Early Bird Connect Privacy Policy
Last updated: 12 May 2026
This privacy policy applies to Early Bird Connect, a Shopify app provided by Exacta Digital AB (org. nr 559136-4681), Kungsgatan 62, Uppsala, Sweden.
Early Bird Connect connects a merchant's Shopify store with Early Bird shipping services. The app processes the data needed to book shipments, update Shopify with shipment information, and support the merchant's use of the service.
Contact
Exacta Digital AB Org. nr 559136-4681 Kungsgatan 62 Uppsala, Sweden info@itsed.se
Roles and Responsibilities
For order, customer, delivery, and shipment data, the Shopify merchant is normally the controller under the GDPR. Exacta Digital AB processes that data as the merchant's processor in order to provide the app.
Exacta Digital AB is controller for data processed for its own administration and operation of the service, for example support correspondence, billing administration, access control, security logs, and legal compliance.
Data Processed by the App
The app may process the following data from Shopify:
- shop domain, shop identifiers, installation status, app subscription status, and Shopify access tokens;
- order identifiers, order name, order status, fulfilment status, selected shipping method, fulfilment order data, parcel weight, and shipping-related order metadata;
- receiver details needed for shipment booking, including name, address, postcode, city, country, email address, and phone number;
- parcel locker selections and delivery preferences, if enabled by the merchant;
- booking, tracking, fulfilment, and shipment-status information written back to Shopify.
The merchant may also provide:
- Early Bird carrier credentials and webhook secrets;
- sender and return-address details;
- shipping configuration, service mappings, prices, notification preferences, and setup state;
- support and troubleshooting information.
Technical logs may include timestamps, request identifiers, shop domain, order or booking identifiers, status codes, error context, IP address, and user-agent information. Logs should not contain passwords, API keys, signing secrets, or access tokens.
The app does not process payment-card details or customer financial data. Merchant and customer data is not used for advertising or profiling.
Purposes
Data is processed to:
- connect the Shopify store to Early Bird;
- show shipping options, coverage decisions, and parcel locker choices;
- create, cancel, track, and update shipments;
- update Shopify with shipment, tracking, fulfilment, and status information;
- prevent duplicate bookings, replay attacks, abuse, and unauthorised access;
- provide support and troubleshooting;
- maintain billing, entitlement, audit, webhook, and security records;
- assist merchants with privacy requests and legal obligations.
Legal Basis
When Exacta Digital AB acts as processor, the merchant is responsible for the legal basis for processing customer and order data.
When Exacta Digital AB acts as controller, the legal basis is normally one or more of the following:
- contract, where processing is needed to provide the app to the merchant;
- legitimate interest, for security, troubleshooting, service reliability, fraud prevention, and business administration;
- legal obligation, where information must be retained or disclosed under applicable law.
Recipients and Service Providers
Data is shared only as needed to provide and operate the app.
The app exchanges data with:
- Shopify, for app installation, Admin API access, webhooks, billing, fulfilment updates, and embedded app functionality;
- Early Bird, for shipment booking, delivery, tracking, carrier operations, and related support.
Exacta Digital AB also uses technical providers for hosting, databases, connectivity, logging, tracing, monitoring, and operational security. Current technical providers include Railway and Grafana Cloud.
Early Bird may process shipment data as a carrier under its own responsibilities and terms. Shopify processes data according to its relationship with the merchant.
Retention
Personal data is kept for as long as needed to provide the app, support merchants, maintain security, and meet legal or operational requirements.
In general:
- Shopify access tokens are deleted when the app is uninstalled;
- shop configuration, sender profile, billing state, shipping settings, order-to-shipment links, locker selections, and related shop records are kept while the app is installed and until deletion is required or requested through Shopify's shop-redaction process;
- operational logs, webhook records, audit records, and security records are kept for troubleshooting, replay protection, security, and compliance;
- shipment and booking records may be retained for longer where needed for carrier operations, support, accounting, legal claims, or legal obligations.
When Shopify sends a shop deletion request after uninstall, Early Bird Connect deletes local shop records where required. Shipment records held by Early Bird or in carrier-related operational systems may be subject to separate retention requirements.
Security
Shopify access tokens and Early Bird credentials are encrypted at rest. Communication between Shopify, Early Bird Connect, Early Bird, and infrastructure providers uses HTTPS or private service networking where available. Webhooks and callbacks are signature-verified where supported.
Production data is accessible only to authorised personnel who need access for support, security, or operation of the service.
Transfers Outside the EU/EEA
Personal data may be processed outside the EU/EEA by Shopify or technical providers used to operate the app. Where required, transfers are protected by GDPR-approved safeguards, such as the European Commission's standard contractual clauses.
Cookies and Similar Technologies
The app uses Shopify's embedded app environment and strictly necessary storage for authentication, session handling, and app settings. It does not use advertising cookies or cross-store tracking.
Rights
Where Exacta Digital AB is controller, you may request access, rectification, erasure, restriction, objection, and data portability under the GDPR.
For customer, order, delivery, and shipment data, customers should normally contact the Shopify merchant, since the merchant is the controller. Merchants can contact Exacta Digital AB at info@itsed.se.
Complaints may be submitted to Integritetsskyddsmyndigheten (IMY): https://www.imy.se.
Changes
The latest version of this policy is available at this URL.