Privacy Policy — AsanShipping

We use the collected information strictly to operate, secure, and improve the AsanShipping platform and fulfill services requested by our merchants:

• Account Provisioning, Authentication & Role Enforcement: Creating merchant stores and staff accounts, verifying identity via email OTP or Google Sign-In, enforcing two-step verification (2FA), managing per-device sessions, and restricting screen/API access based on assigned roles (Admin, Manager, Team_Member).
• Order Validation & Return-Risk Screening: Parsing shipping addresses, mapping destination cities to courier networks, holding duplicate or bulk orders for manual review, and screening incoming COD orders against customer delivery history and risk flags.
• Automated Customer Confirmation (WhatsApp & Voice IVR): Sending interactive WhatsApp confirmation messages and/or placing automated voice confirmation calls within configured Pakistan calling windows so buyers can confirm or cancel COD orders before courier dispatch.
• Multi-Courier Booking, Label Printing & Shipment Tracking: Booking parcels with the merchant's selected or routed courier (Trax, PostEx, Leopards, TCS Envio, M&P), generating barcode shipping labels, polling/receiving tracking updates, and flagging stalled shipments.
• Inventory, Reverse Logistics & Financial Reconciliation: Reserving stock on order creation, releasing stock on cancellation, scanning returned RTO parcels at the warehouse, recording damaged scrap, and reconciling courier COD payouts and overdue remittances.
• Real-Time Notifications: Delivering live order stream updates and mobile push notifications to signed-in merchant devices.
• Storefront Hosting & First-Party Analytics: Rendering hosted online stores, processing storefront checkouts and discount coupons, and providing merchants with aggregated conversion funnels, live city activity, and Core Web Vitals speed metrics.
• Billing, Wallet Metering & Platform Security: Metering WhatsApp message and IVR call credit consumption, processing manual wallet top-up requests, enforcing API rate limits, detecting automated scanner traffic, and maintaining security audit logs.

We do not sell personal data to third parties or share merchant/customer data with third-party advertising networks. We share data only with the service providers, logistics carriers, and merchant-connected platforms necessary to run the Services, as detailed below:

Merchant Developer Webhooks: If a merchant configures custom outbound developer webhooks (/api/v1 / Developer Access), order and fulfillment event payloads for that merchant's store are sent to the HTTPS endpoint URL configured by that merchant.

Legal Compliance & Protection: We may disclose information if required to do so by applicable law, regulation, court order, or valid governmental request, or when necessary to investigate fraud, enforce our Terms of Service, or protect the safety, rights, or property of AsanShipping, our merchants, or the public.

Because AsanShipping powers multi-tenant e-commerce operations, our relationship to personal data depends on whose data is being processed:

• Merchant & Staff Account Data: For merchant owners, administrators, managers, and team members who register and sign into AsanShipping (via web or the Android app), AsanShipping determines how account, authentication, billing, and security records are managed to provide the platform.
• End-Customer (Consignee / Shopper) Order Data: When a merchant syncs orders from Shopify, imports orders via CSV/API, creates manual orders, or receives orders through a hosted storefront, AsanShipping processes the buyer's name, phone number, address, and order details on behalf of that merchant to execute order confirmation, risk screening, courier dispatch, and delivery tracking.
• Merchant Obligations: Merchants are responsible for ensuring that they have provided appropriate privacy notices to their shoppers and obtained any required consents under applicable law before submitting customer phone numbers and addresses to AsanShipping for automated WhatsApp messaging, IVR confirmation calls, and courier fulfillment.
• Shopper Inquiries: If you are an end customer who placed an order with a merchant store and have questions about your order, refund, or a merchant's own store policies, you should contact the merchant directly using the store helpline or email shown on your order confirmation. You may also contact AsanShipping at support@asanshipping.com regarding platform-level privacy inquiries.

We use strictly necessary cookies, browser storage (localStorage and sessionStorage), and secure mobile device storage across our surfaces as follows:

We implement technical and organizational safeguards designed to protect merchant and customer information against unauthorized access, alteration, or loss:

• Encryption of Integration Credentials & 2FA Secrets: Merchant third-party API credentials (Shopify access/refresh tokens and courier API keys, passwords, and tokens) and user TOTP 2FA secrets are encrypted at rest using AES-256-GCM (with legacy AES-256-CBC decryption support) before being written to the database, and are masked when returned to client interfaces.
• Password Hashing & Breached-Password Screening: User passwords are hashed with bcrypt. New and reset passwords must meet complexity requirements and are checked against known compromised password lists using k-anonymity (Have I Been Pwned range queries).
• PKCE Handoff, Lockouts & Session Revocation: Sign-ins through login-auth.asanshipping.com use PKCE and 60-second single-use authorization codes. Accounts are temporarily locked after repeated failed password or 2FA attempts, and every session carries a revocable session ID (sid) and token version counter so password changes immediately invalidate prior sessions.
• Multi-Tenant Scoping & Role-Based Access Control: Tenant operational records are indexed and filtered by tenantId derived from the authenticated session, and backend routes enforce role and screen permissions (read / write).
• Transport Security & Webhook Verification: Traffic across public web, authentication, API, and storefront domains is served over HTTPS/TLS. Inbound Shopify and Meta WhatsApp webhooks are verified using cryptographic HMAC signatures.

While we work continuously to secure our systems and address identified software issues, no method of transmission over the internet or electronic storage can be guaranteed to be completely infallible. We strongly encourage all merchants and staff users to use strong, unique passwords and enable two-step verification (2FA).

We retain personal and operational data only for as long as necessary to provide the Services, comply with legal and accounting obligations, or resolve disputes. Specific code-enforced retention periods and deletion triggers include:

Shopify Uninstall & Redact Webhooks: When a merchant uninstalls the AsanShipping Shopify app (app-uninstalled) or when Shopify sends a shop/redact webhook, our server immediately clears the stored Shopify access token for that store so no further Shopify API calls occur. Merchants or customers requesting full erasure of historical order records may use the self-service deletion tools or contact support as described below.

You have practical controls over your personal and store information both directly inside the product and through our support team:

• Viewing & Updating Account Information: You can view and update your first name, last name, phone number, profile photo, and password at any time in Settings → Your Account on both the Merchant Web Portal and the Asan Shipping Android app. Store Administrators can update business name, store logo, helpline, email, and warehouse address in Settings → Store Details.
• Exporting Operational Data: Merchants can export orders, customer lists, finance settlements, and operational reports from the Merchant Web Portal.
• Withdrawing Device & Notification Permissions: On Android, you can revoke Camera or Notification permissions at any time in your device's system settings. Signing out of the Android app automatically unregisters your phone's Expo push token from our server.
• Managing Customer Communication Modes: Store Administrators can switch order confirmation modes between WHATSAPP_ONLY, IVR_ONLY, IVR_WHATSAPP, and MANUAL, or disable WhatsApp notifications in store settings.
• Submitting Privacy Requests: To request access to, correction of, or deletion of personal data that you cannot update directly in the product, email support@asanshipping.com. To protect account and store security, we verify the requester's identity (for example, by confirming control of the registered email address or store admin credentials) before fulfilling sensitive requests.

Users can permanently delete their AsanShipping account either directly inside the application or from the web without needing the mobile app installed:

AsanShipping is built primarily for e-commerce merchants and domestic courier networks operating in Pakistan (including Trax, PostEx, Leopards Courier, TCS Envio, and M&P Express). However, several of the cloud infrastructure and communication providers we rely on — such as MongoDB Atlas, Vercel, Meta Platforms (WhatsApp Cloud API), Google (OAuth Sign-In), Brevo (SMTP email relay), Expo (push notification delivery), Backblaze B2, and Cloudinary — operate globally distributed servers located outside Pakistan.

By using the Services, you understand that account, store, order, and communication data may be transmitted to and processed on cloud infrastructure located outside your country of residence, subject to the security controls described in Section 7 of this Privacy Policy.

AsanShipping and the Asan Shipping mobile application are business-to-business (B2B) commercial tools designed for e-commerce store owners, warehouse operators, and authorized business personnel. Our Services are not directed to children, and we do not knowingly solicit or collect personal information directly from children.

If you believe that a child has created an account on AsanShipping or submitted personal information to us without appropriate authorization, please contact us at support@asanshipping.com so we can promptly investigate and remove the information.

We may update this Privacy Policy from time to time to reflect new platform features, courier or communication integrations, security improvements, or applicable legal requirements. When we make changes, we will publish the updated policy at https://asanshipping.com/privacy-policy and update the “Effective & Last Updated” date at the top of this page. For material changes that affect registered merchants, we may also provide notice through the Merchant Web Portal, the Android application, or email.