RuleKit privacy policy

Data we store

• Shop and access data. Your shop's myshopify.com domain and the access token Shopify gives RuleKit, with the granted permissions and token expiry dates. We need these to read and save your rules through Shopify's API.
• Your rules. The rules you create are saved in your own Shopify store (as app data on RuleKit's checkout functions), not on our servers.

Customer data

RuleKit does not collect or store personal data about your customers. During checkout, Shopify runs RuleKit's rules inside Shopify with the cart, the shipping address (address lines, postal code and country, to check PO box and country rules) and whether the customer has certain tags, as far as a rule needs them. This data stays within Shopify and is never sent to us.

Billing

Subscriptions are billed by Shopify. To show your plan and apply plan limits, RuleKit asks Shopify which plan your shop is on and keeps the answer in memory for a few minutes. We never see payment details.

Service providers

RuleKit runs on Cloudflare (hosting; it keeps short-lived technical request logs) and stores the shop and access data above in a Neon Postgres database. Both process data only to run RuleKit.

Retention and deletion

When you uninstall RuleKit, we delete your shop and access data right away, and Shopify removes RuleKit's checkout rules from your store. We also handle Shopify's data deletion requests (shop/redact, customers/redact).

Your rights

You can ask what data we hold about your shop, or ask us to correct or delete it. Depending on where you live (for example under the GDPR or CCPA) you may have further rights; contact us to use them.

Changes

We'll update this page when RuleKit's data handling changes, and change the date at the top.