Privacy Policy

Pobo automates hyperlocal delivery for Shopify stores in India through two connected apps — Pobo Pod, the storefront experience your customers use to order, choose a delivery time slot and track their rider, and Pobo Panel, the merchant dashboard used to dispatch orders across carriers such as Porter, Borzo and Shadowfax. This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and the choices and rights you have. It applies when you install or use the App in connection with your Shopify-supported store, and to shoppers who interact with Pobo Pod on a merchant’s storefront.

This policy is provided by Pobo E-Commerce Suite Private Limited (“Pobo”, “we”, “us”) and is intended to be read together with our Terms of Service and Refund Policy.

Information We Collect

Merchant & store data (via Shopify)

When you install the App, we access certain information from your Shopify account using the permission scopes below. Each scope maps to a specific delivery-automation function:

• read_products — product details (title, price, weight, collections) used for planning, prep time and rate calculation.
• read_themes / write_themes — detect app-block support and, where app blocks are unavailable, add the storefront code Pobo Pod needs.
• read_customers — retrieve the customer’s delivery address for serviceability and dispatch.
• read_orders / read_all_orders — read orders placed through your store (including those older than 60 days) to schedule and fulfil deliveries.
• write_orders / write_order_edits — create and edit orders, e.g. to attach delivery-slot or tracking metadata.
• read_locations — read your store locations, which serve as the pickup source of truth.
• read_merchant_managed_fulfillment_orders — read fulfillment orders for merchant-managed locations.
• read_shipping / write_shipping — read and register carrier services so live rates appear at checkout.

Information you provide as a merchant

• Carrier API credentials (e.g. Porter, Borzo, Shadowfax, Delhivery) you enter to enable delivery services.
• A Google Maps API key, where you choose to use your own instead of Pobo’s shared key.
• Your contact details, business name and store location, used to evaluate shipping rates and to communicate with you.
• Identity-verification (KYC) information — where required, government-issued identity documents you submit to verify your business before dispatch is enabled.

Customer (end-shopper) information via Pobo Pod

When a shopper uses Pobo Pod on your storefront, we process the information needed to deliver their order:

• Name, phone number and delivery address.
• A precise map location (delivery pin / geolocation) when the shopper drops a pin using Pobo Cart Map, used to compute accurate hyperlocal rates and guide the rider.
• The chosen delivery date and time slot, and order contents.
• The phone number used for Pobo Pod’s verified login, and one-time passwords (OTPs) sent to authenticate it.

Automatically collected technical data

• Cookies — data files placed on your device, often with an anonymous identifier. Learn more at allaboutcookies.org.
• Log files — actions on the service, including IP address, browser type, ISP, referring/exit pages, and date/time stamps.
• Web beacons, tags and pixels — electronic files used to understand how the service is used.

How We Use Your Information

We use the information we collect to:

• Provide, operate and maintain Pobo Pod and Pobo Panel and the delivery-automation service.
• Compare live carrier rates, check serviceability by distance, and book and track deliveries.
• Send transactional order updates to shoppers by SMS and WhatsApp (e.g. order placed, rider assigned, out for delivery).
• Authenticate Pobo Pod logins via OTP and secure merchant access.
• Verify merchant identity (KYC) where required, and meter usage for billing.
• Communicate with you, provide support, and improve and secure the App.

How We Share Your Information

We share personal information only as needed to run the service:

• Delivery carriers (Porter, Borzo, Shadowfax and other integrated partners) receive the customer name, phone number, pickup and delivery address and order details required to complete a delivery.
• Google Maps Platform processes address and geocoding requests for address collection, mapping and serviceability.
• Messaging providers deliver OTPs and SMS/WhatsApp order notifications.
• Payment providers (e.g. PhonePe for Pobo Credits, and Shopify for subscription billing) process payments; card details are handled by the provider, not stored by Pobo.
• Shopify, which hosts the platform your store runs on.
• Legal & safety — to comply with applicable law, respond to lawful requests (such as a subpoena or warrant), or protect our rights and users.

We do not sell your personal information or your customers’ personal information.

Identity Verification (KYC)

Where a merchant must complete identity verification before dispatch is enabled, any documents you submit are reviewed manually by our team and handled in line with India’s Digital Personal Data Protection Act, 2023. We collect only what is needed to confirm your identity, restrict access to authorised staff, and retain these documents only as long as necessary for verification and our legal obligations.

Data Retention

We retain order, settings and account information for as long as your store uses Pobo and as needed to provide the service, comply with our legal obligations, resolve disputes and enforce our agreements. You may ask us to delete information we hold about you, subject to those obligations.

Your Rights

If you are an Indian resident, you have the right to access the personal information we hold about you and to ask that it be corrected, updated or deleted, consistent with the Digital Personal Data Protection Act, 2023. To exercise these rights, contact us using the details below. Shoppers should note that the merchant whose store they ordered from is also a controller of their order data.

Security

We use reasonable technical and organisational measures to protect personal information, including access controls, encryption of data in transit, and IAM-based database authentication on our infrastructure. No method of transmission or storage is completely secure, but we work to protect your information and to respond promptly to any incident.

Changes

We may update this Privacy Policy from time to time to reflect changes to our practices or for operational, legal or regulatory reasons. The latest version will always be available on this page.