Privacy policy
Last updated 16 October 2026
How Enrixa IndiaPost handles the personal data it needs to ship a store's orders with India Post.
Who we are
Enrixa IndiaPost (“the app”) is provided by Seamedia E-commerce Solutions (“we”, “us”), based in India. The app’s data is stored in India, with encrypted backups in the European Union (see below). For any privacy question or request, email support@myenrixa.com.
What the app does
The app books India Post shipments for a Shopify store’s orders under the store’s own India Post contract. It creates shipping labels, marks orders fulfilled with tracking in Shopify, and keeps delivery status up to date. We process personal data on behalf of the store (the merchant), who decides why and how it’s used. Our data processing terms set out that relationship.
Personal data we process
- Through Shopify’s APIs, from the store’s orders: the customer’s name, shipping address and phone number, the order’s items, and whether it’s paid or cash on delivery. We don’t access customer email addresses or payment details.
- From India Post: tracking events for each parcel, such as office names and delivery notes.
- Directly from merchants’ customers: nothing personal. Their details come only from the store’s Shopify orders. When a store turns on order tracking, a customer who looks up an order sends us the order number, and we keep a count per visitor (a one-way hash of the IP address) for 2 days (see below).
- About the merchant: the store’s Shopify address, its India Post account details (stored encrypted), its shipping settings, its app plan (read from Shopify), the email addresses it chooses for staff notifications with a copy of each notification email we send it (order numbers and article IDs, never customer details), and the Shopify staff account ID of whoever views customer details in the app, for our access log.
Why we use it
Only to book the shipment, print the label, send tracking to Shopify and show delivery status to the merchant.
- We don’t sell personal data.
- We don’t use it for advertising, profiling or automated decisions.
- We share customers’ details only with India Post, which needs them to deliver the parcel, and Shopify, which receives tracking status.
- Staff notification emails go to the addresses the merchant chooses through our email provider, Hostinger (Hostinger International Ltd.), which sees those addresses and the emails (order numbers and article IDs, never customers’ details).
- Only if the store connects it, Unicommerce (the store’s own Uniware account): the app tells Uniware the courier and article ID of each booked package, fetches the Uniware invoice for printing, and can adjust stock by SKU. Those invoices name the customer, as the store’s Uniware already does.
Where it’s stored and how it’s protected
- The app and its database run on a server operated for us by Amazon Web Services (Lightsail) in Mumbai, India. Encrypted backups are also kept offsite in Cloudflare storage (R2) in the European Union. Cloudflare also provides our domain name service, which doesn’t see app data.
- Customer details, labels and credentials are encrypted at rest (AES-256) and in transit (TLS). Backups are encrypted too. The delivery PIN code is also kept on its own, unencrypted, for routing and reports, until the customer’s details are erased.
- Access is limited to authorised administrators, and every access to customer details is logged.
More detail is on our security page.
How long we keep it
| Data | Kept for |
|---|---|
| Customer name, address and phone | Erased after the period the merchant chooses, counted from when the shipment is delivered, cancelled, or back with the store after a return: 90 days by default, and between 30 and 365 days. A shorter period applies to existing shipments too. Erasing also removes the shipping label, the delivery PIN code, India Post’s error messages about the shipment and tracking remarks; the order number, article ID, status and dates stay for the store’s records. |
| Customer details on a shipment that never finishes (for example, an order that’s never shipped) | Erased once the shipment is older than the chosen period plus 90 days (tracking stops after 60 days without a final status) |
| Shipping labels | Deleted 7 days after India Post first scans the parcel |
| Uniware invoices (stores that connect Unicommerce) | Deleted 30 days after India Post first scans the parcel; fetched again from Uniware if the store asks for it later |
| Labels and invoices of a cancelled shipment | Deleted 7 days after the shipment is cancelled |
| Customer data export files | 30 days |
| Records of calls to India Post and Shopify | 30 days. Phone numbers and PIN codes in India Post’s error messages are masked before they’re stored, and the messages are removed when a customer’s data is erased on request. |
| Records of customer data requests and erasures (order and customer IDs only) | 1 year |
| Access log | 1 year |
| Staff notification emails (recipients, subject and text) | 90 days |
| Encrypted backups | 14 days on our server, and up to 35 days in offsite storage |
When a store uninstalls the app, Shopify asks us to delete its data 48 hours later. We delete all of the store’s data when that request arrives; copies in encrypted backups age out within 35 days.
Order tracking on a store
If a store turns on “Track your order”, its customers can look up an order by its number on the store. We show only the parcel’s status, India Post article ID and India Post’s scans, never a name, address or phone. To limit lookups, we count them per visitor using a one-way hash of the IP address, which is deleted after 2 days.
Enquiries through our website
When you use the early access or setup help form on our website, what you enter (your name, email, and optionally your phone number, store website and message) is emailed to our support mailbox so we can reply. The app doesn’t store it. To limit abuse, the form counts requests per visitor using a one-way hash of the IP address, which is deleted after 2 days. The website counts clicks on its main buttons and enquiries sent on our own server.
Website analytics
Our website (not the app in your Shopify admin, and not your store) uses Google Analytics, provided by Google, to understand how visitors find and use it: the pages viewed, how they arrived, and their approximate location and device. It uses Google’s consent mode. Until you accept in the cookie banner, no analytics cookies are set and Google receives only anonymous, cookieless signals (such as a page having been viewed), which can’t be linked to you. If you accept, analytics cookies are set; if you decline, they’re removed. Advertising features are always off. You can change your choice any time with “Cookie settings” at the bottom of every page.
Customers’ rights
Customers can ask the store they bought from for access to, correction of or erasure of their data. When the store receives such a request through Shopify, we act on it automatically: we prepare an export of what we hold, or erase it. Customers can also contact us at support@myenrixa.com, and we’ll work with the store to respond.
Security incidents
If a security incident affects personal data, we notify the affected merchants without undue delay and within the time limits set by applicable law.
Changes to this policy
We’ll post updates on this page and tell merchants about material changes before they take effect.