RC B2B Subscriptions Privacy Policy

1. Introduction & Overview

Royal Cyber Inc. (“Royal Cyber”, “we”, “our”, or “us”) is committed to protecting the privacy and security of your business and personal data. This Privacy Policy governs the RC B2B Subscriptions application (“the App”), designed for merchants on the Shopify platform to automate recurring orders, subscription schedules, and draft order creation for B2B company locations.

By installing or using RC B2B Subscriptions, you agree to the collection and use of information in accordance with this policy. This policy adheres to the guidelines of the Shopify Partner Program Agreement, the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA), and applicable global data protection regulations.

2. Information We Collect

To deliver automated wholesale subscription management, draft order generation, and customer account portal services, the App accesses and processes specific data provided via Shopify APIs:

3. How We Use Collected Information

We process the collected data strictly for the following business purposes:

• Draft Order Automation: Generating recurring B2B draft orders adhering to company catalogs and payment terms at specified intervals.
• Customer Account Management: Empowering wholesale buyers to review upcoming recurring orders and manage frequencies within their Shopify Customer Account.
• Cycle Reconciliation & Audit: Maintaining an accurate ledger of scheduled, invoiced, and completed billing cycles to prevent duplicate orders or missed shipments.
• Service Reliability & Security: Detecting and mitigating rate limiting, API errors, and service interruptions.

4. Data Sharing and Subprocessors

We do not sell, rent, or trade merchant or customer data. We share information only with trusted cloud infrastructure providers (subprocessors) necessary to host and deliver the service:

• Shopify Inc.: App platform and API provider.
• Vercel Inc.: Secure application server and hosting infrastructure (US / Global Edge).
• Cloud Database Providers (PostgreSQL): Encrypted database storage for subscription schedules and audit logs.

5. Data Retention & Mandatory Shopify Privacy Webhooks

We retain data only as long as necessary to maintain active subscriptions for your store. When you uninstall RC B2B Subscriptions, your store data is marked inactive and scheduled for permanent deletion.

We fully support and comply with Shopify’s mandatory GDPR/privacy webhooks:

• customers/data_request: Upon receiving a customer data request forwarded by Shopify, we verify and export any associated records within 30 days.
• customers/redact: Upon receiving a customer redaction request, we permanently erase or anonymize all personal data associated with the requested customer identifier.
• shop/redact: 48 hours after app uninstallation, upon receiving the shop redact webhook, we permanently delete all shop database records, subscription contracts, and audit histories.

6. Security Measures

Royal Cyber implements industry-standard technical and organizational security controls to safeguard data:

• Encryption in Transit: All communication between Shopify, our servers, and clients is encrypted using TLS 1.3 / HTTPS.
• Encryption at Rest: Database records and backups are encrypted at rest using AES-256 standard encryption.
• Strict Authentication: All API requests are authenticated using cryptographic HMAC signatures (Shopify App Proxy) and short-lived Shopify Admin Session Tokens.

7. Your Rights (GDPR & CCPA/CPRA)

Depending on your jurisdiction, merchants and buyers have the following data rights:

• Right of access to the personal information we hold about you.
• Right to request rectification or correction of inaccurate data.
• Right to request erasure (right to be forgotten).
• Right to data portability in a structured, commonly used format.
• Right to withdraw consent at any time without affecting lawful prior processing.

8. Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or our data protection practices, please contact our Data Protection and Security Team: