Privacy Policy

Last updated: February 16, 2026

Drivvo ("we", "our", "us") is a Shopify application that automates digital product delivery via Google Drive. This privacy policy explains how we collect, use, and protect your information when you use our application.

1. Information We Collect

From Shopify (via API)

• Order data: Order ID, order name, customer email, line items, financial status, and tags.
• Product data: Product ID, title, and handle (to map products to Drive files).
• Shop data: Shop domain (used as the account identifier).

From Google (via OAuth)

• Google account email and OAuth tokens (encrypted at rest) to access Google Drive on your behalf.
• Drive file metadata: File IDs and names selected by you for product mapping.

From You Directly

• Service Account JSON keys (encrypted at rest) if you choose to upload custom service accounts.
• Klaviyo API key (encrypted at rest) if you enable the Klaviyo integration.
• Configuration preferences: Order note templates, tag names, and processing settings.

2. How We Use Your Information

• Share Google Drive files with your customers when they purchase digital products.
• Automatically fulfill orders and add delivery notes/tags in Shopify.
• Send delivery notifications via Klaviyo (if enabled by you).
• Track daily usage to enforce plan limits.
• Display order processing history within the app.

3. Data Storage and Security

• All sensitive credentials (OAuth tokens, service account keys, API keys) are encrypted at rest using AES encryption.
• Data is stored in a secure database accessible only by the application.
• We do not sell, share, or transfer your data to third parties, except as required to provide the service (Google Drive API, Shopify API, Klaviyo API).
• Access to your Google Drive is limited to files you explicitly select via Google Picker, plus folders the app creates itself (a root folder and per-order folders) — the app cannot access any pre-existing file or folder you haven't picked.

4. Data Retention

• Your data is retained while the app is installed on your store.
• When you uninstall the app, all associated data (orders, product mappings, service accounts, settings, and Google connection) is permanently deleted within 48 hours.
• Customer data deletion requests (GDPR) are processed within 30 days.

5. Your Rights (GDPR / CCPA)

You and your customers have the right to:

• Access the personal data we store.
• Request correction of inaccurate data.
• Request deletion of personal data.
• Export your data in a machine-readable format.

To exercise these rights, contact us at the email below. We respond to all requests within 30 days.

6. Third-Party Services

Drivvo integrates with the following services, each with their own privacy policies:

• Google (Drive API, OAuth)
• Shopify (Admin API, Billing API)
• Klaviyo (Events API) — only if you enable this integration

7. Changes to This Policy

We may update this privacy policy from time to time. Changes will be reflected on this page with an updated "Last updated" date.

8. Contact

If you have questions about this privacy policy or how we handle your data, contact us at: drivvoapp.support@gmail.com