Terms of Service

Last updated: 2026-10-29

These Terms of Service ("Terms") are an agreement between FOP Mykhailo Barkov, a sole proprietor registered in Ukraine ("we", "us"), and the business that installs Boxly: One Shipping Email ("the App") on a Shopify store ("you", "the merchant"). By installing or using the App you accept these Terms, including the Data Processing Addendum in section 15. If you install the App on behalf of a company, you confirm that you may accept these Terms for it.

1. The service

The App works inside your Shopify admin. When an order ships in several packages, it waits until the order is fully shipped and a waiting period you choose has passed, adds all tracking numbers to one shipment, and asks Shopify to send your customer one shipping update email from your store's notification template. The App does not send email itself. Its features and known limitations are described in the App Store listing and in the App.

The App depends on Shopify's platform and APIs and on the settings of the shipping tools you use. We may change, add or remove features. We do not promise that every order can be consolidated; the App records in its activity log when and why it skipped an order.

2. Your responsibilities

• You are responsible for your store's notification settings and for the settings of your shipping and label tools, including turning off per-package customer notifications where the App's guide asks you to.
• You are responsible for your relationship with your customers, including the notices and legal bases your business needs to process their order data, and for answering their privacy requests (the App helps as described in section 15).
• You keep your Shopify account secure and give access to the App only to staff you trust.

3. Plans and billing

The App offers a Free plan and paid plans (Free, Pro and Business), which differ in how many multi-package orders (orders shipped in two or more packages) the App consolidates per calendar month (UTC). Single-package orders are not counted. Current prices and limits are shown on the App Store listing and on Shopify's plan selection page.

Plans are billed by Shopify through your Shopify invoice, under Shopify's terms. You choose, change or cancel a plan through Shopify. Refunds, taxes and payment disputes are handled by Shopify under its billing rules. When a plan's monthly limit is reached, the App stops handling new multi-package orders until the next month or until you change plan; orders already in progress still finish, and single-package orders are still handled. We may change prices or limits with at least 30 days' notice; changes to a paid plan take effect through Shopify's approval process.

4. Acceptable use

You agree not to:

• use the App in breach of Shopify's terms or applicable law;
• try to access other stores' data, probe or disrupt the App's systems, or bypass its limits;
• reverse engineer the App except where the law allows it;
• resell or sublicense the App.

We may suspend the App for a store that breaks this section or puts the App's security at risk, and will tell you why when we can.

5. Your data

You keep all rights to your store's data. You give us the permission needed to process it to provide the App, as described in the Privacy Policy and the Data Processing Addendum. We do not sell your data or use it for advertising.

6. Our rights

The App, its code and its content belong to us or our licensors. We give you a non-exclusive, non-transferable right to use the App in your Shopify store while these Terms apply.

7. Support and changes to the service

Contact us at boxly.support@gmail.com. We answer on a reasonable-effort basis. We may update the App at any time. If we stop offering the App, we will give at least 30 days' notice where we can.

8. Availability

We aim to keep the App available but do not guarantee uninterrupted operation. Maintenance, Shopify outages, API changes and hosting incidents can delay or prevent consolidation. If the App does not consolidate an order, Shopify's standard notifications and your shipping tools' settings decide what your customer receives.

9. No warranty

The App is provided "as is" and "as available". To the extent the law allows, we disclaim all warranties, express or implied, including merchantability, fitness for a particular purpose and non-infringement.

10. Limitation of liability

To the extent the law allows:

• we are not liable for indirect, incidental, special or consequential damages, or for lost profits, revenue, goodwill or data;
• our total liability for all claims relating to the App is limited to the amount you paid for the App in the 12 months before the event giving rise to the claim, or USD 100 if that amount is lower than USD 100.

Nothing in these Terms limits liability that cannot be limited by law, such as liability for fraud or for death or personal injury caused by negligence.

11. Indemnity

You will compensate us for third-party claims arising from your breach of these Terms or of the law in your use of the App, to the extent the claim is caused by that breach.

12. Term and termination

These Terms apply from installation until you uninstall the App. You can stop using the App at any time by uninstalling it; a paid plan is cancelled through Shopify when you uninstall. We may end these Terms with 30 days' notice, or at once if you materially breach them. On termination, your data is deleted as described in section 15.8 and the Privacy Policy. Sections 9 to 13 survive termination.

13. Governing law

These Terms are governed by the laws of Ukraine, without regard to its conflict-of-law rules. The courts of Ukraine have exclusive jurisdiction, unless the law of your country requires otherwise.

14. Changes to these Terms

We may update these Terms. We will post the new version at this address and update the "Last updated" date. For material changes, we will notify you in the App or by email at least 14 days before they take effect. If you continue to use the App after that, the new Terms apply; if you do not agree, uninstall the App.

15. Data Processing Addendum

This Data Processing Addendum ("DPA") applies when we process personal data on your behalf in providing the App, including under the EU and UK General Data Protection Regulation ("GDPR"), Article 28. If it conflicts with the rest of these Terms, this DPA prevails for personal data.

15.1 Roles

You are the controller of the personal data in your store. We are your processor. Shopify acts under its own agreement with you.

15.2 Subject matter, duration, nature and purpose

• Subject matter: consolidating the tracking information of multi-package orders in your Shopify store.
• Duration: while the App is installed, plus the retention periods in section 15.8.
• Nature: reading order and shipment data through Shopify's API and webhooks, storing a limited record of each order the App handles, updating one shipment per order, and showing you an activity log.
• Purpose: providing the App to you. We process the data only on your documented instructions, which are these Terms, your App settings and your actions in the App, unless the law requires otherwise; we will tell you if we believe an instruction breaks the law.

15.3 Data subjects and categories of data

• Data subjects: your customers whose orders ship through your store.
• Categories of data: order identifiers (order ID and order name such as #1001), shipment identifiers and fulfillment status, tracking numbers, carrier names and tracking URLs, and the time a shipping email was sent.
• Not processed: customer names, email addresses, postal addresses, phone numbers and payment data. The App does not request them. No special categories of data are processed.

15.4 Confidentiality

Only the operator of the App has access to the personal data, and only as needed to run, secure and support the App. Anyone we allow to access it in the future will be bound by confidentiality.

15.5 Security measures

• Encryption in transit: HTTPS (TLS) for all traffic with Shopify, and an encrypted private network between the App and its database.
• Storage-level encryption at rest by our hosting provider.
• Verification of every Shopify request with HMAC signatures; each store sees only its own data in the App.
• Access to production systems limited to the operator, with two-factor authentication on the accounts used.
• Minimal data collection and automatic deletion (section 15.8).

15.6 Sub-processors

You authorise these sub-processors:

We will give at least 14 days' notice in the App, by email or by updating the Privacy Policy before we add or replace a sub-processor. If you object on reasonable data protection grounds, tell us; if we cannot address the objection, you may end these Terms by uninstalling the App. We bind each sub-processor to data protection terms that protect the data at least as well as this DPA and remain responsible for its performance.

15.7 Personal data breaches

We will notify you without undue delay after becoming aware of a personal data breach affecting your data, with a target of 72 hours, and give you the information we have to help you meet your own notification duties. We will also notify Shopify where Shopify's terms require it.

15.8 Deletion and retention

• Consolidation records and activity log entries are deleted 90 days after the last update or creation; webhook receipts after 7 days; background job records within 7 days.
• Uninstalling the App deletes your access token and session data at once.
• All remaining data for your store is deleted when Shopify sends its shop erasure request (shop/redact), 48 hours after you uninstall.
• Logs (no customer data) and database backups, if enabled, kept by our hosting provider expire under its retention schedule (logs up to 30 days, backups up to 3 months).

15.9 Assistance

We help you answer data subject requests through Shopify's mandatory privacy webhooks: on a customer data request we list the records we hold for the listed orders on the App's Activity page, and on a customer erasure request we delete the records for the listed orders. On request we will send you an export of the records we hold for an order. We will also give reasonable help with data protection impact assessments and consultations with supervisory authorities, where they concern the App.

15.10 Audits

On reasonable written request, and no more than once a year unless a supervisory authority requires it or after a personal data breach, we will give you the information needed to show compliance with this DPA, such as a written description of our measures and answers to a security questionnaire. Any on-site audit must be agreed in advance, at your cost, and must not give access to other merchants' data.

15.11 International transfers

The App and its database are hosted in the United States, and the App is operated from Ukraine. Where the GDPR or UK law requires it for a transfer of personal data out of the European Economic Area, the United Kingdom or Switzerland, the Standard Contractual Clauses approved by the European Commission (module two, controller to processor; module three for onward transfers to sub-processors) and the UK International Data Transfer Addendum are incorporated into this DPA by reference.

16. Contact

FOP Mykhailo Barkov
Ukraine
Email: boxly.support@gmail.com