Privacy policy

This policy explains what information the Obnold Checkout Rules Shopify app collects, how it is used, and how it is deleted. Obnold Checkout Rules lets a merchant hide, rename, and reorder payment and delivery methods at Shopify checkout.

Last updated: 5 October 2026

Customer personal data is not stored

The app does not store personal data about your customers. It does not request access to Shopify customer or order data: the permissions it asks for are limited to managing payment customizations, managing delivery customizations, and reading shipping configuration.

Checkout rules are enforced by Shopify Functions, which run inside Shopify. Where a rule depends on customer tags, customer login state, B2B status, destination country, or cart subtotal, those values are evaluated by Shopify at checkout and are never sent to or saved by the app. A rule contains only the tag label you type (for example VIP), not any customer record.

What the app stores

The app stores the store and configuration data it needs in order to run, all of it scoped to your store:

• Store identity — your .myshopify.com domain and your install and uninstall timestamps, used to identify your store.
• Shopify session credentials — the offline access and refresh token issued to the app, the permissions granted, and the token expiry, used to call the Shopify Admin API on your behalf.
• Your checkout rules — the rules you create: their names, the payment method names and delivery option titles they match, country codes, amounts and currency, tag labels, and whether each rule is on.
• Synchronisation state — configuration versions, the Shopify customization id, and the most recent Shopify API error message, used to keep the Shopify Functions in step with your settings.
• Subscription state — your plan handle, any scheduled plan change, the cancellation flag, the billing-cycle end date, and when the plan was last checked. Billing is handled by Shopify; the app stores no payment details.

Staff personal data is not collected. The app uses store-level (offline) sessions only, so the staff name, email, and user id columns that the Shopify session library defines are left empty.

How this information is used

Stored information is used only to operate the app for your store: to apply your checkout rules through Shopify Functions, to keep that configuration in sync, to apply the active-rule limit of your plan, and to support you if you ask for help. The app does not sell your data, does not use it for advertising, and does not use it to build profiles.

Shopify data handling

The app communicates with Shopify over HTTPS, and Shopify requires app URLs to use HTTPS. Calls to the Shopify Admin API use the session credentials described above. Shopify keeps its own records of Function executions; those are held by Shopify under Shopify’s terms, not by this app.

The app responds to Shopify’s mandatory compliance webhooks. Because no customer data is stored, customers/data_request and customers/redact are acknowledged with “no customer data stored”.

Deletion, retention, and redaction

• On uninstall — your Shopify session credentials are deleted when Shopify sends the app/uninstalled webhook. Your rules are kept for the time being so that reinstalling the app can restore them.
• On redaction — when Shopify sends the shop/redact webhook, which it does after an uninstall, the app deletes your store record and any remaining sessions. Your rules, rule conditions, synchronisation state, and subscription record are removed along with it.
• Database backups — the production database keeps encrypted automated backups for 1 day. Deleted records can remain in those backups until they expire.
• Application logs — kept for 30 days. Logs contain store domains, webhook topics, and Shopify API error messages. Customer data is not logged.

Security

Data is encrypted in transit and at rest. Traffic between Shopify and the app, and between the app and the Shopify Admin API, uses HTTPS. The database connection is encrypted and the app refuses to start in production without it. Database storage and backups are encrypted using managed AWS keys, and stored credentials and logs are encrypted by the AWS services that hold them.

Changes to this policy

If this policy changes, the updated version will be published at this address and the date above will be revised.

Contact

For privacy questions, or to ask about the data held for your store, contact Obnold through the support contact shown on the Obnold Checkout Rules listing in the Shopify App Store.