This Privacy Policy explains how Address Validator (“we”, “us”) collects, uses, stores and protects information in connection with the Address Validator application (the “App”) for the Shopify platform. The App checks shipping addresses during checkout, offers autocomplete suggestions and corrections, and applies the merchant’s delivery rules, so that merchants ship to fewer wrong addresses.
For personal data of a store’s customers (buyers) that the App processes, the merchant (the Shopify store) is the data controller and we act as a data processor on the merchant’s behalf and instructions. For data about the merchant and their store account, we act as a data controller.
*.myshopify.com) and store identifiers.When a buyer reaches checkout in a store that has the App installed, the App processes:
orders/create webhook: the order identifier and number, the customer identifier, the buyer’s name, email address and phone number, and the order’s shipping address. These let the merchant see, in the App’s Order history, which order each address check belonged to, and let us answer data-subject requests.The only thing the App ever writes to an order is a single tag, address-validator-block-not-enforced, added when the merchant’s own delivery rule or validation setting was meant to stop the checkout but Shopify’s “Allow app to block checkout” setting was off, so the order was placed anyway. The tag contains no personal data; it exists so the merchant can find such orders in their Shopify admin. The App never changes an order’s contents, customer details or status.
Where the GDPR or UK GDPR applies, we rely on:
For buyer personal data we act on the merchant’s instructions as processor; the merchant is responsible for the lawful basis towards its customers.
shop/redact request, 48 hours after the merchant uninstalls the App — or earlier, on the merchant’s request to support@address-validator.app.All data is transmitted over HTTPS. Requests from the checkout are authenticated with Shopify-issued session tokens and webhooks are verified by HMAC signature before any processing. Access to production systems and secrets is restricted, and secrets are never stored in source code. Every read of buyer data — by store staff in the App's Order history, or by Shopify through a data request — is recorded in an access log kept for 90 days, and we maintain a security incident response policy that covers containment, assessment and notifying affected merchants within 72 hours.
If you are a buyer, the merchant whose store you shopped at is the controller of your data — please direct access or deletion requests to that merchant. We fulfil Shopify’s mandatory privacy requests on the merchant’s behalf, automatically:
customers/data_request — we return every address check and order record we hold for the customer.customers/redact — we erase the customer’s stored addresses, name, email and phone number.shop/redact — we delete all data for the store.Depending on your location, you may have rights to access, correct, delete, restrict or object to the processing of your personal data, and to data portability (GDPR/UK GDPR). California residents (CCPA/CPRA) may request to know or delete personal information and to opt out of “sale”/“sharing” — we do not sell or share personal information as those terms are defined.
Merchants may contact us at support@address-validator.app to access, correct or delete their account data, or uninstall the App at any time to stop further processing.
Our public website uses Google Analytics 4, provided by Google, to measure visits, pages viewed, scrolling and clicks on outbound links. Analytics cookies are set only after you click “Accept” in the cookie banner; until then (or if you decline) no analytics cookies are stored. Google may process this data outside your country, including in the United States. We do not use it for advertising. You can change your choice by clearing this site’s data in your browser, after which the banner is shown again. The website analytics are separate from the App: nothing described in this section runs in a store’s checkout or admin.
The App is a business tool for merchants and is not directed to children. We do not knowingly collect personal data from children.
We may update this Privacy Policy from time to time. Material changes will be reflected by updating the “Last updated” date above and, where appropriate, by notifying merchants through the App.
Questions about this policy or about your data: support@address-validator.app.