privacy policy
Effective date: 22 May 2026
Welcome to Joybox, the Shopify app for personalised gift messaging (the "Service"). The Service is owned and operated by Resonance Design & Technology LLP, Bengaluru, India ("we", "us", or "the Company").
The Service is offered to merchants who use the Shopify ecommerce platform. Merchants access the Service by installing our application (the "App") from the Shopify App Store at https://apps.shopify.com.
Your privacy matters to us. This Privacy Policy (the "Policy") explains what data we collect, why we collect it, how we use and store it, and how to reach us if you have questions.
1. Personal data we collect
From merchants (via Shopify)
When the App is installed, we collect information made available through Shopify's API. This includes the merchant name, store address, contact name, email address, phone number, website domain, Shopify plan name, and timezone.
From gift senders
When a buyer uses the App to send a gift, we collect:
- Their name and email address
- The content of their gift message, which may be a text note, an audio recording, or a video recording
- The recipient's name, email address, and delivery address
- The scheduled delivery time selected by the sender: at the time of order placement, at the time of gift delivery, or a custom date and time chosen by the sender
From gift recipients
We record when a recipient accesses their gift message via a unique link, and when a message has been redeemed. Recipients may also provide or confirm their delivery address as part of the gift experience.
Device and usage data
The App collects standard technical data including IP addresses, browser type, and interaction data. This is used to operate the Service, provide support, and improve the App over time.
2. How we use personal data
To operate the App
We use the data collected to deliver the gifting experience end-to-end — sending gift notifications to recipients, delivering scheduled messages at the time chosen by the sender, and providing merchants with order and analytics information through their dashboard.
Scheduled delivery options available to senders are:
- At the time of order placement
- At the time of gift delivery
- At a custom date and time selected by the sender
To store messages
Text notes are stored on our servers and made accessible to the intended recipient via a unique link.
Audio and video messages recorded through the App are stored on our own servers. These files are accessible only to the intended recipient via a unique link, and are permanently deleted 90 days after delivery.
To provide technical support
Merchant and usage data helps us identify and assist merchants who contact us for support, and understand how the App is being used.
To communicate updates
We may send merchants updates about the App, including changes to features or to this Policy.
3. How personal data is shared
We do not sell your data. We do not share your data with third parties except as described below.
Service providers
Some functionality requires us to work with third-party tools and service providers. These providers are authorised to use your information only to deliver their specific service to us, not for any independent purpose.
Legal requirements
We will disclose your information to governmental or regulatory authorities if required to do so by applicable law, court order, or lawful request.
Shopify's role
The App operates on Shopify's platform. Shopify's own privacy policy governs any data processed or stored by Shopify directly. Merchants are responsible for ensuring their own customers have been informed about and have consented to data collection in accordance with applicable laws.
4. International data transfers
Resonance Design & Technology LLP is based in Bengaluru, India. If you are accessing the Service from outside India — including from the European Economic Area, the United Kingdom, or the United States — your data may be transferred to and processed in India or in countries where our service providers operate. We take reasonable steps to ensure such transfers comply with applicable data protection laws.
5. Data retention
| Data type | Retention period |
|---|---|
| Order information (sender/recipient details, message content) | 180 days from date of order |
| Audio and video message files | Permanently deleted 90 days after delivery |
| Text message content | Deleted at the end of the 180-day order retention period |
| Merchant account data | Retained for the duration of the App installation; deleted 30 days after uninstall |
6. Data security
We implement reasonable technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. This includes access controls and encrypted storage for message files. No system is completely secure, and we cannot guarantee absolute security, but we take these obligations seriously.
7. Children's data
The App is intended for use by merchants and adult consumers. We do not knowingly collect personal data from children under the age of 13 (or the applicable age of digital consent in your jurisdiction). If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
8. Cookies and tracking
The App may use cookies or similar tracking technologies to support its operation and to collect usage data. These are used strictly for functional and analytical purposes. You may be able to control cookie settings through your browser, though disabling certain cookies may affect how the App functions.
9. Your rights
Depending on your location and applicable law, you may have rights regarding your personal data — including the right to access, correct, or request deletion of your data. To exercise any such rights, contact us at the address below.
For merchants based in the European Union or United Kingdom, you may also have the right to lodge a complaint with your local data protection authority.
10. Grievance Officer (India)
In accordance with the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023, the following person has been designated to address grievances regarding the processing of personal data:
Organisation: Resonance Design & Technology LLP
Email: santa@sendjoybox.com
Response time: We will acknowledge your grievance within 48 hours and resolve it within 30 days.
11. Changes to this Policy
We may update this Policy from time to time to reflect changes to our practices or for legal and regulatory reasons. When we make material changes, we will update the effective date at the top of this page. Continued use of the App after changes are posted constitutes acceptance of the updated Policy.
12. Contact us
If you have any questions about this Policy or how we handle your data, contact us at:
Resonance Design & Technology LLP
Bengaluru, India