Privacy Policy

Last updated: October 24, 2026.

CaseGate ("we", "our", or "us") is operated by Yadun Know (sole proprietor), Toronto, Ontario, Canada. Contact: support@getcasegate.com.

1. Information We Access from Shopify Stores

When a merchant installs CaseGate from the Shopify App Store, we request only the narrow Shopify API scopes required to configure and enforce cart and checkout order limits:

• read_products & write_products: to allow merchants to select products, variants, and collections for order-limit rules and store rule configuration metafields.
• read_customers: used solely within Shopify's Cart & Checkout Validation Function runtime to check non-identifying customer tags (such as wholesale or vip) when a merchant configures customer-tag rules.
• write_validations: to register and activate the native Shopify Cart & Checkout Validation Function on the merchant's store.

2. Zero Shopper PII Storage

CaseGate executes cart and checkout validation rules inside Shopify's serverless Function WebAssembly runtime. We do not collect, log, or store shopper names, email addresses, shipping addresses, phone numbers, IP addresses, or payment details on our servers.

3. Merchant Configuration & Billing Data

• Store Configuration: We store the merchant's shop domain (*.myshopify.com), OAuth access token, subscription tier, and configured order-limit rules in encrypted Cloudflare KV storage.
• Billing: Subscriptions are billed through the Shopify Billing API (appSubscriptionCreate) or Stripe Checkout. We never view or store full payment card numbers.

4. Mandatory Shopify GDPR & Privacy Webhooks

CaseGate implements and verifies all mandatory Shopify privacy webhooks using HMAC-SHA256 validation:

• customers/data_request & customers/redact: Because CaseGate never stores shopper personal data, these webhooks confirm zero customer PII is held.
• app/uninstalled & shop/redact: Immediately deletes the merchant's stored shop record, OAuth token, and rule configurations from our database.

5. Data Retention & Your Privacy Rights (PIPEDA & GDPR)

Store rule records are deleted automatically upon app uninstallation. Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), the EU/UK GDPR, and applicable US state privacy laws, merchants may request access to, correction of, or deletion of their account data at any time by emailing support@getcasegate.com.