EZ Rates Privacy Policy

Last updated: October 7, 2026

EZ Rates ("the app", "we") is a Shopify app that returns shipping rates at checkout. This policy explains what data the app receives from a merchant's store, what it does with it, and how long it keeps it.

Data the app receives

• Store information: store name, domain, contact email, plan, and the access token Shopify issues when the app is installed (stored encrypted).
• Product catalog: product and variant titles, SKUs, weights, and the shipping attributes stored in metafields (dimensions, shipping groups, freight class, origin, HS code). This is what the app rates with.
• Checkout rate requests: when a customer reaches the shipping step, Shopify sends the app the cart contents and the destination address (name, address, city, region, postal code, country, and phone when present) so carriers can quote it.
• Order replays and insights: merchants may replay past orders to calibrate rates; the app then reads those orders' line items and shipping address from Shopify.
• Carrier credentials: API keys and account numbers the merchant enters for their own carrier accounts (UPS, FedEx, USPS, DHL, XPO, Freightview, and others), stored encrypted and used only to request rates from that carrier.

How the data is used

• To calculate and return shipping rates for the merchant's checkout, which includes sending the destination address, package weights and dimensions to the carriers the merchant has connected.
• To show the merchant their own checkout activity and rate accuracy in the app's Insights pages.
• To bill the merchant through Shopify's Billing API. The app never sees payment card details.

The app does not sell data, does not use it for advertising, and does not share it with anyone other than the carriers the merchant connects and the infrastructure providers that host the app.

Retention

• Checkout rate logs (destination city, region, postal code, cart summary, rates returned) are kept for 90 days for the merchant's Insights, then deleted.
• Product catalog data is kept while the app is installed and refreshed from Shopify.
• When the app is uninstalled, Shopify sends an uninstall webhook and the store's data, including carrier credentials, is deleted within 48 hours. Shopify's shop/redact request is honored the same way.
• Customer data requests (customers/data_request) and erasure requests (customers/redact) from Shopify are processed within 30 days. The app does not keep customer accounts; the only customer data it holds is in rate logs, which are purged on request.

Security

Data is transmitted over HTTPS. Access tokens and carrier credentials are encrypted at rest. Access to production systems is limited to the app's operators.

Hosting and sub-processors

The app runs on Railway (application and database hosting, United States). Rate requests are sent to the carriers the merchant has configured.

Contact

Questions or data requests: the support address shown on the app's Help page, or the email listed on the app's Shopify App Store page.