Privacy policy
Effective and last updated: 3 November 2026
Who we are
Section titled “Who we are”Termpact is a Shopify app operated by Saim Tech (“Termpact”, “we”, “us”), a business trading under that name, at 63 E1 Wapda Town, Lahore 54700, Pakistan. Website: termpact.com. Contact for privacy questions and data requests: privacy@termpact.com.
Termpact helps merchants sell wholesale on Shopify B2B: contract pricing, order rules, credit limits, receivables, a buyer portal and an order inbox.
Our two roles
Section titled “Our two roles”- Processor (service provider) for merchants. When a merchant installs Termpact, we process data about the merchant’s business customers and orders on the merchant’s behalf and on their instructions. The merchant is the controller. Our Data processing addendum governs this processing.
- Controller for our own customer relationship. We are the controller for the limited data we need to run our business with merchants: the store’s contact details, billing status received from Shopify, and support conversations.
What we process
Section titled “What we process”| Category | Examples | Source |
|---|---|---|
| Store data | Store domain, name, Shopify plan, currency, time zone, app settings, billing plan and status | Shopify, when you install and use the app |
| Merchant staff | Shopify staff user ID, name and email of staff who use the app, their Termpact role, actions they take (audit log) | Shopify sign-in |
| Business customers (buyers) | Company names, company location names and addresses, contacts’ names and email addresses, payment terms, credit limits, account balances | The merchant’s store (Shopify B2B) and the merchant’s staff |
| Orders and payments | Order numbers, amounts, currencies, due dates, payment status, adjustments | The merchant’s store |
| Documents sent to the order inbox | Purchase orders (PDFs, images, emails) a buyer sends to the merchant, and the order lines extracted from them | The buyer or the merchant, when the order inbox is used |
| Trade applications | Business details, the applicant’s name, email and phone number, and tax-exemption certificates submitted through the merchant’s application form | The applicant |
| Technical data | IP addresses (used for rate limiting and abuse protection; shortened in web server access logs, removed from application logs and error reports), request identifiers, error reports | Our servers |
We do not receive or store payment card details: subscription charges are billed by Shopify.
How we use it
Section titled “How we use it”- To provide the features the merchant has turned on (applying contract prices, checking order rules, tracking credit and receivables, sending statements and reminders, turning inbox documents into draft orders).
- To keep the service secure and working: detecting abuse, investigating errors, measuring performance.
- To bill for the app through Shopify and to support the merchant.
- To meet legal obligations.
We don’t sell personal data, use it for advertising, or build profiles across merchants. One merchant’s data is never shown to another merchant.
AI processing
Section titled “AI processing”When a merchant uses the order inbox, documents are sent to Anthropic (Claude) to read the order lines. We send documents directly in the request (no file storage at Anthropic); Anthropic does not use API data to train its models under its commercial terms. Product catalog text (titles, SKUs, vendors) is sent to Voyage AI to match order lines to products; no buyer personal data is sent for that.
Who we share it with
Section titled “Who we share it with”- Shopify, which hosts the merchant’s store.
- Our subprocessors, only as needed to run the service — see the subprocessor list.
- Systems the merchant connects through the Termpact API or webhooks (for example the merchant’s ERP), only on the merchant’s instruction.
- Authorities, when the law requires it.
- A buyer of our business, under the same commitments, if Termpact is sold.
Where it is stored
Section titled “Where it is stored”Our servers and database run on Amazon Web Services (Amazon Lightsail) in Australia (Sydney). Email is sent and received through Amazon SES in Sydney, where inbound email is kept for up to 7 days. Files (exports, documents) and encrypted database backups are stored at Backblaze in the United States; documents read by AI, error reports and telemetry are processed by the US providers on the subprocessor list. We operate the service from Pakistan, where our personnel access data to run and support it. Transfers from the EU, UK or Switzerland rely on the Standard Contractual Clauses in our Data processing addendum.
How long we keep it
Section titled “How long we keep it”| Data | Kept |
|---|---|
| Store data and everything the merchant’s use of Termpact created | While the app is installed. When the app is uninstalled, Shopify sends a store-deletion request 48 hours later; we then delete the store’s data (normally within minutes, always within 30 days) and keep a record of the deletion that contains no personal data |
| Database backups | 30 days (encrypted), then overwritten |
| Application logs and traces | 14 days |
| Error reports | Up to 30 days |
| Data exports | Download links work for 10 minutes; export files are deleted after 7 days |
| Order inbox documents | 24 months after last use; rejected or quarantined documents after 30 days |
| Tax-exemption certificates | 24 months after last use |
When a merchant receives a customer data request or customer redaction request through Shopify, we provide the customer’s data to the merchant or delete it, as Shopify’s privacy webhooks require. After a redaction, the merchant’s invoices and payments stay in its records with the person’s details removed.
How we protect it
Section titled “How we protect it”- Encryption in transit (TLS) and at rest. Access tokens and personal fields (names, emails, phone numbers, addresses) are additionally encrypted per record with data keys wrapped by a master key held outside the database; email addresses are matched through keyed hashes, not plain text.
- Each store’s data is separated in the database by row-level security, so a query for one store cannot read another’s.
- Staff access inside a store follows the merchant’s roles; every change is recorded in the audit log.
- Application logs and error reports are scrubbed of tokens, emails, IP addresses and postal addresses before they leave our servers; web server access logs keep only shortened IP addresses and no query strings.
Your rights
Section titled “Your rights”If you are a buyer or staff member of a merchant, please contact the merchant first: they control your data in their store and can ask us to access, correct, export or delete it. You can also contact us at privacy@termpact.com and we will pass your request to the merchant or answer it ourselves where we are the controller. Depending on where you live (for example under the GDPR, UK GDPR or US state laws such as the CCPA/CPRA) you may have rights to access, correct, delete, restrict or object to processing, and to complain to your data protection authority.
Children
Section titled “Children”Termpact is a business tool and is not directed to children under 16.
Changes
Section titled “Changes”We will post changes here and, for material changes, notify merchants in the app at least 30 days before they apply.
Contact
Section titled “Contact”Saim Tech, 63 E1 Wapda Town, Lahore 54700, Pakistan — privacy@termpact.com (privacy and data requests), support@termpact.com (everything else) — termpact.com