Privacy Policy

Effective September 30, 2026

This Privacy Policy explains how KAK Global Link Inc, doing business as KAK Sourcing & Fulfillment ("KAK", "we", "us"), 6117 Long Dr, Houston, TX 77087, handles information when a Shopify merchant installs the KAK WMS app and when KAK fulfills orders on that merchant's behalf.

1. What we access from Shopify

Orders: order number, line items, SKUs, quantities, totals and fulfillment status.
Ship-to details: for orders KAK fulfills, the recipient's name and shipping address.
Inventory, products and locations: variants, SKUs and stock levels.
Fulfillments: existing fulfillments, and new ones we create with carrier and tracking number.

We do not access customers' email addresses, phone numbers, payment details or customer profiles.

2. Other sales channels

If a merchant connects Walmart, TikTok Shop, eBay or Amazon to KAK WMS, we receive the ship-to name and address of those channels' orders so we can ship them. It is stored with the order record and erased 7 days after the order ships.

The same applies to a WooCommerce (WordPress) store. The merchant approves KAK on their own store, which issues KAK a REST API key (stored encrypted, and revocable by the merchant at any time under WooCommerce → Settings → Advanced → REST API). We read the store's orders and products, and we write back the tracking number, carrier and shipped status. For each order we keep the recipient's name, address, and the phone number given for delivery, together with the items and quantities; we do not keep the customer's email address or payment details. The recipient's details are erased 7 days after the order ships or is cancelled.

3. What we store

The Shopify session (access token) and settings for each installed shop.
Warehouse records: inventory, receiving, purchase orders, outbound shipments, packing scans, and an activity log that records staff names and order numbers.
Shipping-label files attached to an order. They show the recipient's name and address and are deleted automatically 7 days after upload.
Free-text notes staff add to returns.

Ship-to names and addresses from Shopify are read at the moment a KAK staff member opens an order or prints its documents. They are not saved in our database.

4. How we use information

Only to fulfill the merchant's orders:

Show the order queue and pick lists to our warehouse team.
Print packing slips and shipping labels with the recipient's name and address.
Send the tracking number back to the merchant's Shopify store, which emails the customer.
Keep the merchant's Shopify inventory in step with the stock in our warehouse.

We never use customer data for advertising, profiling or any other purpose, and we never sell it.

5. Sharing

Shopify: to read orders and write fulfillments, through the Admin API.
Shipping carriers: the recipient's name and address, printed on the shipping label.
Infrastructure providers: our hosting (Vercel) and database (Neon) providers, which process data on our behalf under their data-processing agreements.

6. Retention and deletion

Customer names and addresses are kept for no longer than 7 days, as described in Sections 2 and 3.
Shopify sessions are deleted when the app is uninstalled.
customers/redact: we immediately delete the shipping-label files and return notes for the orders listed in the request.
customers/data_request: we give the merchant a copy of anything we still hold for the listed orders.
shop/redact: we delete the shop's sessions, shipping-label files and return notes. Inventory, receiving and purchase-order records contain no customer data and are kept under the merchant's fulfillment agreement with KAK.

7. Security

All connections use TLS, and our database is encrypted at rest, including its backups. KAK staff sign in with individual accounts that have role-based permissions and passwords of at least 12 characters, stored only as salted hashes. Every staff view of a customer's ship-to is logged. We test only on development stores, never on a merchant's live store. Staff with access to merchant data are bound by confidentiality obligations.

8. Security incidents

If we confirm a security incident affecting merchant or customer data, we notify the affected merchants without undue delay, and within 72 hours, with what happened and what we have done about it.

9. International transfers

KAK operates internationally. By installing the app, the merchant consents to the transfer of the data described above to and from the jurisdictions in which KAK operates and to and from Shopify, Vercel and Neon, which may process the data in the United States.

10. Children's data

KAK WMS is a business-to-business application and is not intended for use by children under 16. We do not knowingly collect data from children.

11. Changes to this policy

We may update this policy from time to time. The "Effective" date at the top of this page shows the latest revision. We tell installed merchants about material changes in the app and by email to the contact address on file with Shopify.

12. Contact

Questions about this policy or KAK's data practices? Email ceo@kaksourcing.com.