POPLoad
1. Who we are
POPLoad: Proof of Payment ("POPLoad", "we", "us") is a Shopify app operated by MindLab Future. It lets Shopify merchants collect proof-of-payment receipts from their customers for manual payment methods such as bank transfer, and review those receipts in one dashboard.
The terms that govern a merchant's use of POPLoad, including our data processing terms, are in our Terms of Service.
For personal data about a merchant's customers, the merchant is the controller and POPLoad acts as a processor on the merchant's behalf. Questions about this policy can be sent to support@mindlabfuture-ai.com.
2. Data we collect from merchants
When a merchant installs POPLoad we store:
- The store's myshopify domain and the access token Shopify issues to the app.
- App settings: the manual payment methods that show the upload, and the staff allowlist.
- Payment accounts the merchant adds: account name, QR code image and account details, which we show to their customers on the Thank you and Order status pages.
- Plan and usage information: free uploads used and subscription status. Payments are handled by Shopify; we never see card details.
- The name and email of staff members who sign in to the dashboard and view, approve or deny receipts, so each view and decision shows who made it.
3. Data we process about the merchant's customers
For each order paid with a manual payment method the merchant enabled, POPLoad processes:
- Order ID and order number, order total and currency.
- Customer name and email address.
- The receipt image the customer uploads, and the optional reference number and sender name they enter.
- Receipt check data: a fingerprint (hash) of each uploaded file, and information read from the file's metadata, such as the software that saved it, any AI-generation tag and the date it was created. We use these only to flag duplicate, edited, AI-generated or out-of-date receipts for the merchant.
- Text read from the uploaded receipt, such as the amount, reference number and bank wording. We read it with text recognition (OCR) on our own server, never send it to a third party, and use it only to flag receipts that may not be genuine, don't match the order total, or reuse another order's reference number.
- The review outcome (approved or denied), any deny reason, and an activity log of uploads, reviews and who viewed each receipt.
4. Shopify permissions and why we need them
| Permission | Why POPLoad needs it |
|---|---|
read_orders | Read the order a receipt belongs to, its total and its payment method. |
write_orders | Mark an order as paid when the merchant approves a receipt, and add tags and notes. |
write_files | Save uploaded receipts to the merchant's own Shopify Files. |
read_customers | Show each order's customer name and email in the review dashboard, so staff can match a receipt to the right buyer and follow up on missing or denied payments. |
Customer contact details are used only for that purpose. POPLoad does not send marketing messages to customers.
5. Where data is stored
Receipt files are stored in the merchant's own Shopify Files, not on our servers. Order details, review records and app settings are stored in a PostgreSQL database hosted by Railway in Singapore. All traffic between Shopify, POPLoad and our database is encrypted in transit.
6. How we use data
We use the data above only to run POPLoad for the merchant: to show receipts and order details in the dashboard, to flag receipts that may be duplicated, edited, reused or not match the order, to update order payment status, tags and notes, to enforce plan limits, and to provide support when the merchant asks for it. MindLab Future staff can technically access this data, but we only look at it to provide support or keep the service running, never for any other purpose. We do not sell personal data, use it for advertising, or share it with anyone other than the subprocessors below.
7. Subprocessors
| Subprocessor | Purpose |
|---|---|
| Shopify | Commerce platform, app billing and storage of receipt files |
| Railway | Application hosting and PostgreSQL database |
If we add a subprocessor (for example, for malware scanning of uploads or error tracking), we will update this list before it receives any data.
8. Retention and deletion
- Records are kept while POPLoad is installed, so merchants can look back at past receipts.
- When Shopify sends a
customers/redactrequest, we delete that customer's receipt records from our database. - When a merchant uninstalls POPLoad, Shopify sends a
shop/redactrequest 48 hours later and we delete all of that store's data from our database. The one exception is an anonymised count of receipt uploads, stored under a one-way hash of the store's address with no customer or order data, which we keep to enforce the free tier if the store reinstalls. - Receipt files in the merchant's Shopify Files belong to the merchant and stay under their control.
9. Customer data requests
Customers who want to access or delete their data should contact the store they bought from. The merchant can forward the request through Shopify, which notifies us with a customers/data_request webhook. We respond within 30 days.
10. Security
POPLoad uses HTTPS everywhere and verifies Shopify session tokens on every dashboard request. Dashboard access is limited to the store owner and the staff members the merchant adds to the allowlist. Only the store owner can change the allowlist, payment accounts and QR codes, and other settings. Every time someone opens a receipt, POPLoad records who viewed it in that receipt's activity log. Uploads are limited to JPG, PNG, WebP and HEIC images up to 10 MB, and each file is checked by its contents to be a real image; other files, including PDFs, are refused.
11. POPLoad does not verify payments
POPLoad shows the merchant what a customer submitted. It does not connect to any bank or confirm that money was received. The merchant decides whether each payment was received before approving it.
12. Changes and contact
If we change this policy in a way that affects how merchant or customer data is handled, we will update the date above and notify installed merchants by email before the change takes effect. For any privacy question or request, email support@mindlabfuture-ai.com.
MindLab Future · mindlabfuture-ai.com