AppVerix Checkout Rules : Politique de confidentialité

Last updated: 29 October 2026

AppVerix Checkout Rules (“the app”) is published by AppVerix (“we”, “us”). This policy explains what the app collects when a merchant installs it, why, where it is kept and how to have it deleted.

The app does not store customer names, emails, phone numbers or addresses. Rules are merchant configuration.

1. What we collect and why

From the merchant’s store, through the Admin API:

• Shop domain: to identify the store and open the app in the admin. Stored.
• An access token: so the app stays installed and can write payment and delivery customizations. Stored in the login session until you uninstall.
• Rules: conditions and actions you configure. Stored.
• Billing state from the platform (plan active, trial or none). Stored as a cache.
• Compliance log: topic and identifiers from a privacy webhook, never names or emails from the payload.

2. What we do not collect

We do not store payment card numbers, passwords, customer names, emails, phone numbers or addresses. We set no advertising cookies and use no analytics pixels.

3. Who processes data for us

Where data leaves the EEA/UK, we rely on the provider’s Standard Contractual Clauses or other approved transfer mechanisms.

• Cloudflare (cloudflare.com): hosting and the D1 database. Sees everything in section 1. Globally distributed.
• The commerce platform the app runs on, which also handles billing.

4. How long we keep it

• Rules: while the app is installed.
• When you uninstall: we delete the login session right away. A shop/redact request about 48 hours later deletes the store’s rules and shop row.
• A customer deletion request (customers/redact): this app stores no customer records, so there is nothing to delete beyond the webhook log identifiers.
• Server logs: up to 7 days, without personal data.

5. Your rights and data requests

The app answers the three privacy webhooks: customers/data_request, customers/redact and shop/redact, each verified by HMAC. Unsigned requests are rejected with HTTP 401.

Merchants can write to support@appverix.com for a copy of their data or to have it deleted. We answer within 30 days. If you are in the EEA/UK you may complain to your local data protection authority. In Brazil the LGPD applies.

6. Security

• All traffic uses HTTPS (TLS).
• The database runs on Cloudflare D1, which encrypts data at rest.
• Webhooks are verified by HMAC; unsigned requests are rejected.
• The admin checks a session token on every request and uses no third-party cookies.

7. Data processing agreement and security

The AppVerix Data Processing Addendum sets out our commitments, and our security and incident response policy describes how we protect data.

8. Changes and contact

If we change this policy in a way that matters, we update the date at the top. Contact: support@appverix.com