Privacy Policy

This Privacy Policy ("Policy") describes how Unifynd Technologies Pvt. Ltd., the entity operating StackBack ("we", "us", or "our"), collects, uses, stores, shares, and protects information when you access or use our website at stackback.ai, our Shopify application, our customer portal, and any related services (collectively, the "Service").

By installing our Shopify application or accessing any part of the Service, you acknowledge that you have read, understood, and agree to the practices described in this Policy. If you do not agree, please do not use the Service.

1. Definitions

"Merchant" or "You" refers to any business, individual, or entity that installs or uses the StackBack application on a Shopify store.

"End Customer" refers to individuals who purchase products or services from a Merchant’s Shopify store and interact with StackBack features such as the customer portal, subscription widgets, bundles, or flash sale pages.

"Personal Data" means any information relating to an identified or identifiable natural person, as defined under applicable Indian law, including the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023 (as and when notified and applicable).

"Shopify Data" refers to data accessed through Shopify’s APIs and webhooks in connection with the Merchant’s store, including but not limited to order data, product data, customer data, and store settings.

2. Information We Collect

2.1 Information from Merchants

When you install and use our Shopify application, we may collect:

Shopify store information: store name, store URL, store owner name, email address, store locale, currency, and timezone.
Account and billing information: plan selections, billing cycle, and payment status as managed through Shopify’s billing system.
Product and catalogue data: product titles, descriptions, variants, pricing, images, and inventory data necessary to configure subscription plans, bundles, and other selling formats.
Order and transaction data: order details, delivery schedules, fulfilment status, and payment status for orders created through StackBack.
Communication preferences: email addresses and notification settings for receiving service-related communications.
Usage data: actions taken within the StackBack admin dashboard, feature usage patterns, configuration settings, and session information.

2.2 Information from End Customers

When End Customers interact with StackBack-powered features on a Merchant’s store, we may collect:

Contact information: name, email address, phone number, and shipping/billing address as provided during checkout or portal access.
Order and subscription data: subscription plans selected, delivery schedules, order history, product preferences, and renewal information.
Portal activity data: actions taken within the customer portal, including subscription management activities such as rescheduling, pausing, swapping products, and browsing bundles.
Authentication data: email addresses used for magic link authentication to access the customer portal.
Device and browser data: IP address, browser type, device type, operating system, and general location data derived from IP address.

2.3 Automatically Collected Information

We automatically collect certain technical information when you access the Service:

Log data: server logs, access times, pages viewed, referring URLs, and error logs.
Cookies and similar technologies: we use cookies, local storage, and similar tracking technologies to maintain sessions, remember preferences, and analyse usage. See Section 8 for details.
Shopify webhook data: we receive real-time data from Shopify through webhooks for events including order creation, order updates, product changes, app uninstallation, and compliance-related events (data request, data erasure, shop redact).
When you visit or log in to our website, cookies and similar technologies may be used by our online data partners or vendors to associate these activities with other personal information they or others have about you, including by association with your email. We (or service providers on our behalf) may then send communications and marketing to these email addresses. You may opt out of receiving this advertising by visiting https://app.retention.com/optout.

2.4 Enquiries Made on Our Website

When you fill in a form on stackback.ai, for example to apply for the Ignition program, book a demo or ask about an offer, we collect:

What you tell us: your name, work email, WhatsApp or phone number, store URL or brand, monthly sales band, e-commerce platform and any other answers on the form. We save each step as you complete it, so we may hold what you entered even if you do not finish the form.
Call bookings: the time you book through Calendly and the booking reference.
How you reached us: the ad or link that brought you to our website (such as Google or Meta click identifiers and UTM tags) and the dates of your first and latest visits. We keep this in a cookie on your device for up to 90 days.
Technical details: your country and city as estimated from your IP address, your browser and device type, the page you were on, and the identifiers set by our analytics and advertising tools. We store your IP address only as a one-way hash, which we use to prevent spam.

3. How We Use Your Information

We use the information collected for the following purposes:

3.1 Service Delivery and Operations

To install, configure, and operate the StackBack application on your Shopify store.
To create and manage subscription plans (prepaid and pay-as-you-go), bundles (fixed and build-your-own-box), flash sales, and try-before-you-buy campaigns.
To generate and punch Shopify orders for scheduled subscription deliveries.
To operate the customer portal, including magic link authentication, subscription management, delivery tracking, product swaps, and bundle browsing.
To send transactional emails, including order confirmations, delivery reminders, renewal notifications, PAYG payment nudges, and rescheduling confirmations.
To process billing through Shopify’s billing system.

3.2 Service Improvement

To analyse usage patterns and improve the Service’s features, performance, and user experience.
To identify and fix bugs, errors, and security vulnerabilities.
To develop new features and selling format modules.

3.3 Communication

To send you service-related notices, updates, and administrative messages.
To respond to your enquiries and support requests.
To send marketing communications where you have consented to receive them (you may opt out at any time).

3.4 Legal and Compliance

To comply with applicable laws, regulations, and legal processes.
To enforce our Terms and Conditions and protect our rights and property.
To respond to Shopify compliance webhooks (customer data requests, customer data erasure, and shop data erasure).

3.5 Enquiries and Advertising

To respond to your enquiry and contact you about it by WhatsApp, email or phone, including following up on an enquiry you started but did not finish.
To assess whether StackBack suits your business and to arrange calls with you.
To measure and improve our advertising, by reporting that an enquiry was made to the advertising platforms that brought you to us, as described in section 4.5.

We do not sell your Personal Data. We may share information in the following circumstances:

4.1 Service Providers

We engage trusted third-party service providers who process data on our behalf to deliver the Service. These include:

Cloud infrastructure and hosting providers for application delivery and data storage.
Email delivery providers for sending transactional communications on behalf of Merchants.
Authentication service providers for secure customer portal access.
Shopify: as the platform on which the application operates, data is shared with Shopify as necessary for app functionality, billing, and compliance.
Payment processors: billing for the Service is handled through Shopify’s built-in billing system; we do not directly process Merchant payment card information.
For enquiries made on our website: Supabase (our enquiry database, hosted in India), Vercel (website hosting), Slack (internal alerts to our team), Google (Google Sheets, Google Analytics and Google Ads), Calendly (call booking), Meta (advertising measurement and ad delivery), LinkedIn (advertising measurement), and visitor-identification services (Leadfeeder, Apollo and RB2B) that may identify the company you visit from.

All service providers are bound by contractual obligations to process data only for the purposes we specify and to maintain appropriate security measures.

4.2 Legal Obligations

We may disclose information if required to do so by law, regulation, legal process, or governmental request, including requests from Indian law enforcement or regulatory authorities.

4.3 Business Transfers

In the event of a merger, acquisition, reorganisation, or sale of all or a portion of our assets, your information may be transferred as part of the transaction. We will notify you of any such change and any choices you may have regarding your information.

4.4 With Your Consent

We may share your information for purposes not described in this Policy with your explicit consent.

4.5 Advertising Partners

When you submit an enquiry or book a call, our website tells Google Ads, Meta and LinkedIn that it came from their advertising. Google and Meta also receive a reference number for the enquiry and an indicative value.

Google Ads receives your email address and phone number in hashed form (SHA-256), so Google can match the enquiry to an ad you saw or clicked (Google's enhanced conversions).

Meta (Facebook and Instagram) receives your name, email address and phone number in hashed form (SHA-256), your country, a hashed reference number for the enquiry, your IP address, your browser details and the identifiers set by Meta's pixel. We send these from your browser and from our servers when you complete a step of a form and when you book a call, and your browser may include the hashed details with Meta's events for the rest of that visit. Meta uses them to match your enquiry to an ad you saw or clicked, to measure our advertising and to improve who sees our ads.

Hashing turns your details into a code that can't be read back, but a partner can match it against details it already holds, so it doesn't make the data anonymous. LinkedIn doesn't receive your contact details, and no partner receives your other answers on the form (such as your store, sales or platform).

5. Data Processing Roles

With respect to End Customer data: the Merchant is the data fiduciary (controller) and StackBack acts as a data processor. We process End Customer data solely on the Merchant’s behalf and in accordance with the Merchant’s instructions.

With respect to Merchant account data: StackBack is the data fiduciary (controller) and processes Merchant data for the purposes described in this Policy.

Merchants are responsible for ensuring that their collection and use of End Customer data through StackBack complies with applicable privacy laws and that appropriate notices and consents have been obtained from their End Customers.

6. Data Storage and Security

6.1 Storage

Your data is stored on secure cloud servers with data centre presence in India and other locations as necessary for service delivery.

6.2 Security Measures

We implement reasonable technical and organisational measures to protect your data, including:

Encryption of data in transit using TLS/SSL.
Access controls and authentication mechanisms for internal systems.
Regular security reviews and updates.
Secure magic link authentication (no passwords stored) for the customer portal.

No method of transmission or storage is completely secure. While we strive to protect your data, we cannot guarantee absolute security.

6.3 Retention

We retain your data for as long as your account is active or as needed to provide the Service. Upon termination or uninstallation of the StackBack application, we will retain data only as necessary to comply with legal obligations, resolve disputes, and enforce agreements. We respond to Shopify’s mandatory compliance webhooks (48-hour customer data requests, customer data erasure, and shop data erasure within 30 days) as required by Shopify’s platform policies.

Enquiries made on our website are kept for as long as we are in discussion with you and as needed for our business relationship. Enquiries that were started but never completed are deleted after 180 days, and hashed IP addresses after 14 days.

7. Your Rights

Subject to applicable Indian law, including the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023 (as and when effective), you may have the following rights:

Access: request access to the Personal Data we hold about you.
Correction: request correction of inaccurate or incomplete Personal Data.
Erasure: request deletion of your Personal Data, subject to our legal retention obligations.
Grievance redressal: raise complaints regarding the processing of your Personal Data.
Nominate: nominate another individual to exercise your rights on your behalf in the event of your death or incapacity, as provided under applicable law.

To exercise any of these rights, please contact us at the details provided in Section 12. We will respond to your request within a reasonable timeframe, and in any event within the time required by applicable law.

For End Customers: if you are an End Customer and wish to exercise your data rights, please contact the relevant Merchant directly in the first instance, as they are the data fiduciary for your data. You may also contact us, and we will assist the Merchant in responding to your request.

8. Cookies and Tracking Technologies

We use cookies and similar technologies for the following purposes:

Essential cookies: required for the functioning of the Service, including session management and authentication (e.g., magic link sessions in the customer portal).
Analytics cookies: to understand how the Service is used and to improve performance.
Preference cookies: to remember your settings and configuration choices.
Advertising and attribution cookies: Google, Meta and LinkedIn tags measure how our ads perform, and our own cookie remembers which ad or link brought you to our website, for up to 90 days, so we can attribute your enquiry.

You can manage cookie preferences through your browser settings. Disabling essential cookies may impair the functionality of the Service.

9. Third-Party Links and Integrations

The Service operates as a Shopify application and integrates with the Shopify platform. The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of third parties, including Shopify. We encourage you to review the privacy policies of any third-party services you interact with.

10. Children’s Privacy

The Service is not directed at individuals under the age of 18. We do not knowingly collect Personal Data from children. If we become aware that we have inadvertently collected Personal Data from a child, we will take steps to delete such data promptly.

11. Changes to This Policy

We may update this Policy from time to time. When we make material changes, we will notify you by updating the effective date at the top of this Policy and, where appropriate, by sending you a notice via email or through the Service. Your continued use of the Service after such changes constitutes your acceptance of the updated Policy.

12. Grievance Officer and Contact Information

In accordance with applicable Indian law, we have appointed a Grievance Officer to address your concerns regarding data processing. You may contact us at:

Email: hello@unifyndlabs.com

Address: E4, Gul, Pali Hill, Bandra West. Mumbai - 400050

We will acknowledge your grievance within 24 hours and endeavour to resolve it within 30 days of receipt, or within such time as required by applicable law.

13. Governing Law

This Policy shall be governed by and construed in accordance with the laws of India. Any disputes arising from or relating to this Policy shall be subject to the exclusive jurisdiction of the courts in Mumbai, Maharashtra, India.