Privacy Policy

Effective Date: June 10, 2026

This Privacy Policy describes how Explato ("we", "us", or "our") collects, uses, and discloses information when you install or use the CheckGuard – Terms & Conditions app (the "App") in connection with your Shopify-supported store.

1. Information We Collect

When you install and use the App, we collect the following types of information:

A. Information from Merchants

• Store Information: Your Shopify shop domain.
• Contact Information: The shop owner's email address.
• App Configuration: Your settings, such as checkbox text, styling, and positioning.

B. Information from Merchant's Customers

When a customer visits your store and interacts with the App, we collect minimal operational data to record consent:

• Whether the terms and conditions checkbox was checked (true/false).
• The associated Order ID or Cart Token.
• The timestamp of the interaction.

What we do NOT collect: We do not collect, process, or store payment information, full customer names, physical addresses, or any other personally identifiable information (PII) beyond what is strictly necessary to log consent.

2. How We Use the Information

We use the collected information for the following purposes:

• To provide and operate the App's core functionality (logging terms acceptance).
• To allow merchants to configure and customize the App.
• To provide customer support and communicate with merchants about app updates.
• To monitor for security, investigate fraud, and maintain the integrity of our systems.

3. Sharing Your Information (Third Parties)

We do not sell or rent your personal information. We share information only with essential third-party service providers required to operate the App:

• Shopify: As the platform provider, data is synced and shared with Shopify's APIs to function within your store.
• Railway: Our application hosting infrastructure provider.
• Neon: Our secure database hosting provider where the consent logs and configurations are stored.

4. Data Retention and Deletion

We retain merchant configuration data and customer consent logs for as long as the App is installed on your Shopify store.

If you uninstall the App, we will automatically delete your store's configuration settings and associated customer consent logs from our active databases within 48 hours via Shopify's app/uninstalled webhook.

5. Shopify Mandatory Webhooks & Data Subject Requests

We fully comply with Shopify's data privacy requirements and process the following mandatory webhooks:

• Customer Data Request (customers/data_request): If a customer requests to view their data, we will provide you (the merchant) with any consent logs associated with that customer.
• Customer Redact (customers/redact): If a customer requests deletion of their data, we will permanently delete or anonymize any consent logs associated with that customer.
• Shop Redact (shop/redact): If a merchant requests deletion of their store data, we will permanently delete all shop configurations and associated customer logs from our systems within 30 days.

6. Your Rights (GDPR & CCPA Compliance)

Merchant Rights

As a merchant, you have the right to access, update, or delete your information at any time. You can do this by uninstalling the App or contacting us directly.

Customer Rights

If you are a customer of a merchant using our App, your primary relationship is with the merchant. Under the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), you have the right to access, rectify, or erase your personal data.

To exercise these rights, please contact the merchant directly. We act solely as a data processor on behalf of the merchant and will promptly fulfill any data subject requests forwarded to us by the merchant or via Shopify's automated webhooks.

7. Security

We implement industry-standard security measures, including encryption in transit (HTTPS) and secure database hosting, to protect your information. However, no method of transmission over the internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

8. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our practices or for other operational, legal, or regulatory reasons. We will notify merchants of any significant changes by updating the "Effective Date" at the top of this policy.

9. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Email: hello@explato.com
Company: Explato