TEDARILOG

Privacy Policy

Tedarilog is a logistics platform that handles order fulfilment and shipping for e-commerce merchants. This page explains what personal data we process, why we process it, who we share it with and how long we keep it.

1. Data controller

2. What we process

When a merchant connects a store, we import its unfulfilled and non-cancelled orders. The fields we process:

Data	Why it is required
Recipient name	Printed on the shipping label; the courier identifies the recipient with it.
Phone number	The courier calls before delivery; shipment status notifications are sent to it.
Address (province, district, street address)	A shipment cannot be created without it. Province and district also determine the shipping fee.
Email	Matching the order to the right customer and notifications when needed.
Order total and line items	Cash-on-delivery collection, merchant settlement and invoicing.

We do not process payment card data. Cash-on-delivery is collected by the carrier; we only receive the amount collected.

3. Who we share it with

• Carrier (Sürat Kargo): recipient name, phone and address, limited to the fields required to create the shipment.
• SMS provider: the recipient's phone number and message text when a shipment notification is sent.
• Shopify: we write the fulfilment and tracking number back to the merchant's store once the order ships.
• Label rendering service (Labelary): the carrier returns the shipping label as printer commands, which must be converted into a viewable image before the label can be shown and printed. The details printed on the label (recipient name, address, phone) are sent to that service for the conversion. The converted label is stored on our side, so the same label is never sent twice.

We never sell personal data and never share it for marketing purposes.

4. Retention

Each order carries shipping charges, collection and settlement records, which are commercial records subject to statutory retention. On a deletion request the personally identifying fields (name, phone, email, street address) are erased while the commercial record is retained as amounts only.

5. Access and deletion requests

A customer may request deletion of their data or a copy of the data we hold. Requests can be made through the merchant or directly to tedarify@gmail.com.

We handle Shopify's mandatory compliance webhooks (customers/data_request, customers/redact, shop/redact) automatically: when a store uninstalls the app, the personal data belonging to that store is erased.

6. Security

• All traffic is encrypted over HTTPS/TLS.
• The database resides on a cloud disk protected by disk-level encryption.
• Backups are encrypted with a public key and kept off-server; the decryption key is not stored on the server.
• The panel is role-based: a merchant user only ever sees their own company's data.
• Panel access to records containing personal data is logged with user, timestamp and IP address.
• Tests never run against live data; a separate, ephemeral database is used.
• We maintain a written security incident response policy: affected merchants are notified without undue delay and within 48 hours at the latest.

7. Merchant agreement

For merchants using the platform, the roles, sub-processors and security commitments are set out in the Merchant Agreement and Data Processing Addendum, which merchants accept when creating an account.

8. Package preparation video

While orders are packed in our warehouse, the packing process is recorded on video. The recording has no audio and the frame is limited to the packing surface. It can be viewed by the merchant, the merchant's staff, our warehouse team and the customer (only through their own tracking link). Recordings are kept for 14 days after delivery, 7 days after a return, and at most 30 days if neither happens; after that they are permanently deleted. Details (in Turkish): Paket Kaydı Aydınlatma Metni.

9. Changes

If this policy changes, the date above changes with it. We notify merchants separately about material changes.