Privacy policy

This policy explains what the Checkoutlab Shopify app and the checkoutlab.nl website collect, why, how long it is kept and who else is involved. Checkoutlab is operated by Root Agency, registered in the Netherlands under Chamber of Commerce number 95339043 (“we”, “us”). Questions go to hello@root-agency.nl.

What it comes down to: the app stores how many checkouts and orders fell into each arm of your experiment. It reads no customer fields from the order webhooks it receives, never asks Shopify for a name, email address, postal address or customer ID, and has no advertising, profiling or data-selling business behind it.

Our two roles

For data about your store and your staff, we are the controller. That covers your shop domain, your subscription and trial status, and the details Shopify supplies when a staff member opens the app.

For data about your customers, we are a processor and you are the controller. We process it only to deliver the app's results to you, on your instructions, and for no purpose of our own. The data processing terms in our Terms of Service form the data processing agreement between us; no separate signature is needed.

What we collect through Shopify's APIs

The app requests four access scopes and nothing more:

• read_orders, which Shopify classifies as protected customer data. We request the minimum access level and read no customer fields from the payloads at all.
• read_markets, for the market picker when you configure an experiment.
• read_payment_customizations and write_payment_customizations, to create the app's own Shopify Function and switch it on and off.

Through those, and the webhooks you authorise on install, we receive and store:

• Your shop. The myshopify domain, the Shopify access and refresh tokens for your shop, the granted scopes, and your subscription and trial status.
• Your staff. What Shopify supplies when a staff member opens the embedded app, used to render it and for nothing else.
• Checkouts and orders. From the checkouts/create and orders/create webhooks: a checkout token and an order ID, the order total and currency, the names of the payment methods used, and the cart attributes the app itself wrote (the arm, the market handle and the device class).

What we do not store: customer names, email addresses, phone numbers, billing or shipping addresses, customer IDs, IP addresses, line items, product data, your theme, or your Shopify password. We never request the scopes that would grant most of them, and we do not read the ones that happen to travel on an order payload.

A checkout token and an order ID point at a person indirectly, so we treat those rows as personal data even though they contain no identifying field. They are there to deduplicate Shopify's at-least-once webhook delivery and to make an erasure request actionable. Without them there would be no way to find a given person's rows at all.

What happens in your customers' browsers

The app's theme app embed runs on your storefront to decide which arm a visitor is in. On a visitor's device it:

• Checks consent first. A visitor identifier in local storage is, under the GDPR, no different from a cookie. The embed therefore stores one only when Shopify's Customer Privacy API reports that analytics processing is allowed.
• Without consent, stores nothing. It falls back to the cart token, which already exists as a functional necessity of having a cart and is stable for as long as that cart is. The experiment keeps running and nothing is written to the device.
• Writes cart attributes on the cart, which Shopify carries into the checkout and onto the order. That is how the arm reaches both the checkout and our measurement.

No data is sent from a visitor's browser to our servers. There is no pixel, no tracking script, no fingerprinting and no third-party tag. Everything we learn about a checkout arrives afterwards, server to server, from Shopify.

What you give us directly

Whatever you put in a support mail: your address, your shop domain and the content of your message. We keep support correspondence for as long as needed to handle the matter and to answer a follow-up, and no longer than 24 months.

This website

checkoutlab.nl sets no cookies and runs no analytics, advertising or tracking scripts. It has no login and no forms. Our hosting provider keeps standard server logs, including IP addresses, for security and troubleshooting.

One third party is involved: the site loads its typefaces from Google Fonts, which means your browser requests files from Google's servers and Google receives your IP address and user agent in the process. That happens on this marketing website only, never inside the app in your Shopify admin and never on your storefront.

Why we use it

• To run the app you installed. Assigning arms, applying the variant in the checkout, and computing conversion, significance and the breakdowns on your results page.
• To bill you. Through the Shopify Billing API, and to run the trial clock. We never see or store your payment details.
• To support you and to fix bugs, including application logs that may reference a shop domain or an order ID.
• To meet legal obligations, including Shopify's mandatory privacy webhooks.

We do not use any of it to build profiles, to train models, for advertising, or to create benchmarks across stores. We do not sell personal information and we do not share it for cross-context behavioural advertising.

Legal bases where the GDPR applies: performance of our contract with you for everything the app does and for billing; our legitimate interest in a secure, working service for logs and security; and legal obligation for the compliance routes below. Buyer data is processed under your legal basis as controller, on your instructions.

How long we keep it

• Checkout and order rows: 400 days by default. You set the window yourself in the app's settings, anywhere from 30 to 1095 days. Expired rows are purged automatically.
• Your session and tokens: deleted immediately on uninstall.
• Everything else about your shop: deleted on the shop erasure request Shopify sends 48 hours after you uninstall. You do not have to wait for it: the app's settings page has a Delete all data button that runs the same erasure on the spot.
• Support mail: up to 24 months. Invoices: as long as tax law requires, which in the Netherlands is seven years. Shopify, not us, is the source for those.

Sub-processors and where data lives

All processing happens in the European Union. We have not appointed a sub-processor outside the EU for app data, so no standard contractual clauses or transfer mechanism is needed for it.

• Shopify Inc. The platform itself. It is the source of everything the app receives and the party that charges your subscription. Your relationship with Shopify is governed by Shopify's own terms and privacy policy.
• DigitalOcean, LLC. Application hosting. Region: DigitalOcean App Platform (Amsterdam, the Netherlands).
• Supabase, Inc. The managed Postgres database. Region: Supabase Postgres (AWS eu-central-1, Frankfurt, Germany).
• Our business email provider. Only the support correspondence you send us. Hosted in the European Union.
• Google LLC. Google Fonts, on this marketing website only, as described under this website. No app or storefront data reaches Google.

We will tell you before adding or replacing a sub-processor that handles your data, and you may object; see the data processing terms.

Security

Access and refresh tokens are encrypted before they are written to the database, with a key that lives outside it, so a database dump without that key is worthless. Row level security is switched on for every table with zero policies, and the public API roles have no grants on them. The full technical description, including what we deliberately do not do, is on Security & data processing.

Your rights, and your customers' rights

Where the GDPR or a comparable law applies, you have the right to access, correct, delete, restrict and port your personal data, and to object to processing based on legitimate interest. Mail hello@root-agency.nl and we will answer within 30 days. You may also lodge a complaint with your supervisory authority; in the Netherlands that is the Autoriteit Persoonsgegevens.

If one of your customers asks you about their data, you can handle it without contacting us. Shopify sends every app three mandatory privacy requests and the app acts on them automatically:

• A data request. We hold no personal data about a shopper, so there is nothing to disclose, and that is the answer. The request is logged so there is a record that it arrived and what was answered.
• An erasure request. We delete the order rows for the orders named, and the matching checkout rows with them, so no pseudonymous trace is left. The aggregate counts shift slightly as a result; an erasure that leaves the number behind is not an erasure.
• A shop erasure. Everything belonging to your shop, sessions included.

How those routes work is documented in detail.

Children

The app is a business tool and is not directed at children. We do not knowingly process data of anyone under 16.

Changes to this policy

We may update this policy. The date at the top changes with it, and a change that materially affects how we handle your data is announced by mail to the address on your Shopify account before it takes effect. Continuing to use the app after that date means the updated policy applies.

Contact

Root Agency
Chamber of Commerce (the Netherlands): 95339043
Email: hello@root-agency.nl
A postal address is available on request.

We have not appointed a Data Protection Officer: the scale and nature of the processing described above does not meet the threshold at which the GDPR requires one. Privacy questions reach a person directly at the address above.