Your rights, our obligations, and how we handle data on your behalf as a Shopify merchant.
Last updated: 28 June 2026
By installing or using the Tattva Fulfilment Portal Shopify app, you ("the Merchant") agree to these Terms of Service and the Data Processing Agreement set out below.
Tattva Fulfilment Portal provides a web and mobile application that allows merchant staff to manage in-store and fulfilment-centre pickup orders synced from a Shopify store. Features include: order management, inventory snapshots, dispatch creation, and QR-based order confirmation.
The App is provided on a best-effort basis. We aim for high availability but do not guarantee uninterrupted service. Planned maintenance will be announced where possible.
The App and its source code remain the property of the operator. Your order and product data remains your property at all times.
To the maximum extent permitted by law, the operator's liability for any claim arising from use of the App is limited to the fees paid by you in the preceding 12 months. The operator is not liable for indirect, incidental, or consequential losses.
Either party may terminate this agreement at any time by uninstalling the App. Upon termination, your data will be deleted within 30 days per the Data Processing Agreement below.
These terms are governed by the laws of India. Disputes shall be subject to the exclusive jurisdiction of the courts of Bangalore, Karnataka.
This DPA forms part of the Terms of Service and sets out the obligations of Dinesh Kashikar ("Processor") when processing personal data on behalf of the Merchant ("Controller"). It is intended to meet the requirements of GDPR Article 28 and equivalent regulations.
The Processor processes personal data as described below, for the duration of the Merchant's use of the App, on the Merchant's documented instructions.
| Subject matter | Detail |
|---|---|
| Nature | Storage, retrieval, and display of order data to authorised staff |
| Purpose | Fulfilment-centre pickup order management |
| Types of personal data | Customer name, customer email, order number, order line items (product, SKU, quantity) |
| Categories of data subjects | The Merchant's customers who have placed pickup orders |
| Duration | For as long as the App is installed; deleted within 30 days of uninstall |
The Processor will:
| Measure | Implementation |
|---|---|
| Encryption in transit | TLS 1.3 enforced by Cloudflare Workers on all API endpoints |
| Encryption at rest | Cloudflare D1 — AES-256 at rest; backups encrypted by Cloudflare |
| Access control | OTP-only staff authentication; role-based access enforced at API level (staff see only their assigned FC's orders) |
| Session management | Short-lived signed JWTs (1-hour expiry); device tokens stored in encrypted device secure storage |
| Audit logging | Every API access logged by Cloudflare Workers (timestamp, endpoint, status, device); retained 30 days |
| Test / production separation | Isolated databases and mock credentials for development; no real customer data in test environments |
| Incident response | 72-hour merchant notification; immediate token rotation; 7-day written report |
The Processor uses the following sub-processors:
| Sub-processor | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | API hosting (Workers), database (D1), web hosting (Pages) | APAC (Singapore) region |
The Merchant will be notified by email at least 14 days before any new sub-processor is added.
Data is stored in Cloudflare's APAC region (Singapore). Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework and provides Standard Contractual Clauses for international data transfers where required.
The Processor will assist the Merchant in fulfilling data subject requests (access, rectification, erasure, portability) within 5 business days of receiving an instruction. Requests should be sent to dinesh@kashikar.net.
For any questions about this DPA or to exercise your rights as a Merchant:
dinesh@kashikar.net