Robert Ralph LLC · last updated July 17, 2026
WhatBox processes merchant store data (products, orders, packaging configuration) to recommend shipping boxes and route fulfillment. For orders a merchant routes to Amazon Multi-Channel Fulfillment, we process the buyer's name, shipping address, and phone number solely to create that buyer's own shipment.
No sale of data. No marketing use. No analytics on buyer identity. No contact with buyers. No data brokers.
Data is hosted on Microsoft Azure (United States), encrypted in transit (TLS 1.2+) and at rest (AES-256 plus application-level field encryption for credentials and personal data). Access is restricted to named principals with multi-factor authentication; reads of personal data are access-logged.
Buyer personal data is retained no longer than 30 days after order completion, then purged automatically. Merchant data is deleted on app uninstall. Deletion requests received through Shopify's GDPR webhooks are honored immediately.
bob@thewhatbox.com