BESTDEALER

BestDealer Order Tracking Privacy Policy

Effective date: July 20, 2026

This policy applies only to BestDealer Order Tracking. Hongkong Leyihui Technology Co., Limited operates the app and controls the app information described here. The Shopify merchant remains responsible for the order and customer information it submits through Shopify.

Information we process

When a merchant installs and uses the app, we process:

Buyer tracking page

Buyers can search with a tracking number, or submit an order number and checkout email. The order-and-email form uses an HTTP POST so the email is not placed in the page URL. Public results are limited to shipment details and do not return the checkout email, recipient name, phone number, or address summary.

Within the app, a request IP address is used in a Redis rate-limit key that expires after 60 seconds. Operational logs record only non-sensitive runtime metadata, such as lookup type and aggregate outcome. They do not record tracking numbers, Shopify order IDs, checkout emails, recipient details, or other customer identifiers.

17TRACK

We use 17TRACK to retrieve carrier tracking events. We send the tracking number, an internal shipment reference, and, when available, the Shopify order number and ship date. We do not send checkout emails, recipient names, or recipient address summaries to 17TRACK.

How we use information

We use information to authenticate the app, import fulfilled orders, register and refresh shipment tracking, show merchant analytics and exception alerts, provide the buyer tracking page, secure the service, troubleshoot errors, and respond to support or privacy requests.

Retention and deletion

Shipment records and their related carrier events become eligible for deletion 180 days after shipment creation. A daily cleanup removes eligible records. Uninstalling deactivates the shop and removes Shopify sessions. A verified customer-redaction request deletes every complete shipment matched to that customer, including its related tracking events. A verified shop-redaction request deletes the remaining Order Tracking records for the shop; Shopify sends that request at least 48 hours after uninstall. We retain other configuration and operational records only while needed to provide the app, meet legal obligations, secure the service, or resolve disputes.

When Shopify sends a verified customer data request, the app creates a merchant-only JSON export and shows it in the embedded Privacy requests page. The store owner can download the export, deliver it securely to the requester, and mark the request as delivered. Marking it delivered immediately removes the stored export. An uncompleted export expires automatically 60 days after the request was received; the delivery deadline shown in the app is 30 days.

Sharing and international processing

We disclose information only to 17TRACK as described above, to service providers that host, secure, monitor, or support the app, to Shopify as needed for the integration, or when required by law. Providers may process information in other countries and must protect it under applicable contractual and legal safeguards. We do not sell personal information or use app data for behavioral advertising.

Security

We use encrypted network transport, restricted service credentials, request validation, rate limiting, access controls, and operational monitoring designed to protect app data.

Privacy rights and contact

Buyers should contact the Shopify merchant first because the merchant controls the order. Merchants and authorized requesters can contact us for access, correction, deletion, or other applicable privacy rights.

Hongkong Leyihui Technology Co., Limited
support@bestdealer.com