Effective September 12, 2026. Pcnaid Inc. operates IDGate Pro. When the app processes shopper or customer data for a Shopify merchant, the merchant is the controller and Pcnaid Inc. acts as its processor. Pcnaid Inc. is the controller of merchant-account, security, billing, support, and service-observability data used to operate the app.

In plain terms: the merchant decides why shopper data is processed, and Pcnaid processes it on the merchant’s behalf and instructions. For the shop’s own account, billing, and support data, Pcnaid makes those decisions itself.

Merchant and staff data can include the Shopify shop identifier and domain, installed scopes, access and refresh tokens, session state and expiry, and Shopify-associated staff details such as identifier, name, email, locale, account-owner status, and collaborator status. The app also stores plan and subscription state, onboarding confirmations, and merchant settings such as age rules, display text and colors, permitted document types, policy version, and optional integration configuration.

Customer-directory data can be imported from Shopify or entered by a merchant. It can include a Shopify customer identifier, email address, first and last name, phone number, city, province, country, order count, synchronization time, verification status, and last-verification time. A storefront email or customer identifier is not trusted unless Shopify or the identity provider attests the identity.

For simple self-certification, the app receives the entered date of birth long enough to calculate age, but does not save that date of birth. A successful record stores the applicable minimum age, country and state codes reported by the browser, policy version, any required terms acceptance, and time of verification. Attempt records can contain a keyed hash of the network address, user-agent text, outcome, and time. The raw network address is not stored in the verification-attempt table.

For enhanced verification, Didit is the production-selected identity provider and Stripe Identity is the rollback option. The provider receives the document, date of birth, and any selfie or biometric input required by the merchant’s configuration. IDGate Pro stores provider and session references, lifecycle and redaction status, verification and error timestamps, the minimum age applied, and the derived verified or denied age. It does not copy the date of birth, government-ID images, verification reports, or biometric artifacts into its database. The identity provider remains the system of record for those materials.

Operational records include verification retry and checkout-proof state, webhook delivery receipts, rate-limit counters, privacy-request payloads and generated data exports, and ordinary and tamper-evident compliance audit entries. (“Tamper-evident” means each audit entry is cryptographically linked to the one before it, so a later edit or deletion is detectable.) Audit details can include internal entity identifiers, event outcomes, actor identifiers, and sanitized operational metadata.

IDGate Pro runs on Azure Container Apps and stores application and Shopify-session data in an Azure-hosted PostgreSQL database. Shopify provides merchant authentication, commerce APIs, webhooks, metafields, extensions, and subscription billing. Didit provides the production identity-verification flow; Stripe Identity is the supported rollback provider.

Sentry, PostHog, and Datadog are configured for error diagnosis, product analytics, and browser or server observability. Those services can receive app and release identifiers, a shop identifier when available, event names, error details, and technical request, device, or browser context. If a merchant enables an outbound event webhook or Texas Verified evidence forwarding, the configured destination receives the verification event or evidence fields selected by that feature. Texas Verified is a separate Pcnaid Inc.-operated product, so enabling this forwarding sends the data to another Pcnaid Inc. service rather than to an outside company (an intra-company transfer, not a transfer to an unaffiliated third party), and it is subject to the same data-handling commitments described in this policy.

Data can also be disclosed when required by law, to protect the service and its users, or in connection with a business transaction subject to appropriate safeguards.

While a merchant has the app installed, records are retained as needed to provide, secure, audit, and reconcile the service and meet legal obligations. Expired rate-limit counters are removed by a scheduled cleanup. Incomplete identity sessions more than 24 hours old are canceled or deleted when the cleanup can reach their provider; their local lifecycle record remains until an applicable purge or privacy request.

On uninstall, the implemented webhook deletes Shopify sessions immediately, marks the shop uninstalled, and retains the remaining tenant records during a recovery and compliance window. The cleanup job’s current default is 30 days after uninstall, although the operator can configure that interval. After the interval, the job first requests deletion or redaction for every inventoried Didit or Stripe Identity session and then deletes the shop and its related PostgreSQL records. A provider-deletion failure leaves the local references in place so deletion can be retried instead of losing the record needed to complete it.

IDGate Pro authenticates Shopify’s customers/data_request, customers/redact, and shop/redact webhooks. A customer data request creates a PostgreSQL export for merchant review containing the matching local customer, verification, and audit data; the app does not email that export automatically.

Customer redaction requests first request deletion or redaction of the customer’s provider sessions, then delete matching customer, verification, export, and ordinary audit records. Shop redaction deletes the shop’s Shopify sessions, handles its provider sessions, and then deletes the compliance chain and remaining tenant records. The app acknowledges these operations only after its deletion checks succeed.

A shopper seeking access, correction, or deletion should contact the Shopify merchant whose storefront requested verification. The merchant can then use Shopify’s privacy process or contact Pcnaid Inc. for assistance.