Merchant terms and data processing

Agreement and scope

By installing or using ConsentDock, the merchant agrees to these terms and authorizes the processing described here and in the ConsentDock privacy policy. These terms apply only to the ConsentDock app and its Shopify extensions.

Merchant responsibilities

The merchant controls the rules, messages, retention actions, and optional export destinations it configures. The merchant is responsible for having a valid basis for collecting buyer responses, providing required notices, configuring rules suitable for its business, and responding to buyer requests through Shopify.

ConsentDock provides configuration, validation, and evidence tools; it does not provide legal advice or guarantee compliance with any particular law.

Data processing instructions

For personal data submitted through Shopify, the merchant acts as controller or business and ConsentDock acts as processor or service provider. ConsentDock processes that data only to provide, maintain, secure, and support the app; follow documented merchant settings; comply with applicable law; or protect the service.

ConsentDock does not sell buyer personal data, use it for cross-context behavioral advertising, or combine it with personal data received from unrelated sources for its own purposes.

Confidentiality and security

ConsentDock limits production access to authorized operators and service identities, uses encrypted transport and managed encrypted storage, logs evidence-record access, and maintains incident response and recovery procedures. Operators with access to personal data are subject to confidentiality and security requirements.

Service providers

ConsentDock uses Shopify for app installation, authentication, billing, checkout, storefront, order, and webhook services, and Google Cloud for hosting, database, backup, logging, and secret management. These providers process data only as needed to deliver their contracted services. A merchant-selected webhook destination is controlled by that merchant, not ConsentDock.

Deletion, return, and assistance

ConsentDock applies the retention periods described in its privacy policy and processes Shopify's mandatory customer and shop redaction webhooks. On termination or a valid deletion request, applicable data is deleted unless retention is required by law. Merchants may export eligible evidence before deletion and may contact support for reasonable help with privacy requests or security inquiries.

Security incidents

ConsentDock investigates suspected unauthorized access, contains affected systems, preserves appropriate diagnostic evidence, and notifies Shopify and affected merchants when required by applicable law or agreement. Merchants should promptly report suspected misuse through the support contact on the Shopify App Store listing.

Suspension and changes

ConsentDock may suspend access needed to protect Shopify, merchants, buyers, or the service. Material changes to these terms will be reflected by an updated effective date. Continued use after a change constitutes acceptance of the updated terms where permitted.