Nova Poshta Connect privacy policy
Last updated
21 October 2026
In short
- Nova Poshta Connect reads the recipient’s name, phone and delivery address from an order to create a Nova Poshta shipment.
- We pass these details to Nova Poshta and keep them while the app is installed.
- The delivery form on the storefront saves the city and branch to the cart, not the buyer’s name or phone.
- On a deletion request through Shopify we delete the buyer’s or the shop’s data within 30 days.
Who we are
Nova Poshta Connect is an app for Shopify stores that ship with Nova Poshta. It is developed and supported by Base X Tech Ltd, 27 Old Gloucester Street, London WC1N 3AX, United Kingdom. This policy explains what data Nova Poshta Connect processes when a merchant installs it in their store.
Buyers’ data belongs to the store: the merchant decides why it is collected, and we process it on the merchant’s behalf to run the app.
The policy of the basetechgroup.com website is a separate document: Website privacy policy.
What Nova Poshta Connect receives from Shopify
At installation the merchant gives the app access to orders, draft orders, fulfillments, shipping settings, delivery customizations and products. Through Shopify’s APIs the app reads:
- the order number, items, totals and the delivery details the buyer chose on the storefront
- the order’s shipping address: the recipient’s first and last name, phone, country, city and address
- the order’s email address: the app receives it with the order but does not store or use it
- the shop address (
*.myshopify.com) and the shop’s contact email at installation - the access token Shopify issues to the app at installation
- the state of the app subscription (plan)
We need this data to create Nova Poshta waybills, mark orders as fulfilled with the tracking number, print labels and, if the merchant connects Checkbox, issue fiscal receipts.
What we store
- Shop data: the shop address, access token, plan and app settings
- Sender details the merchant enters: sender name, phone and address
- The merchant’s Nova Poshta API key and, if connected, Checkbox credentials, both encrypted
- Shipments: the recipient’s name, phone, city and delivery address, waybill number, order number, costs, cash-on-delivery amount and delivery statuses
- Fiscal receipts, if Checkbox is connected: order, waybill number, amount and receipt link
- Server logs: app events and requests, which can include the recipient’s name and phone
Usage statistics (shop ID, shop address, plan, errors) go to Google Analytics. They contain no buyer data.
On the storefront
| What | How it works |
|---|---|
| Delivery form | The buyer chooses the delivery method, city, Nova Poshta branch or parcel locker, or street, house and apartment, and can add a comment. The form does not ask for a name, phone or email. |
| Cart attributes | The choice is saved in the cart in service fields starting with np__. The comment is saved as the cart note. This data is stored in Shopify, passed to checkout and visible to the merchant on the order and to other apps you have given access to. |
| Requests to us | City, branch and street search goes through Shopify’s app proxy (/apps/np-connect) to our server and on to Nova Poshta. Only the search text and the chosen city are sent. |
| Browser storage | The form keeps the buyer’s entries in the browser’s local storage (npConnectForm) so they are not lost between pages. It is not sent anywhere and is not used for advertising or analytics. The app sets no cookies. |
How we use data
Only to provide the Nova Poshta Connect service: show delivery options on the storefront, create, track and cancel Nova Poshta shipments, print labels, issue fiscal receipts if the merchant connects Checkbox, give access by subscription, answer support requests and fix failures. We do not sell data, use it for advertising or build buyer profiles.
Where data is processed
Base X Tech Ltd is based in the United Kingdom. The app’s server, its database and the server logs run on Amazon Web Services in Frankfurt, Germany. The app’s admin interface runs on Heroku in the EU region. Shipment data goes to Nova Poshta in Ukraine.
How long we keep data
| Data | How long |
|---|---|
| Shop data, settings, sender details, API keys | While the app is installed; after uninstall, until Shopify’s deletion request, then deleted within 30 days (see below) |
| Shipments with recipient details | While the app is installed, so the merchant can track shipments and reprint labels; deleted within 30 days of a deletion request for that buyer or for the shop |
| Access token | App sessions are deleted immediately on uninstall; the token in our database is deleted with the shop’s data |
| Server logs | 30 days |
| Cached sender details from Nova Poshta | 7 days |
npConnectForm | Until the buyer clears the site’s data in the browser |
What happens after uninstall
When a merchant uninstalls Nova Poshta Connect, the app stops working with the store at once: we delete the app sessions and mark the shop as inactive. About 48 hours later Shopify sends a request to delete the shop’s data (shop/redact), and within 30 days we delete everything related to the shop: shop data, settings, sender details, API keys, shipments with recipient details and fiscal receipts.
Waybills already created stay with Nova Poshta under its rules. Cart attributes and notes stay on past orders in Shopify; the merchant can manage them in the Shopify admin.
Requests about buyer data
Nova Poshta Connect is subscribed to Shopify’s mandatory personal-data requests. Our team handles each request and completes it within 30 days:
customers/data_request: we send the merchant the shipment records we hold for that buyercustomers/redact: we delete that buyer’s shipment records: name, phone and addressshop/redact: we delete all of the shop’s data, as described above
Shopify sends the first two when a buyer contacts the store about their data.
Your rights
A merchant can ask for a copy of their shop’s data, its correction or deletion: email support@basetechgroup.com from an address linked to the store and include the *.myshopify.com address.
For buyers: Nova Poshta Connect holds your name, phone and delivery address only as part of the store’s orders. To get a copy or ask for deletion, contact the store; Shopify then sends us the request. You can also write to us at the address below. If you believe we have violated your rights, you can contact the data protection authority in your country.
Security
Connections to Shopify and Nova Poshta are encrypted (HTTPS). Every request from Shopify to the app is checked by its signature; requests without a valid signature are rejected. The Nova Poshta API key and Checkbox credentials are stored encrypted. No payment card data passes through Nova Poshta Connect.
Changes to this policy
If we change what data Nova Poshta Connect processes, we will update this page and the date at the top.
Contact
Base X Tech Ltd
27 Old Gloucester Street, London WC1N 3AX, United Kingdom
support@basetechgroup.com
Last updated
21 October 2026