Checkout Toolkit KSA Privacy Policy

Checkout Toolkit KSA stores no data about your customers. The address check runs inside Shopify's own checkout infrastructure as a Shopify Function, so the delivery address never reaches our servers. What we hold is your store's domain, an access token, and the settings you choose in the app.

• Your .myshopify.com domain and an offline access token for the Shopify Admin API, so the app can create and update its own checkout rule. The token is kept in the app's private database and is never shown in the interface or shared.
• Your settings: which address line is checked, strict or tolerant format, and the error messages in Arabic and English. These are stored as a metafield on the checkout rule inside your Shopify store, not in our database.

That is the complete list. There is no other record of your store.

At the moment of checkout, Shopify runs our validation function with the cart's delivery address (address lines, country), the checkout language, and the settings above. The function returns only a yes/no result and an error message. It runs within Shopify; our servers do not receive, store, log or transmit any of it.

The app does not request access to orders, customers or protected customer data. If a future version reads order data after checkout, this policy will be updated before that version is released.

Nothing. The app uses offline access tokens, so it holds no staff member names, emails or session details.

The admin app and its database are hosted on Railway. Railway processes the store records above and standard request logs (timestamps, request paths, error messages, store domain) on our behalf under its own data processing terms. No customer data exists to share.

We do not sell data, and we do not use your data to train models.

• The access token: for as long as the app is installed. Shopify notifies us when you uninstall and the token is deleted immediately.
• After you uninstall: Shopify sends a shop/redact request 48 hours later, and we erase anything that remains for your store. You do not need to ask.
• Server request logs: kept by the hosting provider for a short period for reliability, then discarded.

You can also email us to have your data erased sooner.

You can ask us what we hold about your store, ask for a copy, ask for corrections, or ask for erasure. Email privacy@zolodigital.com and we will respond within 30 days.

We respond to Shopify's mandatory customers/data_request, customers/redact and shop/redact webhooks. The two customer topics return nothing, because no customer data exists to return. Customers should contact the merchant they purchased from; the merchant controls their order data in Shopify.

Access tokens are kept in the app's private database and never exposed in the interface. All traffic runs over HTTPS. Access to production data is limited to the operator of the service.

If a breach affects your data, we will notify you and the relevant supervisory authority within 72 hours of becoming aware of it.

Material changes will be announced in the app before they take effect. The date at the top of this page always reflects the current version.

Contact: privacy@zolodigital.com