Who we are
Outbound MCF is a Shopify app provided by Shreyas Labs. It fulfils a merchant's Shopify orders from the merchant's own TikTok Shop Fulfilled by TikTok (FBT) warehouse through TikTok's Multi-Channel Fulfillment API, and writes dispatch, tracking and stock information back to Shopify. The merchant is the data controller; we act as the merchant's processor.
Personal data we process
For each order the merchant routes to FBT, we process the order recipient's name, phone number, email address and shipping address, together with the Shopify order number, line items and quantities. We do not process payment details, browsing data or marketing preferences, and we do not access the merchant's customer list beyond the orders being fulfilled.
Why we process it
Solely to create and track the fulfillment order at the merchant's TikTok warehouse so the parcel can be shipped to the recipient. We do not use personal data for marketing, analytics, profiling or any other purpose, and we never sell it.
Who receives it
Recipient details are sent to TikTok Shop under the merchant's own TikTok Shop seller agreement, which the merchant authorises when connecting their TikTok account in the app. No other third party, sub-processor or analytics service receives personal data.
Where it is stored and for how long
Data is stored on servers in the United States. A snapshot of the recipient details is kept on the order record so failed handoffs can be retried and the merchant can see what was sent. It is automatically deleted 90 days after the order is delivered, cancelled or otherwise closed. Raw platform webhook payloads are deleted after 15 days. Backups are encrypted and rotated after 14 days.
Security
All traffic is encrypted in transit (TLS). Data is encrypted at rest, including backups. Access to systems holding personal data is limited to named staff using key-based authentication, and reads of recipient details through the app are logged. We keep a written security incident response policy and will notify affected merchants within 72 hours of confirming a breach involving their customers' data.
Merchant and customer rights
We honour Shopify's mandatory privacy webhooks: a customer data request is forwarded to the merchant; a customer erasure request deletes the recipient snapshot on the affected orders immediately; uninstalling the app deletes all recipient data for that store. Merchants may also email us to request export or deletion of any data we hold for their store.
Changes
If this policy changes materially we will notify installed merchants by email and update the date above.