Doorcheck Privacy Policy

1. Overview

Doorcheck: Age Verification (“the App”) is a Shopify application by ShopOpsy that shows an age confirmation popup on a merchant’s online store. This policy explains what data the App collects, how it is used, and how it is protected. The App is free to install. Charges are optional and one-time: a payment that removes a small ShopOpsy icon from the popup, and policy-writing services ordered in the App.

Your use of the App is also governed by our Terms of Service. For the ShopOpsy website, see the website Privacy Policy.

2. Data we collect

Merchant data

When you install the App, we store the following information linked to your Shopify store:

• Shop domain: to identify your store and link it to your settings.
• Access token: an offline access token issued by Shopify, used only to authenticate the App for your store. The App uses no staff (online) tokens, so it stores no name, email or other personal data of you or your staff, except what you type into a policy-writing order form (below).
• Popup settings: the text and its translations, colors, fonts, layout, logo and image addresses, custom CSS, verification method, minimum age, remember period, redirect address, the page, collection, product, tag, country and device rules, the timing, and any additional popups you set up in the App.
• Uploaded images: logos and background images you upload for the popup. They are stored in the App’s database and shown on your storefront through Shopify’s app proxy. Images your saved settings no longer use are deleted when you save.
• Statistics: if statistics are on (the default; you can turn them off in Settings), the number of times per day the popup was shown, passed and refused on your store. Only these daily totals are stored, with nothing about the visitors. Totals older than 400 days are deleted.
• Storefront summary: whether an age checkbox is on, the highest and default minimum age, the country ages, and the collections, products and tags each popup covers, kept in a metafield owned by the App on its own installation, so your theme knows when to load the App’s script and what the “Age notice” block shows.
• Closed notices: which in-app notices you closed (for example the setup guide) and when, so they stay closed.
• Purchases: if you buy the removal of the ShopOpsy icon, the Shopify charge ID, whether it was a test charge and the purchase date. Payments are handled by Shopify and billed on your Shopify invoice; the App never sees payment details.
• Policy-writing orders: if you order a policy-writing service, the service, its price, the Shopify charge ID and status, the answers you give in its order form (such as your business name, contact emails, the tools you use and how your store handles data, returns and shipping) and the order dates. Your answers are emailed to ShopOpsy through Resend so we can write the policy, and we use them only for that order.
• Support chat: the App’s admin pages (not your storefront) include a Crisp chat window so you can contact us. Crisp receives your shop domain, the messages you send and any name or email you choose to give, plus the technical data a chat needs (such as IP address and browser), and sets its own cookies in the App’s admin pages. These conversations are stored by Crisp, not in the App’s database, and are used only to answer you.

Customer and visitor data

The App does not collect, store or process personal data of your customers or visitors.

• The visitor’s answer is kept in the visitor’s own browser in a first-party cookie named soav_age_verified that holds only the minimum age the visitor confirmed (for example 18), so that a popup asking a higher age on some products can ask again. It contains no personal data and no date of birth. It lasts for the number of days set in the App (30 by default), or until the browser is closed if you turned off “Remember the visitor’s answer”. It is a strictly necessary cookie: without it the popup would appear on every page. It is never read by the App’s servers.
• Date of birth and age range: when you use the date of birth or age range method, the answer is checked inside the visitor’s browser against your minimum age and then discarded. It is never sent to the App’s servers, to Shopify or to anyone else, and never stored.
• Page, language and country: to decide whether the popup applies and which text to show, the script reads what your theme already knows about the current page (the product, its collections and tags, the collection), the store language and the visitor’s country as set by your store’s markets. This happens in the browser; none of it is sent to the App.
• Statistics events: if statistics are on, the browser tells the App, through Shopify’s app proxy, that the popup was shown, passed or refused. The request contains only that word, no identifier and no cookie. The App adds one to your store’s total for the day and stores nothing else about the request.
• Age checkboxes: if you turn on the checkbox before checkout or before Add to cart, a ticked box is remembered in the browser’s session storage (soav_cart_confirmed) until the browser is closed.
• Preview mode: the “Preview on my store” button opens your store with ?soav_preview=1, which sets soav_preview in that browser tab’s session storage. While it is set, answers aren’t remembered, counted or added to the cart. It is removed when the tab is closed or with ?soav_preview=0.
• Age notice: the optional “Age notice” block is rendered by your theme from the storefront summary above. It runs no script and collects nothing.
• Age confirmation on the order: if you turn it on, confirming adds the cart attribute “Age confirmed” (for example “Yes, 18+ (self-declared)”) to the visitor’s Shopify cart, so it appears on the order. It is stored by Shopify with the order; the App never receives it. On Shopify Plus, the optional “Age confirmation” checkout block adds the same attribute in checkout.
• ShopOpsy icon: unless you removed it, the popup shows a small ShopOpsy image served from Shopify’s CDN, like the popup’s script and styles. It is not a link and collects nothing.
• Popup settings cache: the storefront keeps a copy of your popup settings in the browser’s session storage for up to 5 minutes so that it doesn’t download them on every page. It contains only your popup settings.
• The App does not use the Shopify Customer Privacy API, third-party analytics, advertising or tracking of any kind, and sets no other cookies. The statistics above are anonymous totals kept by the App itself.

3. How we use your data

Your data is used only to:

• Show the popup, the age checkboxes and the age notice on your store as you configured them.
• Show you the statistics of your popup.
• Authenticate the App with Shopify.
• Remember whether you bought the removal of the ShopOpsy icon.
• Write the policies you order, and contact you about that order.
• Answer you when you contact us through the support chat.

We do not use your data for marketing, we do not send you marketing emails, and we do not sell or rent your data or share it with third parties other than the service providers listed below.

4. Data storage and security

• Data is stored in a PostgreSQL database run by Neon (AWS us-east-1) and served by Vercel.
• All communication between the App, Shopify and the storefront uses HTTPS.
• Storefront requests for the popup settings, images and statistics go through Shopify’s app proxy, which signs every request; the App rejects unsigned requests.
• Access tokens are stored through Shopify’s official session storage library.

5. Data retention and deletion

• Your settings are kept while the App is installed.
• When you uninstall the App, its access tokens are deleted immediately. Your settings are kept for 48 hours in case you reinstall.
• 48 hours after uninstall, Shopify sends a shop data erasure request, and the App permanently deletes everything it holds for your store: settings, uploaded images, statistics, closed notices, purchase records, policy-writing orders and any remaining tokens. Shopify keeps its own record of the charge.

6. GDPR and privacy webhooks

The App supports Shopify’s mandatory privacy webhooks:

• Customer data request: the App stores no customer data, so there is nothing to return.
• Customer data erasure: the App stores no customer data, so there is nothing to erase.
• Shop data erasure: all data for the shop is permanently deleted.

7. Third-party services

• Shopify: the App runs on Shopify’s platform and APIs.
• Hosting: Vercel (application) and Neon (PostgreSQL database), which process the merchant data listed above on our behalf.
• Email: Resend (resend.com), which delivers the answers from a policy-writing order form to ShopOpsy on our behalf.
• Support chat: Crisp (crisp.chat), on the App’s admin pages only, which processes support conversations on our behalf. It is never loaded on your storefront and receives no data about your customers or visitors.

The App does not integrate with any third-party analytics, tracking or advertising service.

8. Important note about age verification

The popup asks visitors to confirm their own age. It doesn’t verify identity or age and is not a substitute for any legal age-verification obligation. Merchants are responsible for checking which rules apply to the products they sell and the countries they sell to.

9. Changes to this policy

We may update this policy. Changes will be published on this page with a new “Last updated” date.

10. Contact

Questions about this policy or your data:

Email

hi@shopopsy.com

Website

https://www.shopopsy.com