EZOZ AusPost eParcel & Satchel
Privacy Policy
Effective date: 7 October 2026
This policy explains how Nicolas Gabriel Laurent Vibert (ABN 61 165 925 947) ("we", "us") handles personal information in the Shopify app EZOZ AusPost eParcel & Satchel (the "App").
The App lets a Shopify store (the "Merchant") quote Australia Post shipping at checkout, create Australia Post eParcel labels, manifests and return labels, and record prepaid satchels for the Merchant's orders.
1. Our role
- For the Merchant's customers: we handle their information on the Merchant's behalf and on its instructions, only to provide the App. The Merchant decides why it's collected and is responsible for it towards its customers. Customers should contact the Merchant first. We help the Merchant respond (section 8).
- For the Merchant's own details (store, account and staff): we decide how those are used, as this policy describes.
We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth). Where a Merchant's customers are in other countries, we support the Merchant's obligations under the laws that apply to it.
2. What we handle
About the Merchant's customers (received from the Merchant's Shopify store):
| Information | Why the App needs it |
|---|---|
| Name and company on the shipping address | Printed on the Australia Post label as the recipient |
| Shipping address (street, suburb, state, postcode, country) | The delivery address on the label; the postcode and suburb to quote shipping at checkout |
| Phone number and email address | Australia Post requires one of them for the recipient; the email is also used for Australia Post's tracking notifications |
| Order details: order number, items (SKU, quantity, weight, price), the shipping option paid for | To choose the service, build the parcel and fill the customs declaration for international parcels |
| Shopify customer ID | To recognise that two orders are for the same customer so they can be sent as one parcel, and to apply the Merchant's trade-customer shipping rules |
About the Merchant:
- the store's domain and name, and the owner's email;
- the Shopify plan and the App plan;
- dates of install and uninstall;
- the Shopify ID of staff who use the App (so the App can record who did what);
- the Merchant's Australia Post account number and API credentials (stored encrypted);
- the Merchant's sender address;
- support correspondence.
Photos you upload (the warehouse-sheet import, on plans that include it): the photos are sent to our AI provider (section 5) to read the order numbers, satchel barcodes and weights written on the sheet. The App keeps what was read (order numbers, barcodes and weights), not the photos.
We don't collect payment card details; Shopify bills the App's fees. We don't use the Merchant's customers' information for marketing, profiling or advertising, and we never sell it or share it for those purposes.
3. How we use it
- Running the App: to quote shipping at checkout, create and print labels, lodge manifests, create return labels, record satchels, add tracking to the Merchant's orders, and alert the Merchant when an order needs attention.
- Accounts and billing: to know which stores use the App, which plan they are on, and to provide support.
- Keeping the App secure and working: detecting errors, abuse and security incidents. The App's logs are designed to contain no customer names, addresses, emails or phone numbers.
4. Where it's stored, and for how long
Where: each store's database and files are stored with Cloudflare in its Oceania region. The list of installed stores (store domain, owner's email, App plan), the access token each store grants the App, and short-lived caches are kept in Cloudflare's key-value store, on its global network.
How long:
What How long Label PDFs (they show the recipient's name and address) Deleted 180 days after they're made Print sheets (copies of labels, for printing) Deleted after 30 days Manifest summaries (Australia Post lodgement and billing records) Deleted 180 days after they're made Shipment records (order number, items, weights, tracking numbers, destination suburb/state/postcode) While the App is installed The App's activity log (who did what, by order number) 180 days Checkout quote log (destination postcode, weight, price; no names) 90 days Database backups 12 weeks Australia Post credentials Until the Merchant changes them or uninstalls the App When the Merchant uninstalls the App, Shopify notifies us 48 hours later. We then delete that store's data and files within 30 days. Backups roll off within 12 weeks.
5. Who we share it with
Only these service providers, and only as the App needs:
| Provider | What they do | What they receive |
|---|---|---|
| Australia Post (Australia) | Carries the parcels; creates labels, manifests and tracking | Recipient name, address, phone and email; parcel and customs details |
| Shopify (Canada/US) | The platform the App runs on | Tracking numbers and fulfilment updates written back to the Merchant's orders |
| Cloudflare, Inc. (US; databases and files stored in Oceania) | Hosting, database and file storage | Everything the App stores |
| Anthropic, PBC (US) | Reads photos of warehouse sheets (only on plans with the sheet import) | The photos the Merchant uploads. Under Anthropic's commercial terms the photos are not used to train its models |
| Nitrosend Pty Ltd (Australia; data processed in the US) | Sends the App's operational emails to the Merchant | The Merchant's alert email address, order numbers and short descriptions of what needs attention; no customer contact details |
- Legal requests: we may disclose information when the law requires it, for example to a court or regulator.
- Business transfers: if our business is sold or restructured, this policy continues to apply to the information transferred.
- Overseas providers: some providers are outside Australia. We take reasonable steps so that they protect the information consistently with the Australian Privacy Principles.
6. Security
- Encryption: everything is encrypted in transit (TLS) and at rest. Australia Post credentials are also sealed with AES-GCM using a key held separately from the database.
- Checked requests: requests from Shopify are verified (signed session tokens and webhook signatures).
- Links to labels are signed and expire after 30 minutes.
- Access: only our developer can reach the App's infrastructure, with two-factor authentication. Access and changes are logged.
- Separate test and live data: testing uses Australia Post's test environment and Shopify development stores, never live customer data.
- Incident response: we keep a written policy. If a data breach is likely to cause serious harm, we notify the affected Merchants, the Office of the Australian Information Commissioner (OAIC) and affected individuals as the Privacy Act 1988 requires.
7. Cookies
The App runs inside the Shopify admin. It doesn't use advertising or analytics cookies, and it doesn't track the Merchant's customers on the storefront.
8. Access, correction and deletion
- Customers of a Merchant should ask the Merchant. When a customer asks Shopify for their data,
or to erase it, Shopify passes the request to us:
- for a data request, we send the Merchant what the App holds for those orders;
- for an erasure request, we delete that customer's label files and the destination details stored with their shipments, automatically and normally within minutes.
- Merchants can ask us at [email protected] for a copy of their information, or to correct or delete it.
9. Complaints and contact
- Contact: Nicolas Gabriel Laurent Vibert, NSW 2500, Australia. Email: [email protected].
- Complaints: we reply within 30 days. If you're not satisfied, you can complain to the OAIC at www.oaic.gov.au.
10. Changes
We may update this policy. The current version is always at synckony.com/ezoz/privacy. We'll tell Merchants in the App before a change that affects how we handle their customers' information.