1. Overview & Architecture

RuleFort ("the App") is engineered with a strict data minimization architecture. The core checkout customization rules (Payment Customization, Delivery Customization, and Cart Validation) are executed natively within Shopify Functions (WebAssembly) directly on Shopify's secure global infrastructure.

2. Information We Do NOT Collect

The core functionality of the App does not require collecting, storing, transmitting, or monetizing any of the following buyer personal data:

Customer names, email addresses, or phone numbers
Full shipping or billing street addresses
Credit card numbers, bank details, or financial accounts
Customer purchase history or profile tracking across stores

3. Information We Store for Merchants

To authenticate merchants and provide the rule dashboard, we store the minimum app administration data needed for those purposes:

Shop identifier domain (e.g., your-shop.myshopify.com)
Merchant-configured rule definitions (thresholds, country codes, product SKUs, messages)
Shopify authentication sessions and access tokens
For online sessions, staff account details Shopify provides for authentication, such as user ID, name, email, locale, and account role flags

Subscription status is queried from Shopify when needed and is not copied into a separate RuleFort subscription table.

4. Use, Processing, and Retention

We use merchant data to authenticate the app, manage and publish checkout rules, enforce plan limits, and respond to support or security issues. RuleFort does not sell this data. Shopify provides the commerce and billing platform, and Cloudflare provides application hosting and D1 database processing.

App data is retained while needed to provide the installed service and to meet applicable legal obligations. Installation sessions are removed when Shopify notifies us of an uninstall, and remaining shop rules and sessions are removed when Shopify sends the shop erasure webhook.

5. GDPR / CCPA Compliance & Data Erasure

We process Shopify's mandatory privacy webhooks as follows:

customers/data_request: Responds to Shopify compliance webhooks confirming no buyer personal data is stored.
customers/redact: Responds to Shopify compliance webhooks confirming no buyer personal data is retained.
shop/redact: Processes Shopify shop erasure webhooks to delete store rule definitions and session records.

6. Security & Contact