Rotulín privacy policy

Last updated: 14 October 2026. Translated from the Spanish original, which prevails if they differ: Versión en español

Rotulín is a Shopify app that creates Chilexpress transport orders and shipping labels for the orders of shops in Chile, under each shop's own Chilexpress contract. It is operated by Standard Computing LLC, a US company ("we"). This policy explains what data Rotulín handles, why, who it is shared with, how long we keep it, and how to have it deleted. Contact: wallace@standardcomputingllc.com.

Our role

We are the controller of the data of the shops that use Rotulín. Each shop is the controller of its customers' (shoppers') data: we process it on the shop's behalf, as its processor, only to create its shipments, as our terms of service (in Spanish) say.

Shoppers' data

Rotulín reads the shop's open, unfulfilled orders from Shopify: the order number, when it was placed, the shipping address (street, address line 2, city or comuna, region and country) and the order's and the address's phone numbers. When creating labels it also reads the recipient's name and the order's weight and total.

It uses them to show the shop its orders and which can be shipped, and to create the shipment with Chilexpress, which receives the recipient's name, address and phone number, the weight, the total as the declared value, and the order number as a reference. We do not read shoppers' email addresses: Chilexpress gets the shop's contact email instead.

We do not store shoppers' names, addresses or phone numbers: they are read from Shopify each time they are needed. For each order we store only:

• if the shop created its shipment: the order's Shopify ID and number, the Chilexpress transport order number and certificate number, the shipment's status, when the order was marked fulfilled and, if something failed, the reason in Chilexpress's or Shopify's words;
• if the shop corrected the order's comuna: the order's ID, the comuna it chose, and a keyed hash (HMAC) of the address, used only to tell whether the address has changed. We do not store the address text.

Labels are not stored: the PDF is built on the spot and handed to the shop, and a label is reprinted by asking Chilexpress for it again.

Shops' data

• The shop's myshopify.com domain, the access tokens Shopify gives us, the permissions the shop granted, and when it installed and uninstalled Rotulín.
• What the shop enters in Configuración (settings): its Chilexpress API keys and whether they are test or production keys, its Chilexpress customer number (TCC), its company's RUT, its origin comuna, its contact phone number and its return address.
• How many labels the shop created each month, counted separately for test and production keys, to measure how much it uses Rotulín. They do not say which orders they were for.
• We read the shop's name from Shopify, to show it in the app and as the shipment's sender, and, when creating a shipment, its contact email, which goes to Chilexpress. We store neither.

Usage statistics

We record usage events: installs, connecting Chilexpress, transport orders created, and orders marked fulfilled. Each carries, instead of the shop's domain, an identifier derived from it with SHA-256, and, except for installs, whether the Chilexpress keys are test or production keys. They contain no shoppers' data: no names, addresses, phone numbers or order numbers.

The statistics also include our log of access to shoppers' data: each time someone at the shop opens the order list, creates labels or reprints one, we record the shop's identifier, the user ID Shopify gives that person (not their name or email), and how many orders were read.

Each event and each page visit also records the page (its route, not the full address), the site that linked to it, and the country it was visited from. We use no cookies and store no IP addresses.

Technical logs

Rotulín writes logs of its errors and operation. They name the shop (its domain) and the order's ID, never a shopper's name, address or phone number.

Why we use it

• To show the shop its orders, check Chilexpress's coverage, and create transport orders and their labels with the shop's Chilexpress account.
• To mark orders fulfilled in Shopify with their tracking number, so that Shopify notifies the shopper.
• Statistics, to learn how Rotulín is used and improve it, and the access log, to be able to review who read shoppers' data.

We do not sell personal data, do not use it for advertising, and do not share it with anyone but those listed below.

Who it is shared with

• Shopify, the shop's platform: we read orders from it and send it the tracking number.
• Chilexpress, which receives each shipment's data under the shop's contract with Chilexpress and handles it under its own policies.
• Cloudflare, Inc., which hosts Rotulín, its database, the statistics and the technical logs.

We are in the United States, and Cloudflare stores and processes this data in the United States and other countries where it operates. Where the law requires safeguards for that transfer, we rely on Cloudflare's customer data processing addendum, which includes the standard contractual clauses.

How long we keep it

• Shoppers' names, addresses and phone numbers: not stored.
• Each order's transport orders and corrected comunas: a daily job deletes them 60 days after they last changed. They are deleted sooner if Shopify asks us to delete the shopper's or the shop's data.
• How many labels the shop created each month: kept until the shop's data is deleted, as described next.
• Shops' data: when a shop uninstalls Rotulín we delete its Shopify access tokens at once. Shopify asks us to delete the shop's data 48 hours after uninstalling, and we then delete everything we keep about it from our database, its transport orders and corrected comunas included. If that request never comes, a daily job deletes shops uninstalled 28 days ago or more, so everything is deleted from our database within 30 days of uninstalling, unless the shop installs Rotulín again before then. The statistics, which carry an identifier derived from the shop's domain rather than the domain, are not deleted on uninstall: they are deleted after about three months, as below.
• Database history: Cloudflare keeps 7 days of history of our database, which we use only to restore it after an error, so what we delete from it stays in that history for 7 more days.
• Statistics: about three months, after which Cloudflare deletes them.
• Technical logs: 3 days.

If you are a shopper

If you bought from a shop that uses Rotulín, ask the shop to see, correct or delete your data: it is responsible for it and holds it in Shopify. The shop can write to us at wallace@standardcomputingllc.com if it needs our help.

When a shopper asks the shop for their data, Shopify notifies us. There is no separate report to hand over: all we keep about their orders is what the shop itself did (the comuna it corrected and the transport order it created), which the shop already sees in Rotulín and Shopify. When the shop asks for a shopper's data to be deleted, Shopify notifies us and we delete the transport orders and corrected comunas of their orders right away.

Your rights

A shop can ask us to see, correct or delete the data we keep about it by writing to wallace@standardcomputingllc.com, or delete it by uninstalling Rotulín, as above. Anyone can exercise with us the rights their law gives them, such as those recognised in Chile by Law 19.628 on personal data protection, as amended (access, rectification, erasure, objection and portability, among others), by writing to the same address.

Security

Shopify tokens and Chilexpress keys are stored encrypted with AES-256-GCM, and each can be decrypted only for its own shop. Connections with Shopify, Chilexpress and Rotulín are encrypted with HTTPS.

Changes

We will post changes on this page and update the date above.