AppVerix Shipping Rates: Política de privacidade

Última atualização: 19 de outubro de 2026

AppVerix Shipping Rates (“the app”) is a Shopify app published by AppVerix (“we”, “us”). This policy explains what the app collects when a merchant installs it, why, where it is kept and how to have it deleted.

Rate rules are merchant records. The checkout rate callback receives a destination address from the platform to compute a rate; that address is not stored. For any customer data that stays in the platform, the merchant is the controller and we are the processor.

1. What we collect and why

From the merchant’s store, through the Admin API and the Carrier Service callback:

  • Shop domain: to identify the store and open the app in the admin. Stored.
  • An access token: so the app can stay installed and register the carrier service. Stored in the login session until you uninstall.
  • Your rate rules, fallback rates and hide/rename rules (names, zones, weight and total ranges, tags, collection ids, SKUs, product ids, amounts). Stored.
  • A compact product index (product id → tags/collections) so the rate callback does not call the Admin API. Stored.
  • Shop settings: admin language, which setup steps you ticked, detected store plan name, carrier-service id. Stored.
  • Billing state from the platform (plan active, trial or none). Stored as a cache.
  • Destination on a rate request (country, province, postal code, and sometimes name, phone, street): used in memory to match a zone, then discarded. Not stored.
  • Compliance log: the topic and a short summary of a privacy webhook. No names or emails.
  • If a welcome or cancellation email is sent, the store contact email is read at send time and is not stored by the app. Email is sent through Resend only when that key is configured.

2. What we do not collect

The app does not ask for access to orders or customer records, and it receives no order webhooks. It does not store customer names, emails, addresses, payment details or order contents. Cart contents on the rate callback are used in memory and discarded. The app sets no cookies and uses no analytics or advertising. A reconnect page in the admin may keep a first-party sessionStorage retry counter with no personal data.

3. Who processes data for us

Where data leaves the EEA/UK, we rely on the provider’s Standard Contractual Clauses or other approved transfer mechanisms.

  • Cloudflare (cloudflare.com): hosting for the app and its D1 database. Sees everything in section 1 that is stored. Globally distributed.
  • The commerce platform the app runs on, which also handles billing and sends the rate callback. See that platform’s privacy policy.
  • Resend (resend.com): merchant emails, only if a Resend API key is configured. Not configured by default.

4. How long we keep it

  • Rules and settings: while the app is installed.
  • When you uninstall: we delete the login session right away. The platform sends a shop/redact request about 48 hours later and we then delete the store’s rules, settings and compliance records.
  • A customer deletion request (customers/redact): we hold no stored customer personal data to delete; we log that it arrived.
  • Server logs: up to 7 days, without personal data.

5. Your rights and data requests

The app supports the three privacy webhooks: customers/data_request (we reply that we hold no stored personal data of that customer), customers/redact (nothing stored to delete; logged) and shop/redact (we delete all data of the store).

Merchants can also write to support@appverix.com for a copy of their data or to have it deleted. We answer within 30 days. A store’s customers should contact the store first. If you are in the EEA/UK you may complain to your local data protection authority. In Brazil the LGPD applies; contact us at the same address.

6. Security

  • All traffic uses HTTPS (TLS).
  • The database runs on Cloudflare D1, which encrypts data at rest.
  • Webhooks are verified by HMAC; unsigned requests are rejected.
  • The Carrier Service callback is authenticated by a secret token in the URL, not by storing the destination.
  • The app checks a session token on every admin request and uses no third-party cookies.
  • Access to production infrastructure is restricted and protected by two-factor authentication.
  • If a breach affects your data we tell you without undue delay, and within 72 hours where the law requires it.

7. Data processing agreement and security

For personal data of a store’s customers that we process (the in-memory destination on a rate request), the merchant is the controller and we are the processor. The AppVerix Adendo de processamento de dados sets out our commitments, and our security and incident response policy describes how we protect and handle data.

8. Changes and contact

If we change this policy in a way that matters, we update the date at the top and tell merchants in the app or by email. Contato: support@appverix.com