SETROASFLOW — SHOPIFY PRIVACY & DATA PROTECTION DOCUMENT

Version: Draft — 25 August 2026

SetRoasFlow supports Shopify through a Web Pixel and order webhooks.

Consent:

Where a Shopify consent attribute srf_consent is available, it is used for the consent state. Otherwise the geo-aware consent model applies using the billing-country signal available to the webhook.

Privacy webhooks:

• customers/data_request

• customers/redact

• shop/redact

Webhook authenticity:

HMAC verification is implemented.

Merchant responsibility:

The Shopify merchant remains responsible for its customer-facing privacy notice, consent configuration and lawful processing purposes.

Data handling:

SetRoasFlow is intended to operate as processor for merchant-controlled customer data. The Shopify merchant determines the purposes and lawful basis.

[LAWYER REVIEW REQUIRED: confirm current Shopify privacy/compliance requirements and contractual positioning before submission or publication.]