Privacy Policy & Shopify / GDPR / CCPA Data Governance
This Privacy Policy governs all applications, plugins, and web tools operated by MerchantBastion (https://merchantbastion.com, https://api.merchantbastion.com, and https://id.merchantbastion.io). Data protection inquiries are handled directly at privacy@merchantbastion.com.
1. Data Controller, Data Processor Role & Zero Data Sale Commitment
When a merchant installs a MerchantBastion application on Shopify or activates a WooCommerce / Bulk CSV license, MerchantBastion acts as the Data Controller solely for merchant account and subscription billing metadata, and strictly as a Data Processor / Service Provider on behalf of the merchant for any statutory compliance records processed under the merchant's instructions.
- Zero Advertising or Data Brokerage: MerchantBastion never sells, rents, shares, or monetizes merchant or shopper data with advertisers, data brokers, or generative AI training datasets.
- Zero Storefront Password Storage & Zero Tracking Cookies: Neither
merchantbastion.comnor our Online Store 2.0 Theme App Extensions collect separate account passwords or set third-party behavioral tracking cookies.
2. Minimal Shopify OAuth Scopes & Protected Customer Data (PCD) Matrix
In strict compliance with Shopify's Minimal Scope Principle, each MerchantBastion app requests only the permissions technically necessary for its compliance workflow. Two of our four flagship apps operate with Protected Customer Data: NONE (zero shopper personal data), and zero apps ever request direct theme-file write access (write_themes) or legacy storefront script injection:
| Application | Protected Customer Data (PCD) Status | Exact Requested Shopify OAuth Scopes | Explicitly Prohibited (Never Requested) |
|---|---|---|---|
| App 03 — 3-Continent Product Safety & DPP QR GPSR + US CPSC + Prop 65 + UKCA |
Protected Customer Data: NONE Processes 0 shopper personal records. |
read_products, write_products, read_metaobjects, write_metaobjects (product metafields & operator profiles). |
read_orders, read_customers, write_themes, legacy script tags. |
| App 04 — Unified ADA + CCPA Sec-GPC:1 + EU EAA Fixer WCAG 2.1 AA Source Remediation |
Protected Customer Data: NONE Aggregate non-personal GPC signal counts only. |
read_products, write_products, read_online_store_pages, write_online_store_pages, read_themes (read-only contrast & overlay check). |
read_orders, read_customers, write_themes, legacy script tags. |
| App 01 — VIES VAT Shield & Global B2B Tax Vault EU VIES + US MTC/SST + AU ABN |
GDPR Art. 6(1)(c) Statutory Tax Obligation Corporate B2B VAT/ABN/Resale & shipping jurisdiction. |
read_orders, write_orders, read_customers, write_customers, write_validations, write_cart_transforms. |
read_products, write_products, write_themes, read_shopify_payments_disputes. |
| App 02 — ShieldPack: Chargeback Defense PDF Visa CE 3.0 & Mastercard Dossiers |
GDPR Art. 6(1)(f) & Art. 17(3)(e) Legal Claims Disputed order fulfillment, AVS/CVV/3DS & delivery proof. |
read_orders, read_fulfillments, read_shopify_payments_disputes, write_shopify_payments_dispute_evidences. |
write_orders, write_customers, read_products, write_themes. |
3. Statutory Tax & Audit Record Retention Schedule (10-Year EU · 7-Year US · 5-Year ATO)
Pursuant to GDPR Article 17(3)(b) (compliance with a statutory legal obligation) and regional tax statutes, corporate tax exemption proofs must remain verifiable during national tax authority inspections:
- European Union (10-Year Statutory Retention): Under Council Directive 2006/112/EC Article 247 and Article 138(1a), corporate B2B VAT numbers, cross-border transaction timestamps, and official 16-digit European Commission VIES consultation proof certificates are retained in an immutable ledger for 10 years. Personal contact names and emails are anonymized upon a
customers/redactrequest. - United States (7-Year Statutory Retention): Executed MTC Uniform Sales & Use Tax Certificates, Streamlined Sales Tax (SST) Form F0003, and state-specific resale forms (NY Form ST-120, FL DR-13, CA CDTFA-230) carrying ESIGN Act vector signatures, masked IP logs, and SHA-256 integrity digests are retained for 7 years for state Department of Revenue audit defense.
- Australia (5-Year Statutory Retention): Under the Taxation Administration Act 1953 (Cth) and ATO Ruling GSTR 2013/1, 11-digit ABR ABN verification logs, 47% No-ABN PAYG withholding flags, and Tax Invoice audit records are retained for 5 years.
- Chargeback Representment Drafts (App 02): Scrubbed immediately upon
customers/redactonce no active card-network representment window (7 to 21 days) remains open.
4. Mandatory Shopify GDPR Compliance Webhooks & shop/redact Deletion Guarantee
All MerchantBastion Shopify applications register mandatory compliance endpoints (/api/webhooks/gdpr) authenticated against raw HTTP request bodies via constant-time HMAC-SHA256 verification. Any webhook lacking a valid X-Shopify-Hmac-Sha256 signature is immediately rejected with HTTP 401 Unauthorized.
customers/data_request: Compiles and returns any order-linked B2B tax or dispute records within under 2 seconds (HTTP 200 OK). For Apps 03 and 04, confirms zero personal shopper records are stored.customers/redact: Immediately scrubs personal individual identifiers (contact name, personal email, client IP replaced with[REDACTED]) while preserving strictly non-personal corporate VAT, ABN, and Resale audit proofs required by statutory tax law.shop/redactDeletion Guarantee: Within 48 hours of app uninstallation, MerchantBastion permanently purges the merchant's OAuth access tokens, session credentials, and cached scan records (while leaving previously written Product Mediaalttexts and exported PDF certificates intact for the merchant). Merchants may also request immediate manual erasure at any time via privacy@merchantbastion.com.
5. California CCPA / CPRA & Global Privacy Control (Sec-GPC: 1) Compliance
Under the California Consumer Privacy Act (CCPA / CPRA, Cal. Civ. Code § 1798.135) and comparable US state privacy laws (Colorado, Connecticut, Texas, Virginia):
- MerchantBastion honors browser-level Global Privacy Control HTTP headers (
Sec-GPC: 1) and DOM privacy signals automatically, returningX-MerchantBastion-GPC-Honored: 1; mode=do-not-sell-or-sharewithout forcing intrusive cookie-banner friction. - In our ADA & EAA Source A11y Fixer (App 04), the lightweight sub-8 KB App Embed bridges detected
Sec-GPC: 1signals directly to Shopify's native Customer Privacy API to disable non-essential sale, sharing, marketing, and analytics tracking automatically.
6. WordPress.org & WooCommerce External Services Transparency (Guidelines #6 & #7)
Our standalone WordPress and WooCommerce plugins (eu-vies-vat-shield, eu-gpsr-dpp-label-passport, and ada-eaa-gpc-source-fixer) execute core HPOS checkout checks, local QR generation, and [mb_accessibility_statement] rendering locally on the merchant's WordPress server with zero frontend visitor tracking. External HTTPS calls to https://api.merchantbastion.com, https://id.merchantbastion.io, or official European Commission VIES endpoints occur solely when explicitly configured by the store administrator.