Privacy Policy

FABTRACK is a service of FABXERS, Pakistan. FABTRACK helps online stores in Pakistan manage orders, couriers, cash on delivery (COD), riders and customer messages. FABTRACK Riders is our Android app for delivery riders who take jobs from stores that use FABTRACK.

Contact for anything about privacy: [email protected] or WhatsApp +92 345 0676754.

• FABTRACK web app (app.fabtrack.pk) used by store owners and their team.
• FABTRACK WordPress plugin, which connects a WooCommerce store to FABTRACK.
• FABTRACK store Android app (package pk.fabtrack.app).
• FABTRACK Riders Android app (package pk.fabtrack.riders).
• This website, fabtrack.pk.

Order and customer data that comes from a store belongs to that store. For that data FABTRACK works on the store's behalf and follows its instructions; the store is responsible for having the right to use its customers' data.

When a store uses FABTRACK we process:

• Account data: name, email address, password (kept by our login provider as a hash), team members and their roles.
• Store connection settings: store address, WooCommerce or Shopify keys, courier account keys (for example PostEx or Leopards), email and WhatsApp settings. These are used only to run the features the store turns on.
• Order data from the store: order numbers, products, amounts, payment method, and the customer's name, phone number, email and delivery address.
• Shipping data: courier tracking numbers and statuses, rider bookings, COD amounts and settlements.
• Messages the store sends to its customers through FABTRACK (order emails, marketing emails, WhatsApp message drafts), and delivery and open results for emails.
• Google Search Console data, only if the store connects it (see section 7).
• AI features, only if the store uses them: the questions asked in the ASK Agent and the saved chats, and what an AI connection reads (see section 8).
• Browser notifications for the store team, if they turn them on (a browser push subscription).

The FABTRACK store app is the Android version of the FABTRACK web app for store owners and their team. You log in with the same account, and it shows and changes the same data as app.fabtrack.pk, so everything in section 3 applies to it too. What you can do in the app depends on your role (owner, manager, staff or accountant) and your plan, exactly as on the web.

• Email and password

  Why: Logging in. The password is kept by our login provider as a hash

  Shared with: No one

• Store, order, customer and shipping data

  Why: Showing and updating what you see on the web

  Shared with: Only your own store and team; the same services as the web (section 10)

• Notification token (Firebase Cloud Messaging)

  Why: Alerts on your phone for new orders, cancellations, low stock and other events you choose

  Shared with: Google Firebase, only to deliver the notification

• Product photos you pick from your gallery

  Why: Adding a photo to a product in your store

  Shared with: Your WooCommerce store and our private file storage

• Documents you create (invoices, airway bills, CSV)

  Why: Saving or sharing them with your phone's share sheet

  Shared with: Only the app you choose to share with

Permissions the app asks for:

• Notifications: to show your alerts. You can choose which alerts you get and set quiet hours in the app.
• Internet: to talk to FABTRACK.

When you add a product photo, the app opens your phone's own photo picker, so it sees only the photo you choose. The app does not collect your location, contacts, call log, SMS, microphone or files, and it has no ads and no advertising or tracking SDKs. Calls and WhatsApp messages to customers open your phone's Phone and WhatsApp apps; we do not send that data to them ourselves.

When you log out, your notification token for that phone is removed.

Riders are approved by FABTRACK before they can get jobs. The app collects only what is needed to give riders jobs and to prove deliveries.

• Name and mobile number

  Why: Your account; stores see who is delivering their order

  Shared with: Stores that assign you a job

• PIN

  Why: Logging in. We store only a one-way hash, never the PIN itself

  Shared with: No one

• Areas you work in and your fee per area

  Why: Showing you to stores for orders in those areas

  Shared with: Stores using FABTRACK

• On duty / off duty

  Why: Showing stores who is available

  Shared with: Stores using FABTRACK

• Device ID, phone model, app version

  Why: Keeping your login safe and showing you which phones are logged in

  Shared with: No one

• Notification token (Firebase Cloud Messaging)

  Why: Sending you new jobs and job changes

  Shared with: Google Firebase, only to deliver the notification

• Job actions and times (picked up, delivered, problem reported)

  Why: Updating the order for the store and its customer

  Shared with: The store of that order

• Delivery proof photo

  Why: Proof that a parcel was delivered

  Shared with: The store of that order

• Customer code you enter

  Why: Confirming the right customer got the parcel

  Shared with: The store of that order

Permissions the app asks for:

• Camera: only when you take a delivery photo. Photos are taken in the app and uploaded to private storage; the app does not read your gallery.
• Notifications: to tell you about new jobs.
• Fingerprint / face unlock (optional): to lock the app. This check happens on your phone; we never receive fingerprint or face data.

The app does not collect your location, contacts, call log, SMS, microphone, photos from your gallery or files. It has no ads and no advertising or tracking SDKs.

Customer data riders see: for each job the rider sees the customer's name, phone number and address, and the store's pickup address and phone, so the parcel can be delivered. This copy is wiped 24 hours after the job ends. Riders must use it only to deliver that order.

fabtrack.pk uses Google Analytics to count visits and see which pages are useful. Google Analytics uses cookies and receives information such as your browser, device type, approximate location from your IP address and the pages you view. You can block these cookies in your browser or use Google's opt-out add-on. We do not use advertising cookies.

This section applies only if a store owner or manager chooses Growth → SEO → Connect with Google in the FABTRACK web app. It is optional. Without it, FABTRACK does not access anything from Google.

• Your Google account email address

  Why: To show which Google account is connected

  What we keep: The email address, until you disconnect

• The list of Search Console sites in that account

  Why: To find and let you choose the site that is your shop

  What we keep: Only the site you choose (its address)

• Search performance of that site: search words, page addresses, clicks, impressions, click rate and average position

  Why: To show the SEO page and to let your AI assistant (if you connected one) answer questions about how your shop does in Google

  What we keep: Nothing. These numbers are fetched when needed and held in the server's memory for about 10 minutes, then dropped

• A permission token from Google (refresh token)

  Why: To read the numbers above again later without asking you to log in each time

  What we keep: The token, encrypted, until you disconnect

Access is read-only. We ask Google only for permission to read Search Console data (thewebmasters.readonly permission) and your basic sign-in details (email address). FABTRACK cannot change anything in your Google account or in Search Console.

• How it is used: only to show you these numbers inside FABTRACK. We do not use Google data for advertising, we do not sell it, and we do not use it to train AI models.
• Who can see it: the owner and managers of your store in FABTRACK. If you use the ASK Agent, or connect an AI assistant to FABTRACK (Pro), these numbers can be sent to the AI company involved (see section 8), only to answer your question, on your request, and under that provider's own terms. We do not use Google data to train AI models. Our staff do not read your Google data, except if needed for security, to follow the law, or when you ask us for support and agree.
• How it is protected: the token is encrypted before it is saved and is used only by our servers; all connections use HTTPS.
• Disconnecting and deleting: press Disconnect on the SEO page. FABTRACK then asks Google to cancel the permission and deletes the saved token, email and site choice straight away. You can also remove FABTRACK at any time at myaccount.google.com/permissions. If a store account is closed, the connection is deleted with it.

FABTRACK's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

These features are optional and part of the Pro plan. Everything an AI does here is read only: it looks at the same reports you see in FABTRACK and cannot change your store. The only exception is a draft that an owner or manager approves (see "AI drafts" below).

ASK Agent (the chat in the web app)

ASK FABTRACK works as an agent. You ask a question in your own words; our server lets an AI model decide which of your FABTRACK reports to check, check them one after another, and write the answer. The "quick answer" buttons do not use AI at all.

• The question you type, and the last few messages of the same chat

  Why: To get the answer

  What we keep: In your saved chat for 30 days; and in a question log (the question, which reports were used, time, size, and a thumbs up/down if you give one) for 90 days. The log does not hold the answer

• Numbers from your reports: orders and parcels, COD amounts, sales funnel, abandoned carts, stock, profit, product names, and Google search numbers if you connected Google

  Why: So the AI can write the answer

  What we keep: Sent to the AI provider for that question only; the answer is saved in your chat for 30 days

• The answer

  Why: Shown to you

  What we keep: In your saved chat for 30 days

• Never sent to the AI: customer names, phone numbers, email addresses, delivery addresses, tracking numbers, and your store's keys and passwords. The reports do not contain them, and a filter also hides anything that looks like an email address or a phone number before the text is sent.
• AI provider: we use an outside AI company through its business interface (currently OpenAI; we may change it). It handles the text under its own terms and privacy policy. We send only what is needed to answer that question, and we do not use your data to train any AI model ourselves.
• Your chats are private: only the person who asked can see a chat, not the other people of the store. You can delete any chat in the Chats list at any time. A chat is deleted automatically 30 days after its last message.

AI connections (Claude, ChatGPT, Cursor and similar)

In Settings → AI connections an owner or manager can make a key and give it to an AI app of their choice. That app can then read the same reports (again without customer contact details), as far as the person's own role allows. FABTRACK keeps only a one-way hash of the key (not the key itself), its name, its access level and when it was last used, plus a log of each report the AI asked for (which report, when, and short details with emails and phone numbers hidden) for 90 days. The data goes to the AI company you chose, under its terms; we do not control what happens there. You can revoke a key at any time and it stops working at once.

AI drafts

If you give an AI connection the "Read and save drafts" access, it can save text drafts in FABTRACK (product text, tags, category text, SEO titles and descriptions, stock suggestions, email ideas). Nothing changes in your shop until an owner or manager approves it. When you approve, FABTRACK writes the text to your own store using your store's own keys (and the FABTRACK plugin for SEO text), and saves what was there before so you can undo it. Drafts and this change history are kept with your store while it uses FABTRACK.

• To provide FABTRACK: sync orders, book couriers and riders, track parcels, follow COD, and send the messages a store chooses to send.
• To give riders jobs, send them notifications and record deliveries.
• To keep accounts secure, stop abuse and fix problems.
• If a store connects Google Search Console: to show its search numbers (section 7).
• If a store uses the ASK Agent or an AI connection: to answer its questions and let its chosen AI read its reports (section 8).
• To answer support requests.
• To meet legal obligations.

We do not sell personal data, and we do not use it for advertising.

We share data only as needed to run the service:

• Supabase

  What for: Database, login and private file storage

• Hostinger

  What for: Hosting our servers and this website

• Google Firebase Cloud Messaging

  What for: Delivering notifications to the Riders app

• Resend

  What for: Sending emails a store sends to its customers

• Courier companies (e.g. PostEx, Leopards)

  What for: Booking and tracking shipments the store books

• WooCommerce / Shopify

  What for: Reading and updating the store's own orders

• WhatsApp

  What for: Message buttons open WhatsApp on your own phone; we do not send data to WhatsApp ourselves

• Google Analytics

  What for: Visit statistics for fabtrack.pk

• Google (Search Console API and sign-in)

  What for: Only if a store connects it: reading its Search Console numbers (section 7). We receive data from Google; we do not send your customers' data to Google for this

• AI provider for the ASK Agent (currently OpenAI)

  What for: Only for the ASK Agent: your question and the store numbers needed to answer it, never customer contact details (section 8)

Between users: a store sees the name, phone number and fee of the rider it assigns, and the delivery photo and status for its orders. A rider sees the store's pickup details and the customer's delivery details for their own jobs only.

We may also share data if the law requires it, or to protect the safety of people or the service.

• Customer name, phone, address and delivery code on a rider job

  Kept for: 24 hours after the job ends, then wiped

• Delivery proof photos

  Kept for: 30 days, then deleted

• Rider logins (sessions)

  Kept for: Up to 60 days, or until you log out

• Rider account, areas and fees

  Kept for: Until the account is deleted

• Google Search Console connection (token, email, chosen site)

  Kept for: Until you press Disconnect, or the store account is closed

• ASK Agent chats (your questions and the answers)

  Kept for: 30 days after the last message, or until you delete the chat

• ASK Agent question log (question, reports used, rating; no answer text)

  Kept for: 90 days

• AI connection activity log (which report, when)

  Kept for: 90 days

• AI drafts and change history

  Kept for: While the store uses FABTRACK

• Store account and store data

  Kept for: While the store uses FABTRACK; deleted after the store asks us to close the account

• Records of past jobs (order number, fee, status, rider name)

  Kept for: Kept with the store's order history for its accounts

Riders: open the app and go to Profile → Delete account (the button is named "Account delete karein" in the app), then confirm with your PIN. This deletes your account, PIN, areas, fees, logins and notification tokens straight away. If you cannot open the app, send a request from your registered number to WhatsApp +92 345 0676754 or email [email protected]; we delete it within 7 days.

What stays: a store keeps its own record of orders you delivered (order number, your name and phone, fee and status), because it needs this for its accounts. Delivery photos are deleted on their normal 30-day schedule. Jobs still in progress must be finished or returned to the store before the account can be deleted.

Stores (web and store app): email [email protected] from the account owner's email to close the account. We delete the store's account, settings and synced data within 30 days, except records we must keep by law.

Google Search Console: press Disconnect on the SEO page, or remove FABTRACK in your Google account (section 7). The saved token, email and site choice are deleted.

ASK Agent and AI connections: delete any chat in the Chats list of the ASK Agent page, or revoke a key in Settings → AI connections. All chats are deleted when the store account is closed (section 8).

Customers of a store: your order data belongs to the store you bought from, so please contact that store. If you contact us, we will pass your request to the store.

• All data travels over encrypted HTTPS connections.
• Rider PINs and login tokens are stored only as one-way hashes. Repeated wrong PINs lock the account for a while.
• Delivery photos are in private storage and open only through short-lived links.
• Store keys and settings are reachable only by our servers and the store's own team.

No system is perfectly secure. If we learn of a breach that affects you, we will tell you.

• Ask us for a copy of your data, or ask us to correct or delete it, using the contacts above.
• Riders can change their areas, fees and PIN in the app, and turn notifications off in Android settings (you will then miss new jobs).
• Store team members can turn browser notifications on or off at any time.

FABTRACK and FABTRACK Riders are for adults. Riders must be at least 18 years old. We do not knowingly collect data from children.

If we change this policy we will update the date at the top and, for important changes, tell users in the app or by email.

FABXERS, Pakistan · [email protected] · WhatsApp +92 345 0676754