Privacy Policy

Last updated: 21 September 2026

TariffAware is provided by Dextaroo Ltd ("Dextaroo", "we", "us" or "our"). This Privacy Policy explains how information is processed when Shopify merchants install or use TariffAware and when the app processes order-related information on behalf of those merchants.

1. Who we are

TariffAware — Duties & Tariff Protection is developed and operated by Dextaroo Ltd, United Kingdom.

Privacy enquiries can be sent to dextaroo.ltd@gmail.com.

2. Our role

For information relating to merchant accounts, administration, security and operation of the TariffAware service, Dextaroo acts as a data controller.

Where TariffAware processes buyer or order information from a merchant's Shopify store in order to provide acknowledgement and evidence services, Dextaroo generally acts as a processor or service provider on behalf of that merchant. The merchant remains responsible for determining the appropriate lawful basis for its processing of customer information.

3. Information TariffAware processes

Merchant and administrator information may include:

• Shopify shop domain and shop identifiers.
• Shopify administrator or user identifiers.
• Name, email address and locale where Shopify supplies these as part of an authenticated app session.
• Authentication, session, access-scope and token information required to operate the app securely.
• TariffAware settings, setup status and published notice versions.
• Information supplied when contacting us for support.

Order and acknowledgement information may include:

• Shopify order ID and order number.
• Cart and checkout references.
• Delivery country.
• Customer acknowledgement date and time.
• The version and exact wording of the notice shown to the customer.
• TariffAware evidence identifiers and cryptographic hashes.
• Order financial snapshots, including amounts, currency, duties, taxes, shipping charges and quantities where supplied by Shopify.
• Privacy request references, requested order references and fulfilment status so we can respond to authenticated data requests.

Technical information may also be processed for security and reliability, including application events, errors, timestamps and standard network metadata.

4. How we use information

We process information to:

• Authenticate merchants and operate TariffAware.
• Display merchant-configured tariff and import-fee notices.
• Record and verify customer acknowledgement.
• Apply checkout acknowledgement rules.
• Link evidence records to completed Shopify orders.
• Generate merchant evidence records and PDF reports.
• Maintain security, diagnose errors and prevent misuse.
• Provide support and respond to privacy or legal requests.
• Comply with Shopify requirements and applicable law.

We do not sell personal information. We do not use TariffAware evidence information for behavioural advertising or customer profiling.

When automatic translation is used, merchant-entered notice wording is sent to Amazon Translate to generate local-language notices. TariffAware does not send customer evidence or order financial snapshots to Translate.

5. Lawful bases

Where Dextaroo acts as controller, processing is generally necessary to perform our agreement with the merchant, to pursue legitimate interests in operating and securing TariffAware, or to comply with legal obligations.

Where Dextaroo processes buyer or order data as a processor or service provider, processing is performed on the merchant's instructions for the purpose of providing TariffAware. The merchant is responsible for its lawful basis and its own privacy disclosures to customers.

6. Who information may be shared with

Information may be processed by or disclosed to:

• Shopify, as the commerce platform through which the app is installed, authenticated and operated.
• Amazon Web Services (AWS), which provides TariffAware's hosting, database, encrypted secrets, logging, monitoring and backup infrastructure.
• Authorised Dextaroo personnel and professional advisers where access is necessary for support, security, compliance or legal purposes.
• Public authorities where disclosure is required by law.

Shopify handles app billing. TariffAware does not store merchants' payment-card information.

7. Data location and international transfers

TariffAware's primary application and PostgreSQL database infrastructure is hosted by AWS in the London region (eu-west-2), United Kingdom.

Shopify and other service providers may operate internationally. Where personal information is transferred internationally, we rely on applicable contractual, organisational and legal safeguards provided by the relevant service provider and required by applicable law.

8. Retention

TariffAware currently applies the following retention approach:

• Temporary checkout-destination state is deleted after approximately 72 hours, or sooner when it is no longer required.
• Acknowledgement evidence that never becomes linked to a completed order is deleted after approximately 7 days.
• Evidence linked to completed orders is retained while required to provide the merchant's evidence service, subject to valid deletion or redaction requests and applicable legal obligations.
• Merchant sessions, settings and shop-specific records are deleted when required following uninstall or a valid Shopify shop-redaction request, unless retention is legally required.
• Application logs are generally retained for up to 90 days.
• Automated production database backups are currently retained for 7 days. Controlled recovery snapshots may be retained for disaster-recovery purposes until they are no longer required.

Backup systems may retain copies of deleted information until the applicable backup or recovery lifecycle expires.

9. Security

We use technical and organisational safeguards appropriate to the nature of the service. These currently include HTTPS/TLS encryption in transit, encrypted database storage, private database networking, access controls, least-privilege production permissions, managed secrets, monitoring and database backups.

No online system can be guaranteed to be completely secure, but we regularly review the controls used to protect TariffAware.

10. Cookies and local storage

TariffAware uses authentication, session and technical storage necessary to operate the Shopify embedded app and secure merchant sessions. We do not use TariffAware customer evidence for advertising cookies or behavioural advertising.

11. Automated processing

TariffAware automatically checks information such as the destination country and whether the required acknowledgement is present in order to apply the merchant's checkout protection rule.

TariffAware does not use this information to profile customers or make automated decisions about credit, pricing, insurance, employment or similar matters.

12. Privacy requests and your rights

Depending on applicable law, individuals may have rights to request access, correction, deletion or restriction of personal information, to object to certain processing, or to request portability of information.

If you are a shopper, the Shopify merchant from whom you purchased is normally the best first contact for questions about your order or personal information. Dextaroo assists merchants and Shopify with valid privacy requests relating to information processed by TariffAware.

TariffAware supports Shopify's required privacy-request mechanisms, including customer data requests, customer redaction requests and shop redaction requests.

Privacy requests concerning Dextaroo can also be sent to dextaroo.ltd@gmail.com.

Individuals in the United Kingdom also have the right to raise concerns with the Information Commissioner's Office (ICO): ico.org.uk.

13. Changes to this policy

We may update this Privacy Policy as TariffAware changes or as legal and regulatory requirements develop. The current version will always be published at this URL and the "Last updated" date will be revised when material changes are made.

14. Contact

Dextaroo Ltd
United Kingdom
Email: dextaroo.ltd@gmail.com