (with tracking numbers and carrier names).

2. What information we store

KAK WMS stores the absolute minimum required to operate:

The Shopify OAuth access token for each installed shop, in our database.
The shop's myshopify.com domain.
Operational metadata (when the app was installed, last activity).

We do not persist customer personal information (names, emails, addresses, phone numbers, payment details) in our database. We read this data from Shopify's Admin API only at request time and use it to display the order in our warehouse interface so KAK staff can pick, pack, and ship the order.

3. How we use information

We use the data we access exclusively to provide fulfillment services to the merchant:

Display incoming orders in our warehouse queue.
Show pickers the items, quantities, and shipping addresses needed to fulfill orders.
Push fulfillment status (tracking numbers, carrier names) back to the merchant's Shopify store so the merchant's customer receives a tracking email from Shopify.
Adjust inventory levels in the merchant's Shopify when stock moves through our warehouse.

We do not use the data for advertising, profiling, resale, or any purpose other than fulfilling orders on behalf of the merchant.

4. Information sharing

We do not sell, rent, or share merchant or customer data with third parties for marketing purposes. We share data only with:

Shopify: via the Admin API, to read orders and write fulfillment updates.
Shipping carriers: when KAK staff hands off a packed parcel for delivery. Carriers receive the recipient's shipping address as printed on the label (the label itself is generated by the merchant's tools — see Section 6).
Infrastructure providers: our hosting (Vercel) and database (Neon Postgres) providers process data on our behalf under their respective data-processing agreements.

5. Data retention & deletion

We retain the OAuth access token and shop metadata for as long as the app is installed on the merchant's store. When a merchant uninstalls the app, we delete the associated session within 30 days. We also respond to Shopify's privacy compliance webhooks:

customers/data_request — we acknowledge but have no stored customer data to return.
customers/redact — we acknowledge but have no stored customer data to delete.
shop/redact — we delete the shop's session and any operational metadata within 30 days of the webhook.

6. Shipping labels

KAK WMS does not purchase, generate, or store shipping labels. Merchants purchase labels through their own tools (Shopify Shipping, Veeqo, ShipStation, etc.) and provide the tracking number to KAK for entry into the fulfillment record. Label PDFs are handled outside of this app.

7. Security

All connections to KAK WMS use TLS. OAuth access tokens are stored encrypted at rest in our database. Access to KAK's warehouse back-office is gated by a password and a signed session cookie. KAK staff with access to merchant data sign confidentiality agreements as part of their employment.

8. International transfers

KAK Sourcing operates internationally. By installing the app, the merchant consents to transfer of the data described in Section 1 to and from the jurisdictions in which KAK operates and to and from Shopify, Vercel, and Neon, which may process the data in the United States.

9. Children's data

KAK WMS is a business-to-business application and is not intended for use by children under 16. We do not knowingly collect data from children.

10. Changes to this policy

We may update this policy from time to time. The "Effective" date at the top of this page reflects the latest revision. Material changes will be communicated to installed merchants via the app and via email to the contact email on file with Shopify.

11. Contact

Questions about this policy or about KAK's data practices? Email ceo@kaksourcing.com.