Privacy Policy

Last updated: 2026-08-18

This policy describes what ConsentKit ("we") collects, why, and how long we keep it. It applies to merchants who install the ConsentKit Shopify app and to visitors of stores that use it.

1. What we collect

From merchants (the Shopify store owner)

• Shop domain (e.g. example.myshopify.com) — how we identify your store.
• OAuth session token — how we authenticate API calls to Shopify.
• Configuration settings — region mode, plan tier.

We do not receive customer names, emails, addresses, or order data.

From storefront visitors (your customers)

• Anonymous visitor ID — a random string generated in the visitor's browser; not linked to any name, email, or account.
• Consent choice — accept/decline/custom, plus which categories.
• Approximate country — from the connecting IP by Cloudflare (CF-IPCountry). The IP itself is not stored.
• User agent — first 255 characters, for debugging.
• Timestamp.

We do not use cookies to track visitors across stores. We do not sell data. We do not run ads.

2. Why

Consent records exist so merchants can demonstrate compliance with GDPR, ePrivacy, and CCPA/CPRA if a regulator asks. Configuration data lets the app remember its settings between sessions.

3. Where the data lives

On Cloudflare's global network — session tokens in Workers KV, settings and consent events in D1 (SQLite). Cloudflare's own privacy practices apply as a data processor.

4. Retention

• Session tokens: deleted immediately when a merchant uninstalls.
• Settings + consent events: deleted within 48 hours of uninstall, when Shopify sends the mandatory shop/redact webhook. Merchants can request earlier deletion by email.
• Individual customer redaction: because visitor IDs are anonymous and not linked to Shopify customers, we typically cannot map a customer to specific consent rows. We respond to customers/redact requests by confirming no personally identifying data is held.

5. Sharing

We do not share consent data with third parties. We use Cloudflare Workers, D1, and KV as sub-processors — no other vendors.

6. Your rights (visitors)

Under GDPR/CCPA you have the right to access, correct, or delete personal data about you. Because we store no identifiers linking a consent row to you personally, we usually cannot fulfil an individual request. You can reopen the consent banner at any time on the store where it's installed to withdraw or change your consent.

7. Contact

Questions or requests: zahariaanton95@gmail.com.