Introduction

This Privacy Notice explains how Humanmark SPC ("Humanmark," "we," "our," or "us") processes data when you use the Humanmark Shopify App ("App"). This notice is for merchants using our App, not for end customers who undergo verification.

For information about how we handle end-user verification data, see our main Privacy Policy at humanmark.app/privacy.

Our Role in Data Processing

Independent Service Provider: Humanmark operates an independent verification service. We are generally the data controller for information processed through our service.

• Merchant Account Data: We're the data controller for your account information, usage metrics, and communications with you
• Store Configuration: We process your configuration choices stored in Shopify metafields to deliver the service
• Verification Operations: We independently operate the verification network and determine how verifications are processed
• Customer Data: We never collect or store end-customer personal data - any PII in webhooks is immediately discarded

This means we determine the purposes and means of processing for our verification service, while ensuring we never retain your customers' personal information.

Information We Process

Merchant Information

We collect and store:

• Your Shopify store name and ID
• Admin email addresses for account management
• App configuration settings (primarily stored in Shopify metafields, may be cached in our systems)
• Usage metrics (number of verifications, success rates)

Billing information is collected and managed entirely by Shopify.

Store Data Access

Through Shopify's API, the App accesses:

• Product information (to identify protected products)
• Order data (to enforce verification requirements)
• Theme data (for integration)
• Validation configurations

Webhook Data Processing

Shopify sends us webhooks for various store events. We:

• Process webhooks immediately upon receipt
• Extract only the minimum data needed for verification
• Never store webhook payloads
• Automatically discard any customer PII contained in webhooks

Customer Data Handling

Important: While Shopify's webhooks and APIs may incidentally include customer personal information (names, emails, addresses), we:

• Never use or process this customer PII
• Never store or persist customer PII
• Immediately discard any customer PII that passes through our systems
• Only process cryptographic verification proofs that contain no personal information

How We Use Information

Merchant Data

• Provide and maintain the App
• Send service updates and support communications
• Monitor and improve App performance
• Comply with legal obligations

Note: Billing is handled entirely by Shopify; we don't process payment information.

Verification Data

• Process verification attempts to determine if requests come from humans
• Track verification counts against monthly allowances
• Detect and prevent abuse of the verification system

Data Sharing

We share data only as follows:

• With Shopify: As required for App functionality and billing
• Service Providers: Infrastructure providers (AWS, DigitalOcean, Cloudflare) under strict confidentiality
• Legal Requirements: If required by law or legal process
• No Sale of Data: We never sell merchant or customer data

Data Retention

• Merchant Data: Retained while you use the App and for 7 years after for legal requirements
• Configuration Data in Our Systems: Deleted within 30 days of App uninstallation
• Configuration Data in Shopify Metafields: Managed by Shopify (we lose access upon uninstall)
• Customer PII: Never retained (immediately discarded if received)
• Verification Logs: Anonymous logs retained for 30 days for troubleshooting
• Billing Records: Managed entirely by Shopify

Merchant-Initiated Data Deletion

• When you uninstall the App, Shopify automatically sends us a deletion request
• We delete any configuration and operational data in our systems within 30 days
• Configuration stored in Shopify metafields is managed by Shopify
• To request immediate deletion of our data, contact privacy@humanmark.io
• Billing and subscription data is managed by Shopify

Security

We implement industry-standard security measures including:

• Encryption in transit and at rest
• Access controls and monitoring
• Regular security assessments
• Secure development practices
• Incident response procedures

Your Rights and Responsibilities

Your Rights

• Access your merchant data
• Request correction of inaccurate data
• Request deletion (subject to legal retention requirements)
• Export your configuration and analytics data

Your Responsibilities

• Inform customers about Humanmark verification in your privacy policy
• Ensure you have legal basis to require verification
• Handle customer inquiries about verification
• Comply with applicable privacy laws for your customer data

Customer Privacy Requests

If your customers submit GDPR/CCPA requests regarding Humanmark:

• We cannot identify or retrieve customer data (we don't store it)
• No deletion action is needed since we auto-discard customer PII
• You can inform customers that Humanmark verification doesn't retain personal data
• Direct customer questions about verification to your support team first

International Data Transfers

Our servers are located in the United States. By using the App, you consent to the transfer and processing of data in the US. We rely on appropriate safeguards for international transfers.

Compliance

GDPR (European Merchants)

We process data under legitimate interests and contractual necessity. We will execute a Data Processing Agreement (DPA) upon request. We support data deletion requests via Shopify's webhooks and comply with all GDPR requirements for processors.

CCPA (California Merchants)

We act as a service provider and do not sell personal information. We automatically honor deletion requests through Shopify's uninstall webhook.

Shopify-Specific Compliance

We handle Shopify's mandatory GDPR webhooks for customer data requests, though no action is typically required since we don't retain customer data.

Other Jurisdictions

Contact us for specific compliance documentation for your jurisdiction.

Updates to This Notice

We may update this notice as our App evolves. Material changes will be communicated through the App or via email to your registered admin address.

Contact Us

Privacy Questions: privacy@humanmark.io
Data Processing Agreement: legal@humanmark.io
General Support: support@humanmark.io
Security Issues: security@humanmark.io

We typically respond within 2 business days.