Privacy Policy

For merchant account data, Zyron Labs is the controller. For customer data we process on a merchant's behalf, the merchant is the controller and Zyron Labs acts as a processor, handling that data only on the merchant's instructions and to provide the service. If you are a customer of a store that uses WarrantyFlow, please contact that store first about your personal data; we will support them in responding to your request.

From merchants and their team members

• Account details: name, email address, and password (stored only as a salted hash).
• Organization details: business name, country, currency, and tax registration such as a GSTIN.
• Billing details: plan and subscription status. Payments are processed by Shopify or our payment processors; we do not receive or store full card numbers.
• Security data: login sessions, optional two-factor authentication settings, and audit records of changes made in the dashboard.

From connected Shopify stores

• Store information: shop domain and an encrypted access token issued by Shopify.
• Product data: products, variants, SKUs, and warranty-related product metafields.
• Order data: order number, currency, totals, and line items for paid and cancelled orders, used to issue and void warranties.
• Customer data attached to orders: the Shopify customer ID and email address.

From customers who register a warranty or file a claim

• Full name, email address, and, if provided, phone number.
• Product serial number, activation code, or QR token.
• Claim descriptions and any photos or files uploaded as evidence.
• Preferred language.

Technical data

• IP address, browser type, and request logs collected by our servers for security, abuse prevention, and troubleshooting.

We use personal data only to provide and improve WarrantyFlow, specifically to:

• Create warranty records from orders and let customers activate them.
• Receive, route, and track warranty claims for the merchant's team.
• Send transactional messages about a warranty or claim, such as issuance confirmations, claim status updates, and expiry reminders, by email and, where the merchant enables them, SMS or WhatsApp.
• Operate merchant accounts, billing, and customer support.
• Secure the service, prevent fraud, and comply with legal and tax obligations.

We do not sell personal data, we do not use customer data for advertising, and we do not send marketing messages to merchants' customers. We do not make automated decisions that produce legal or similarly significant effects on individuals.

Where laws such as the GDPR apply, we process merchant data to perform our contract with the merchant and for our legitimate interests in running a secure service. Customer data is processed on the merchant's instructions, under the legal basis the merchant relies on, which is typically performance of the warranty they offer. Where consent is required, it is collected before processing and can be withdrawn at any time.

We share personal data only with service providers that help us run WarrantyFlow, under contracts that require them to protect it:

• Shopify, to connect to stores, receive order and product data, and process app subscription billing.
• Cloud hosting, database, and file storage providers, which run our service and store uploaded claim files in private storage.
• Email, SMS, and messaging providers, to send transactional messages. SMS and WhatsApp are used only when a merchant enables them.
• Payment processors, to handle payments for merchants billed directly rather than through Shopify.

We may also disclose information when required by law, to protect the rights and safety of our users or the public, or as part of a merger or acquisition, in which case this policy will continue to apply.

• Merchant account data is kept while the account is active and deleted or anonymized when the merchant asks us to close it.
• When a customer's data is erased, whether through a merchant's request or a Shopify customer-redaction request, we remove their name, email address, phone number, and address from their customer record. Warranty, order, and claim records are kept so merchants can meet warranty and tax record-keeping obligations.
• When a store uninstalls our Shopify app, we delete its Shopify access credentials immediately and stop receiving its data. When Shopify then sends a shop-redaction request, we erase the personal details of every customer who ordered through that store in the same way.
• Server logs are kept for a limited period for security and troubleshooting, then deleted.

We protect data with encryption in transit (TLS), encryption of Shopify access tokens at rest, salted password hashing, role-based access controls for merchant teams, private file storage accessed through short-lived signed links, and restricted internal access to production systems. No system is perfectly secure; if we become aware of a breach affecting personal data, we will notify affected merchants and authorities as required by law.

The WarrantyFlow dashboard uses strictly necessary cookies to keep you signed in and to protect against cross-site request forgery. The storefront warranty widget does not set cookies. We do not use advertising or cross-site tracking cookies.

Depending on where you live, including under the GDPR, the UK GDPR, India's Digital Personal Data Protection Act, and U.S. state privacy laws such as the CCPA, you may have the right to access, correct, delete, or export your personal data, to object to or restrict certain processing, to withdraw consent, and to nominate someone to exercise these rights on your behalf.

Merchants can export or delete data from Settings → Data privacy in the dashboard or by emailing us. Customers should contact the store they purchased from; we act on verified requests forwarded by merchants and by Shopify. We will not discriminate against anyone for exercising their rights. You may also lodge a complaint with your local data protection authority.

We and our service providers may process data in countries other than the one where you live. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses for these transfers.

WarrantyFlow is a business service and is not directed at children. We do not knowingly collect personal data from anyone under 18.

We may update this policy as our service or legal requirements change. We will post the updated version here with a new effective date and, for material changes, notify merchants by email or in the dashboard.

For privacy questions or requests, contact Zyron Labs at contact@zyronlabs.com. We aim to respond within 30 days.