​

Privacy

​

1. What this app is

ConsentAI is a Shopify app that adds a required Terms & Conditions consent checkbox to a merchant’s storefront and records evidence of each consent event. Pcnaid Inc. operates the app and acts as a data processor on behalf of the merchant (the data controller) for the consent evidence it stores.

​

2. Consent evidence — the only shopper data collected

When a shopper checks the consent box and proceeds, the app records an immutable consent row: the consent text shown, a snapshot of the policy link shown, a timestamp, the shop domain, page context, the storefront page’s URL (which can include query-string data), optional structured metadata the storefront passes (such as currency, locale, or settings version), and the cart/session/request identifiers available at that time. Shopify’s secret ?key= cart-token suffix is removed before storage or export. After Shopify reports the order through its authenticated orders/create webhook, the app requires a signed-body Order GID, numeric order number, and valid offset-bearing creation time before writing a separate sealed binding containing the Shopify order fields, checkout token when present, and matching normalized cart token. Only consent rows timestamped at or before that signed order time qualify. Bare numeric order IDs and Order GIDs use one positive numeric storage form; the GID scheme, host, and Order type are compared case-insensitively, and every other App Proxy form is rejected before storage or sealing. Before querying those rows, the app checks the signed order ID against HMAC-only order-redaction tombstones and acknowledges a match without writing a binding. An App Proxy consent request that directly supplies a tombstoned order ID is rejected before its consent row is inserted. The order creation time is used only for the eligibility comparison and is not copied into the binding; the binding timestamp records when the app appended it. If Shopify reports no cart token, an invalid timestamp, or a non-order payload, the app does not guess an order link. If the storefront session provides a customer email or customer id, those are recorded too. The browser’s User-Agent string is stored. The shopper’s IP address is never stored in raw form — it is hashed with per-shop HMAC-SHA256 before being written.

​

3. What the app does not collect

The app requests only read_metaobjects, write_metaobjects, read_metaobject_definitions, write_metaobject_definitions, read_products, write_products, read_themes, read_orders. The metaobject/product/theme scopes publish policy content and detect whether the storefront embed is enabled. read_orders is used only to receive the authenticated orders/create webhook and bind an existing cart consent to that order; the app does not query a customer list or general order history and does not request read_customers. Shopify’s Protected Customer Data declaration must cover this order data. The storefront consent script uses no third-party analytics or advertising trackers. The separate admin-app observability sub-processors are disclosed in §5. Pcnaid does not sell data or share it beyond those sub-processors.

​

4. Storage, security, and retention

Consent evidence is stored securely with access restricted to the merchant’s own shop. All storefront-to-app traffic is verified through Shopify’s signed App Proxy — there are no public, unsigned consent endpoints. Consent records and their linked order records can only be changed or removed through GDPR-required redaction or deletion flows. Evidence is retained while the app is installed and, after uninstall, until Shopify sends its data-deletion request, since it is compliance evidence the merchant may need to produce; the history visible in the admin UI is plan-dependent (7 days on Free, 30 days on Pro, unlimited on Advanced).

​

5. Sub-processors

For the consent evidence described in §2, the sub-processors are Shopify (platform, identity, billing, App Proxy) and Microsoft Azure (application hosting and database). The storefront consent-checkbox script itself is dependency-free and talks only to the app’s own signed App Proxy endpoint — no shopper data from that script reaches any other third party.

Separately, the embedded admin app (used by the merchant and their staff, not shoppers) sends usage and error data to Sentry (error monitoring), PostHog (product analytics — including the shop domain on install), and Datadog (performance monitoring), for Pcnaid’s own operation of the service.

​

6. GDPR / CCPA data-subject handling

The app implements all three Shopify mandatory compliance webhooks: customers/data_request (produces an authenticated, merchant-only 30-day snapshot of the shopper’s consent evidence and any linked orders), customers/redact (removes the shopper’s personal identifiers and consent evidence when Shopify reports that erasure is required, including for guest orders), and shop/redact (deletes the shop’s evidence and configuration when the app is removed, keeping only a minimal receipt that confirms the deletion and prevents any delayed data from being restored). A shopper who wants their data accessed or deleted should contact the merchant, who triggers these flows through Shopify.

​

7. International transfers

Data is processed in the United States (Azure region: the app service and database are in Central US). Merchants with region-specific obligations should account for this.

​

8. Changes to this policy

Material changes will be reflected on this page with an updated “Last updated” date.

​

9. Contact