Exemption Desk privacy policy

1. Our role and the merchant’s role

The store merchant decides why exemption evidence is collected, which purchases it covers and how requests are approved. We process certificate and customer information on the merchant’s instructions to provide the app. The merchant’s own privacy notice also applies to purchases and its use of your information.

We are responsible for information we use to manage our relationship with merchants, provide support, protect the service and meet our own legal obligations. Shopify independently operates the store platform, customer sign-in and app billing.

2. Information we collect

Certificate information: Shopify store and customer identifiers, customer name and email, business or organization name, exemption category, state, certificate number, validity date and the uploaded PDF or image. Uploaded documents may contain other information you choose to include. Provide only evidence needed for the merchant’s exemption review.

Service records: submission and renewal history, decisions and reasons, Shopify exemption and checkout-coverage updates, expiry information, notification contents and delivery status, store settings and app subscription status.

Installation information: store identity, authorized installation/session credentials, granted permissions and account details provided by Shopify. We use these to authenticate access and maintain the authorized integration. We do not collect payment-card details through this app.

Support and technical information: your reply address and message, optional screenshots/video/audio, store URL, app release, setup and error counts, browser version and viewport size. Hosting and security logs may also process connection information such as IP addresses, request paths, timestamps and error information.

3. How we use information

We use information to collect and retrieve certificates, show application status, apply merchant decisions to Shopify customer tax settings, manage expiry and renewals, send requested service notifications, resolve support issues, authenticate access, prevent misuse and respond to data requests.

Automatic acceptance follows rules chosen by the merchant. It is not verification by a tax authority or a determination of legal eligibility. Customers can choose manual review when that option is offered in the application form, or contact the merchant about a decision.

We do not sell personal information, use certificate contents for advertising, or use them to train an AI model. The app does not add advertising trackers. Shopify and a merchant’s storefront may use their own cookies or services under their own notices.

4. Optional recordings and support attachments

Screen and voice recording start only when you choose the recording control and grant the browser permission. You choose what to share and can preview a recording before attaching it. The app uploads a recording or attachment when you send the support form, not merely when you start recording.

Avoid including passwords, payment details or customer certificate documents in support messages and recordings. The form also includes limited troubleshooting details so our team can identify the store and investigate the problem.

5. Who receives information

The merchant and its authorized app users can access the store’s certificate records. The signed-in customer can view their own application history through the customer hub.

We use Shopify for the store integration, Amazon Web Services for hosting, and Resend to deliver transactional and support emails. Our support mailbox provider processes messages sent to our company inbox. Email messages may contain certificate status and the information needed to identify a request; certificate files are not routinely attached to customer notifications. Support attachments you choose to send are included in the support email.

Authorized company personnel and service providers access information as needed to operate, secure or support the service. We may disclose information when required by law, to protect legal rights or safety, or as part of a business transfer subject to applicable protections.

6. Storage, location and security

The app’s primary hosting is in AWS’s US East (Northern Virginia) region. Our company operates in Pakistan, and authorized support access may take place there. Shopify, email and other service providers may process information in additional countries. Where applicable law requires safeguards for a transfer, those requirements apply to the relevant processing arrangement.

Certificate documents are stored privately on our app server, rather than in public Shopify Files. Stored documents use authenticated application-level encryption; the encryption key is kept separately from the document directory with restricted access. We also use HTTPS, authenticated store-scoped access, restricted file permissions and encrypted backup exports. These controls do not make any online service entirely risk-free.

7. How long we keep information

Certificate files, decisions and related history are kept while the app is installed and the merchant uses the service, so the merchant can manage exemption evidence and its recordkeeping. Expiry or withdrawal changes exemption status but does not automatically erase the evidence. A merchant can request deletion through Shopify or our privacy contact. A specific legal retention obligation may affect what can be deleted; it does not justify keeping unrelated information indefinitely.

After uninstall, Shopify sends a separate shop-redaction request, normally 48 hours later. We process that request to remove the store’s app data. An active reinstall, a verified legal retention obligation or unresolved identity may require review rather than immediate erasure. Uninstalling or deleting app records does not by itself reverse tax settings already stored in Shopify.

Support-form retry records and their attachments are scheduled for removal from the app database after 30 days. Copies delivered to our inbox or held by email providers have a separate lifecycle and may remain as needed to resolve a support issue, handle a dispute or meet legal obligations. Contact us to request deletion of those copies.

Routine server recovery backups rotate after 14 days. Copies made for a documented incident or legal obligation may be kept longer for that purpose. A live-data deletion does not immediately edit older backups; access to recovery copies is restricted. Before using restored data, we review and reapply relevant later deletion requests. Temporary data exports are removed after secure delivery and verification.

8. Access, correction and deletion requests

Customers should contact the store merchant first, because the merchant controls the exemption record and purchase. You may also contact support@agilestsol.com with “Privacy request” in the subject. Include the store URL and enough information to identify your request; do not send passwords or identity documents unless we arrange a secure, necessary verification step.

We work with the merchant to verify identity and handle access, correction, export or deletion requests. Shopify compliance requests are handled within 30 days of receipt, except where a legal retention obligation prevents deletion. We communicate issues requiring clarification rather than treating acknowledgment as completion. Additional rights and complaint routes depend on the law that applies to you.

9. Contact and policy changes

Privacy and support: support@agilestsol.com. Telephone: +92 332 1322221. Postal address: Agilest Solution, 101 Gulshan-e-Rah Street, Taj Bagh Harbancepura Lahore, Pakistan.

We may update this policy as the service or its processing changes. The effective date identifies the current version. We will provide additional notice of material changes where required.