Privacy Policy

This policy explains what data the SUNNY Delivery Date & Pickup app ("SUNNY Delivery", "the app", "we", "us") collects when a Shopify merchant installs it, how we use that data, and the choices merchants and their customers have. You can reach us at [email protected].

1. Our role

For merchant account data, we decide how the data is used and act as the controller.

For the personal data of a merchant's customers (shoppers) and delivery drivers, the merchant is the controller and we act as a processor. We process that data only to provide the app's features on the merchant's behalf and according to the merchant's settings. Shoppers should contact the store they ordered from about their data; we will help the merchant respond.

2. Data we collect

Merchant data

When you install the app, Shopify gives us your store's details: store name and myshopify.com domain, store owner name and email, country, timezone and Shopify plan. We also store the access tokens Shopify issues to the app, your SUNNY Delivery plan and billing status, and the settings you create in the app (locations and their addresses, schedules, time slots, delivery zones, fees, notification templates and integrations). Integration credentials you enter are stored encrypted.

Shopper data

When a shopper places an order that uses SUNNY Delivery, we receive the order from Shopify and store the data needed to schedule and fulfil it:

• name, email address and phone number;
• shipping address and, where available, its map coordinates;
• the order's items, the chosen pickup or delivery method, date and time slot, and delivery status;
• order notes, curbside vehicle details and pickup codes, when the merchant uses those features;
• proof of delivery (a photo and note added by the driver), when the merchant uses driver routes;
• a log of notification emails sent for the order (recipient, type and delivery result).

Before an order is placed, the storefront widget sends the store, the selected products and the chosen date and slot to reserve a slot for 10 minutes. These reservations contain no name or contact details and are deleted when the order is placed or the hold expires.

Driver data

If a merchant adds delivery drivers, we store each driver's name, phone number, email address and assigned locations. Proof-of-delivery photos are uploaded to the merchant's own Shopify Files, not to our servers.

Cookies and browser storage

The app does not set tracking or advertising cookies and does not use analytics trackers on the storefront. The storefront widget keeps the shopper's current selection and small display preferences in the browser's session or local storage so the choice is not lost between pages. Inside the Shopify admin, the app uses only what Shopify requires to authenticate the merchant.

3. How we use data

• to show available dates and slots and to stop slots being overbooked;
• to calculate delivery eligibility, distance and fees from the shipping address;
• to show orders, calendars, routes and pickup handovers to the merchant and their staff;
• to send order notification emails (confirmation, reminder, ready for pickup, out for delivery, delivered, rescheduled) on the merchant's behalf, when the merchant turns them on. These emails show the store's name as the sender and replies go to the store;
• to send data to tools the merchant connects, such as Klaviyo or the merchant's own webhook endpoint, only when the merchant sets that up;
• to bill the merchant through Shopify, provide support, and keep the service secure and working.

We do not sell personal data, use it for advertising, or use shopper data for our own marketing.

4. Service providers

We use a small number of trusted service providers to run the app, in these categories:

• cloud hosting, database and backup storage;
• email delivery, for the notifications merchants turn on;
• mapping and address lookup, to work out delivery zones, distance and fees;
• network security and monitoring.

Each provider processes data only to provide its service to us, under a written agreement with confidentiality and security obligations. We share only the data each one needs; for example, address lookup receives the address, not the shopper's name, email or phone number. Shopify itself also processes data as the platform the app runs on. Tools such as Klaviyo or webhook destinations receive data only when the merchant connects them. A current list of providers is available on request from [email protected].

5. International transfers

Data is mainly stored and processed in the United States. Where data protection law requires it, transfers rely on standard contractual clauses or equivalent safeguards.

6. Retention and deletion

• While the app is installed: we keep order and settings data so the merchant can see past and upcoming orders.
• When a shopper's data is redacted: when Shopify sends a customers/redact request, we remove the shopper's name, email, phone, address, coordinates, notes, vehicle details, pickup code and proof of delivery from their orders, and their address from email logs.
• When the app is uninstalled: we immediately revoke and delete the store's access tokens and stop all processing. Shopify sends a shop/redact request 48 hours later, and we then permanently delete all of the store's data.
• Logs used for troubleshooting are kept for up to 30 days.
• Backups are encrypted. Daily backups are kept for 35 days and monthly backups for up to 13 months, after which they are deleted. Data deleted from the live database may remain in these backups until they expire. We do not restore deleted data from backups except to recover from an incident.

7. Data requests

Shoppers can ask the store they ordered from to access or delete their data. Shopify passes these requests to us: for a customers/data_request we send the merchant a copy of the data we hold for that shopper so they can respond, and for a customers/redact we delete it as described above.

Merchants can ask us at any time to access, correct, export or delete their data by emailing [email protected]. We reply within 30 days.

Depending on where you live (for example under the GDPR in the EU/UK or the CCPA in California), you may have rights to access, correct, delete or restrict the use of your personal data, and to complain to your local data protection authority.

8. Security

We use industry-standard measures to protect data, including encryption in transit and at rest, verification of every request from Shopify, encrypted storage of credentials, and access controls with two-factor authentication. Order tracking links are signed and do not show the shopper's name, address, email or phone number.

If a data breach affects personal data, we will notify affected merchants without undue delay and within 72 hours of becoming aware of it.

9. Children

The app is a business tool for merchants and is not directed at children.

10. Changes

We may update this policy as the app changes. We will change the "Last updated" date at the bottom of this page, and for material changes we will notify merchants by email or in the app before they take effect.

11. Contact

Privacy questions and requests: [email protected]
General support: [email protected]

Last updated: October 18, 2026