TB3 Log / Privacy Policy
Privacy Policy
Last updated: October 2026
TB3 LOG CORP ("TB3 Log", "we", "us") is a Miami-based third-party logistics and fulfillment provider. This policy explains what information we collect through our websites (tb3log.com and quote.tb3log.com), through the TB3 Log app for Shopify and when providing our services, how we use it, and the choices you have.
Scope and our role
The TB3 Log app for Shopify (the "app") connects the Shopify store of a business client ("merchant") to our fulfillment center in Miami. Orders are sent to the app; our team picks, packs and ships them; and the tracking number goes back to Shopify, which marks the order as fulfilled and, depending on the merchant's settings, notifies the customer. This policy covers every version of the app, including versions we set up for a single merchant.
When we are the controller. For information about visitors to our websites, people who request a quote or contact us, and merchants and their staff, TB3 LOG CORP is the controller: we decide how and why that data is used.
When we act for merchants. For personal data about a merchant's customers that we receive through the app or otherwise to fulfill the merchant's orders, the merchant is the controller and we act as its processor (a "service provider" under some U.S. state laws). We process that data only on the merchant's behalf and instructions, as set out in our Data Processing Addendum (DPA). If you bought from a store that ships with TB3 Log, that store's privacy policy explains how it handles your data.
Information we collect
- Information you give us when you request a quote or contact us: name, brand or company, work email, phone or WhatsApp number, the products you ship, packaging and weight details, and the markets you sell to.
- Client and operational data needed to provide fulfillment services, such as inventory, order and shipment details.
- Technical and usage data collected automatically: IP address, device and browser type, pages viewed, and interactions, gathered through cookies and analytics tools (including Contentsquare) to understand and improve site performance.
When a merchant uses the app, we process the following data for that store:
- Store data: the store's name, its myshopify.com domain and its contact email.
- Order data: order number, items, variants, SKUs, quantities, shipping method and fulfillment status.
- Recipient data: the name, company, shipping address, phone number and email address of the person receiving the order.
- Shipment data: carrier, tracking number and tracking link.
- Activity records: which member of our team viewed or changed each order in our internal dashboard, and when.
The app only asks for permission to read orders and manage their fulfillment. It does not request access to the merchant's products or customer list. Order permissions also cover payment details; the app uses only whether an order is paid and does not read card or other payment details.
How we use it
- To respond to quote requests and communicate with you.
- To provide, administer and improve our fulfillment and logistics services.
- To operate, secure and improve our websites.
- To comply with legal obligations and prevent fraud or misuse.
Our use of the data we process through the app is narrower. We use it only to:
- Receive and prepare the merchant's orders.
- Create shipping labels and ship the orders.
- Coordinate deliveries, returns and claims with carriers.
- Send the carrier and tracking number back to Shopify.
- Provide support to the merchant.
- Protect our systems and keep a record of who viewed or changed each order.
- Comply with legal obligations.
We give the recipient's email address and phone number to the carrier of each shipment, only so that the carrier can send delivery notifications and reach the recipient about that delivery. Our team does not contact recipients directly: if a delivery needs attention, we contact the merchant. We never use recipients' contact details for marketing. Merchants authorize this sharing with carriers when they accept our app terms.
Legal bases (EEA/UK)
Where the GDPR or UK GDPR applies, we process personal data on the basis of your consent, the performance of a contract, our legitimate interests in operating and improving our business, and compliance with legal obligations. When we process customer data on a merchant's behalf, the merchant, as controller, is responsible for the legal basis of that processing.
Sharing
We share personal data only with the following recipients:
- Shipping carriers (USPS, UPS, FedEx and DHL Express) receive only the information needed to deliver each shipment. They are independent companies that handle it under their own terms and privacy notices.
- Hosting and database providers in the United States run the app and store its data. We send our current list of sub-processors on request and will publish it before we release the public version of the app.
- Email and messaging providers, including WhatsApp, handle the messages that we exchange with merchants.
- Analytics providers, such as Contentsquare, help us measure and improve our websites.
- Authorities receive data only when the law requires it.
What we do not do. We do not sell personal data, and we do not "share" it for cross-context behavioral advertising, as those terms are defined under California law. We do not use merchant or customer data to train artificial intelligence or machine learning models. We do not send marketing to the people who receive the orders we ship, and we do not make decisions based solely on automated processing that have legal or similarly significant effects.
International transfers
We are based in the United States, and information may be processed there. Data processed through the app is hosted in the United States. Our operations and support team works in Brazil and accesses that data remotely, with the protections described under Security below.
Where the GDPR or UK GDPR applies to data we process for merchants, transfers of that data rely on the Standard Contractual Clauses and, for the UK, the UK International Data Transfer Addendum, incorporated by reference in our DPA. In other cases, where required, we rely on appropriate safeguards for international transfers. Brazil's General Data Protection Law (LGPD) may also apply to the processing carried out in Brazil.
Retention
We keep personal data only as long as needed for the purposes described here or as required by law, after which it is deleted or anonymized. For data processed through the app:
- Recipient personal data (name, address, phone number and email): up to 24 months after delivery, to handle returns, carrier claims and disputes.
- International shipping documents: up to 5 years, when U.S. export regulations require it.
- Order records from which the recipient's details and tracking numbers have been removed may be kept for as long as we need them for our billing, accounting and legal records.
When these periods end, the data is deleted or anonymized automatically. Deletion requests that Shopify sends us for a customer or for a store are completed within 30 days, unless the law requires us to keep the data. When a merchant uninstalls the app, we do not wait for these periods to end: Shopify sends us a deletion request for that store 48 hours after uninstallation, and we delete the data that we received through the app for that store within 30 days of uninstallation. When a merchant's services with us end, we delete the rest of the personal data that we process for that merchant within 30 days. In both cases, we keep only the data that the law requires us to keep.
Security
We protect the data we handle with these measures:
- Encryption in transit (TLS) and at rest, including backups.
- Access limited to the team members who need it for their work.
- One account per person, with a strong password and two-step verification.
- Access logs, reviewed every month.
- No bulk exports of names and addresses.
- Test data kept separate from production data.
- An incident response plan.
No system is completely secure. If an actual or suspected security incident affects merchant or customer data, we notify Shopify within 24 hours of becoming aware of it, and we notify affected merchants without undue delay and no later than 72 hours after confirming it, in addition to any notice required by law. To report a security concern, email support@tb3log.com.
Your rights
Depending on where you live, you may have the right to access, correct, delete, or port your data, to object to or restrict processing, and to withdraw consent. For personal data that we process through the app, we honor requests to access, correct or delete it for everyone, wherever they live. California residents may request to know, delete, or correct their personal information and to opt out of "sale" or "sharing" — which we do not do. To exercise any right, email us at support@tb3log.com. We respond within 30 days, or sooner where the law requires, and may ask for information to confirm your identity. You may also have the right to lodge a complaint with your local data protection authority.
If you are a customer of a store that uses TB3 Log, the merchant is the controller of your data, so you may prefer to contact the store directly. If you contact us, we will forward your request to the merchant and help them respond. When Shopify forwards a customer's data request to us, we provide the requested data to the merchant.
Cookies
We use essential cookies to run the site and analytics cookies to measure and improve it. You can control cookies through your browser settings; disabling some may affect how the site works. The app does not add cookies, scripts or other tracking technologies to the merchant's online store.
Children
Our sites and services are intended for businesses and are not directed to children.
Changes
We may update this policy from time to time. The "last updated" date above reflects the latest version. If a change materially affects how the app handles merchant or customer data, we will also notify merchants by email to the store's contact address and with a notice in the app, at least 30 days in advance where possible.
Contact
TB3 LOG CORP, a Florida corporation (Florida document no. P26000036331), 2000 NW 133rd Avenue, Unit 2, Miami, FL 33178, USA.
- Privacy requests and support: support@tb3log.com
- Commercial: commercial@tb3log.com
- WhatsApp: +55 21 97533-7316 (calls and messages)
Support hours and what to include in a request are on our Support page.