SETROASFLOW: SHOPIFY PRIVACY & DATA PROTECTION DOCUMENT

Version: Draft, 26 August 2026

SetRoasFlow supports Shopify through a Web Pixel and order webhooks.

Consent:

Where a Shopify consent attribute srf_consent is available, it is used for the consent state. Otherwise the geo-aware consent model applies using the billing-country signal available to the webhook.

Privacy webhooks:

• customers/data_request

• customers/redact

• shop/redact

Webhook authenticity:

HMAC verification is implemented.

Merchant responsibility:

The Shopify merchant remains responsible for its customer-facing privacy notice, consent configuration and lawful processing purposes.

Data handling:

SetRoasFlow is intended to operate as processor for merchant-controlled customer data. The Shopify merchant determines the purposes and lawful basis.

The positioning stated here is reviewed against Shopify's current requirements before any app submission. This point is being finalized with counsel; write to [email protected] for the current position.