Privacy Policy

This Privacy Policy explains how Enegotz Technologies Pty Ltd (“unboxx.app”, “we”, “us”) collects, uses, and shares personal information when you use the unboxx.app Shopify application (the “App”), visit https://unboxx.app (the “Site”), or interact with a gifting link powered by unboxx.app. If you do not agree with this policy, please do not use the App or the Site.

1. Information we collect

From merchants

When you install the App on your Shopify store, we receive information through Shopify’s APIs as authorized during installation: your store name and domain, contact details, product catalog, and the order data needed to create and manage draft orders. Billing is handled by Shopify; we do not receive your payment card details.

From creators

When a creator submits a gifting link, we collect the information they provide: name, email address, shipping address, social media handles, and product selections. We may also associate publicly available profile information (such as follower counts, engagement rates, and content niche) with a creator’s record.

Public creator data

Our creator discovery features index publicly available information from social media platforms, such as usernames, follower counts, and engagement metrics. We do not collect private audience data.

From website visitors

We collect usage data on the Site through cookies and similar technologies (see our Cookie Policy), and scheduling information if you book a demo through our scheduling provider, Calendly.

2. How we use information

• To provide the App: create draft orders, maintain your creator CRM, track content and sales attribution, and power creator discovery.
• To operate integrations you enable, such as Klaviyo events and webhooks.
• To provide support, respond to inquiries, and schedule demos.
• To improve, secure, and monitor the App and the Site.
• To send service communications, and marketing communications where permitted (you can opt out at any time).

3. Legal bases (GDPR)

Where the GDPR applies, we process personal information to perform our contract with you, for our legitimate interests in operating and improving the service, to comply with legal obligations, and with your consent where required (for example, certain cookies and marketing).

4. How we share information

• Shopify — order, product, and customer data flows between the App and your store to deliver the service.
• Integrations you enable — such as Klaviyo, which receives the events you configure.
• Service providers — hosting, analytics, scheduling, and support tools that process data on our behalf under contract.
• Legal — where required to comply with law or protect our rights.
• Business transfers — as part of a merger, acquisition, or asset sale, subject to this policy.

We do not sell personal information.

5. Shopify data requests

We honor Shopify’s mandatory privacy webhooks. When a merchant or their customer exercises data rights through Shopify (data access requests, customer data erasure, or store data erasure after uninstall), we respond in line with Shopify’s requirements and applicable law.

6. Retention

We keep personal information for as long as needed to provide the service and for legitimate business or legal purposes. Store data is deleted following uninstall in accordance with Shopify’s data erasure timelines. Creator records are retained while the associated merchant account is active, or until deletion is requested.

7. Security

We use administrative, technical, and organizational safeguards appropriate to the risk, including encryption in transit and access controls. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

8. International transfers

We may process information in countries other than where you live. Where required, we use appropriate safeguards for cross-border transfers, such as standard contractual clauses.

9. Your rights

Depending on where you live, you may have rights to access, correct, delete, restrict, or port your personal information, and to object to certain processing. Residents of the EEA/UK can also lodge a complaint with their supervisory authority; California residents have rights under the CCPA/CPRA. To exercise any right, contact us at support@unboxx.app. Creators can also contact the merchant who invited them, who acts as the controller of their campaign data.

10. Children

The App and the Site are not directed to children under 16, and we do not knowingly collect their personal information.

11. Changes to this policy

We may update this policy from time to time. We will post the updated version here and revise the “Last updated” date; material changes will be communicated to merchants directly.

12. Contact us

Questions about privacy? Email us at support@unboxx.app.