SetRoasFlow Shopify Compliance Guide

Version: 1.0.0 Last Updated: July 2026

1. Purpose

This document explains how SetRoasFlow complies with Shopify's requirements for public applications.

It is intended for:

• Shopify reviewers;
• Merchants;
• security teams;
• enterprise customers.

This document should be read together with the Privacy Policy, Terms of Service and Data Processing Addendum.

2. Platform Overview

SetRoasFlow is a server-side tracking platform designed for Shopify merchants.

Its primary purpose is to:

• collect ecommerce events;
• validate event payloads;
• route events to advertising platforms;
• improve attribution accuracy;
• reduce data loss caused by browser limitations;
• simplify server-side tracking.

SetRoasFlow is not a customer relationship management platform and is not intended to replace Shopify as the system of record.

3. OAuth Authorization

Merchants connect their Shopify stores using Shopify's OAuth authorization flow.

During installation:

• the Merchant authenticates with Shopify;
• Shopify presents the requested permissions;
• the Merchant explicitly grants access;
• Shopify returns an authorization token;
• SetRoasFlow stores only the credentials necessary to provide the Services.

Access is never obtained without Merchant authorization.

4. Requested Access Scopes

SetRoasFlow requests only the scopes required for its functionality:

• read_customer_events
• read_orders
• write_pixels

SetRoasFlow follows the principle of least privilege and does not request unnecessary permissions.

5. Use of Shopify APIs

SetRoasFlow uses official Shopify APIs to:

• receive shop information;
• synchronize configuration;
• receive webhooks;
• retrieve data required for event processing;
• maintain application functionality.

API usage follows Shopify rate limits and technical requirements.

6. Webhooks

SetRoasFlow subscribes only to the Shopify webhooks required to provide the Services and to satisfy Shopify's mandatory privacy-compliance requirements:

• orders/create — the authoritative purchase event used for conversion tracking;
• customers/data_request — mandatory compliance webhook for customer data-access requests;
• customers/redact — mandatory compliance webhook for customer data deletion;
• shop/redact — mandatory compliance webhook for deletion of shop data after uninstallation.

Webhook authenticity is verified using HMAC signature validation before any processing. Webhook subscriptions are limited to those necessary for providing the Services and meeting Shopify's compliance obligations.

7. Customer Privacy

SetRoasFlow is designed to support Merchant compliance with applicable privacy laws.

Merchants remain responsible for:

• obtaining user consent;
• publishing privacy notices;
• honoring opt-out requests;
• complying with Shopify Customer Privacy requirements.

The platform does not determine whether consent has been obtained.

8. Customer Privacy API

Where required, SetRoasFlow supports Shopify's Customer Privacy framework.

Merchants are responsible for configuring consent banners and consent management platforms in accordance with applicable law.

SetRoasFlow respects Merchant configuration when processing events.

9. Data Minimization

SetRoasFlow processes only the information reasonably necessary to provide the Services.

The platform is designed to avoid unnecessary collection of Personal Data.

Merchants should avoid transmitting:

• payment credentials;
• unnecessary sensitive information;
• confidential internal notes;
• unrelated customer information.

10. Data Deletion

Upon receiving supported Shopify privacy requests or account termination events, SetRoasFlow will process deletion requests in accordance with:

• applicable law;
• Shopify requirements;
• the Data Processing Addendum;
• the Data Retention Policy.

Where SetRoasFlow acts solely as a processor, requests are handled according to Merchant instructions.

11. App Uninstallation

When the Shopify application is uninstalled:

• Shopify notifies SetRoasFlow through the official webhook;
• API access tokens are revoked or invalidated;
• synchronization stops;
• future event processing ceases unless the Merchant reinstalls the application.

Merchant data is retained only as described in the Data Retention Policy.

12. Security

SetRoasFlow protects Shopify-related information using measures including:

• encrypted communications;
• authenticated API requests;
• secure credential storage;
• role-based access controls;
• infrastructure monitoring;
• audit logging.

Access to production systems is restricted to authorized personnel.

13. Third-Party Integrations

Merchants may choose to send events to supported third-party platforms, including:

• Meta Ads;
• Google Ads;
• TikTok Ads;
• Pinterest Ads;
• Snapchat Ads;
• Reddit Ads;
• Klaviyo.

These integrations are enabled solely at the Merchant's direction.

14. Compliance Responsibilities

SetRoasFlow is responsible for:

• securing the application;
• maintaining the platform;
• processing Merchant instructions;
• protecting data in transit;
• implementing technical safeguards.

Merchants remain responsible for:

• lawful collection of Personal Data;
• consent management;
• privacy notices;
• advertising compliance;
• configuration of integrations.

15. Contact

Questions regarding Shopify compliance may be directed to:

Email: [email protected]

Website: https://setroasflow.com

Version History