JoyBox
JoyBox: Gift Cart

privacy policy

Effective date: 22 May 2026

Welcome to Joybox, the Shopify app for personalised gift messaging (the "Service"). The Service is owned and operated by Resonance Design & Technology LLP, Bengaluru, India ("we", "us", or "the Company").

The Service is offered to merchants who use the Shopify ecommerce platform. Merchants access the Service by installing our application (the "App") from the Shopify App Store at https://apps.shopify.com.

Your privacy matters to us. This Privacy Policy (the "Policy") explains what data we collect, why we collect it, how we use and store it, and how to reach us if you have questions.

1. Personal data we collect

From merchants (via Shopify)

When the App is installed, we collect information made available through Shopify's API. This includes the merchant name, store address, contact name, email address, phone number, website domain, Shopify plan name, and timezone.

From gift senders

When a buyer uses the App to send a gift, we collect:

  • Their name and email address
  • The content of their gift message, which may be a text note, an audio recording, or a video recording
  • The recipient's name, email address, and delivery address
  • The scheduled delivery time selected by the sender: at the time of order placement, at the time of gift delivery, or a custom date and time chosen by the sender

From gift recipients

We record when a recipient accesses their gift message via a unique link, and when a message has been redeemed. Recipients may also provide or confirm their delivery address as part of the gift experience.

Device and usage data

The App collects standard technical data including IP addresses, browser type, and interaction data. This is used to operate the Service, provide support, and improve the App over time.

2. How we use personal data

To operate the App

We use the data collected to deliver the gifting experience end-to-end — sending gift notifications to recipients, delivering scheduled messages at the time chosen by the sender, and providing merchants with order and analytics information through their dashboard.

Scheduled delivery options available to senders are:

  • At the time of order placement
  • At the time of gift delivery
  • At a custom date and time selected by the sender

To store messages

Text notes are stored on our servers and made accessible to the intended recipient via a unique link.

Audio and video messages recorded through the App are stored on our own servers. These files are accessible only to the intended recipient via a unique link, and are permanently deleted 90 days after delivery.

To provide technical support

Merchant and usage data helps us identify and assist merchants who contact us for support, and understand how the App is being used.

To communicate updates

We may send merchants updates about the App, including changes to features or to this Policy.

3. How personal data is shared

We do not sell your data. We do not share your data with third parties except as described below.

Service providers

Some functionality requires us to work with third-party tools and service providers. These providers are authorised to use your information only to deliver their specific service to us, not for any independent purpose.

Legal requirements

We will disclose your information to governmental or regulatory authorities if required to do so by applicable law, court order, or lawful request.

Shopify's role

The App operates on Shopify's platform. Shopify's own privacy policy governs any data processed or stored by Shopify directly. Merchants are responsible for ensuring their own customers have been informed about and have consented to data collection in accordance with applicable laws.

4. International data transfers

Resonance Design & Technology LLP is based in Bengaluru, India. If you are accessing the Service from outside India — including from the European Economic Area, the United Kingdom, or the United States — your data may be transferred to and processed in India or in countries where our service providers operate. We take reasonable steps to ensure such transfers comply with applicable data protection laws.

5. Data retention

Data typeRetention period
Order information (sender/recipient details, message content)180 days from date of order
Audio and video message filesPermanently deleted 90 days after delivery
Text message contentDeleted at the end of the 180-day order retention period
Merchant account dataRetained for the duration of the App installation; deleted 30 days after uninstall

6. Data security

We implement reasonable technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. This includes access controls and encrypted storage for message files. No system is completely secure, and we cannot guarantee absolute security, but we take these obligations seriously.

7. Children's data

The App is intended for use by merchants and adult consumers. We do not knowingly collect personal data from children under the age of 13 (or the applicable age of digital consent in your jurisdiction). If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

8. Cookies and tracking

The App may use cookies or similar tracking technologies to support its operation and to collect usage data. These are used strictly for functional and analytical purposes. You may be able to control cookie settings through your browser, though disabling certain cookies may affect how the App functions.

9. Your rights

Depending on your location and applicable law, you may have rights regarding your personal data — including the right to access, correct, or request deletion of your data. To exercise any such rights, contact us at the address below.

For merchants based in the European Union or United Kingdom, you may also have the right to lodge a complaint with your local data protection authority.

10. Grievance Officer (India)

In accordance with the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023, the following person has been designated to address grievances regarding the processing of personal data:

Organisation: Resonance Design & Technology LLP

Email: santa@sendjoybox.com

Response time: We will acknowledge your grievance within 48 hours and resolve it within 30 days.

11. Changes to this Policy

We may update this Policy from time to time to reflect changes to our practices or for legal and regulatory reasons. When we make material changes, we will update the effective date at the top of this page. Continued use of the App after changes are posted constitutes acceptance of the updated Policy.

12. Contact us

If you have any questions about this Policy or how we handle your data, contact us at:

santa@sendjoybox.com

Resonance Design & Technology LLP
Bengaluru, India