Privacy Policy

Effective Date: November 4, 2026

This Privacy Policy explains how Explato ("we," "us," or "our") collects, uses, and safeguards information when you install and use the CheckGuard Terms and Conditions application (the "App") on your Shopify store.

1. What CheckGuard Offers

CheckGuard provides Shopify merchants with explicit consent collection and compliance audit tools:

• Storefront and Checkout Consent: Renders terms and conditions checkboxes on your cart page, cart drawer, product pages, or Shopify Checkout to require buyer consent before checkout.
• Tamper Evident Audit Ledger: Records customer consent events alongside a cryptographic SHA-256 checksum to produce verifiable, unaltered records of agreement.
• Dispute Defense Documentation: Generates formatted dispute certificates with masked customer email, IP address, device telemetry, and time stamps to assist merchants in resolving payment disputes and chargebacks.

2. Information We Collect and Process

We follow strict data minimization principles, collecting only what is strictly necessary to operate the App and produce valid compliance records.

A. Merchant Information

• Store Information: Your primary Shopify store domain (`myshopify.com` domain).
• Contact Information: Shop owner email address associated with your Shopify account.
• App Settings: Custom agreement copy, policy links, layout styling, error messages, and surface placement preferences.

B. Customer Data Processed for Consent Records

When customers interact with the consent checkbox on your storefront or checkout, the App records the following data points:

• Consent Action: Checkbox confirmation status and the exact UTC time stamp of agreement.
• Placement Surface: The specific store location where consent was given (such as cart, cart drawer, product page, or checkout).
• Customer Email: Customer email address obtained during checkout or via order webhook under approved Protected Customer Data access. To protect shopper privacy, email addresses are masked in your daily dashboard view (for example, `m***l@example.com`) and only revealed in dispute certificates.
• Order Reference: Order ID or order number, paired with the consent event upon purchase completion.
• Technical Telemetry: Customer IP address and browser user agent header at the exact second of consent, proving the network origin, device type, and operating system.
• Integrity Checksum: A SHA-256 cryptographic hash calculated from the store domain, order reference, and time stamp to ensure the record remains tamper evident.

C. What We Never Collect

We never collect, process, or store:

• Credit card details, debit card details, or banking credentials (all payment processing is handled solely by Shopify Payments or third party payment gateways).
• Customer phone numbers.
• Customer physical shipping or billing addresses.
• Customer browsing history outside of consent checkbox interactions.

3. How We Use the Information

Collected information is used solely for the following purposes:

• To enforce mandatory agreement to your store policies prior to purchase.
• To maintain an immutable, tamper evident log of terms agreements for your records.
• To link consent events with order numbers for compliance verification.
• To generate dispute ready certificates and CSV exports that help you win payment chargebacks.
• To respond to your support inquiries and provide technical assistance.

We do not sell, rent, or monetize merchant or customer data. We do not use customer data for profiling, targeted advertising, or marketing.

4. Third Party Service Providers

We share data only with verified infrastructure providers essential to delivering the service:

• Shopify: The ecommerce platform hosting your store and processing subscription billing via Shopify App Pricing.
• Railway: Cloud application server hosting our web service.
• Neon: Secure cloud PostgreSQL database hosting, with full encryption in transit and encryption at rest.

5. Data Retention and Automated Deletion

We retain your settings and consent records for the duration of your active installation.

When you uninstall CheckGuard, Shopify dispatches an automated app/uninstalled webhook to our server. Upon receiving this webhook, our systems automatically delete your store settings and customer consent records from our active databases within 48 hours.

6. Shopify Privacy Compliance (GDPR and CCPA)

CheckGuard fully supports Shopify mandatory privacy compliance webhooks:

• Customer Data Request (customers/data_request): If a customer requests their data, we furnish any associated consent logs to the merchant.
• Customer Redaction (customers/redact): If a customer requests data deletion, we permanently erase or anonymize all matching consent records.
• Shop Redaction (shop/redact): If a merchant requests data erasure, all remaining store configurations and logs are completely purged from our backups within 30 days.

7. Security

We protect your data using industry standard technical and operational safeguards:

• All web communications use HTTPS encryption with modern TLS protocols.
• Database storage is hosted on secure isolated clusters encrypted at rest.
• Access to production databases is restricted to authorized engineers with multi factor authentication.

8. Contact Information

If you have questions, feedback, or privacy requests regarding this Privacy Policy, please contact us at:

Email: explato.hq@gmail.com
Company: Explato