Privacy Policy

1. Roles in data processing

1.1. The App processes Personal Data in two distinct contexts, with different roles:

• Store Consumer Data (buyers who interact with the checkout): the Merchant is the Controller and IDCLIP acts as Processor, processing the data under the Merchant's instructions, as set out in the Data Processing Addendum (DPA).
• Merchant Data (account, contact, App usage, and revenue): IDCLIP acts as Controller, as this data is processed to enable the relationship with the Merchant itself.

2. Data we process

2.1. Data provided by the Merchant or collected in the relationship

• Identification and contact data of the store owner (name, email, and other Shopify account data);
• Store configuration data and alert preferences (Slack, email, WhatsApp, webhooks);
• Usage records, access logs, and technical App data (date/time, IP address, dashboard session identifiers).

2.2. Data accessed via Shopify APIs (processed as Processor, on behalf of the Merchant)

To monitor the checkout and diagnose failures, the App accesses, according to the scopes authorized at installation:

• Customer/Consumer data: name, email, phone, and address, as well as sensitive, device, and activity data, when made available by the platform;
• Order and checkout data: cart items, amounts, coupons, shipping and payment options, checkout status and events;
• Checkout navigation and behavior data: steps taken, fields with errors, abandonment points, and friction signals;
• Error and anomaly data: gateway, shipping, and coupon failures, and other technical events detected in the checkout steps;
• Store data and analytics: order and performance metrics required for diagnosis.

Data minimization. We process only the Personal Data strictly necessary for the App to function. Whenever possible, we use aggregated or anonymized data.

3. Purposes of processing

• Monitor the Store's checkout in real time and detect failures, errors, and friction;
• Generate diagnostics, alerts, webhooks, and reports for the Merchant;
• Identify the source of problems (buyer, operations, shipping, or payment) and enable the assignment of responsibility towards third-party suppliers;
• Provide support, ensure security, prevent fraud and abuse, and comply with legal and regulatory obligations;
• Operate, maintain, and improve the App, including through aggregated/anonymized data;
• Produce benchmarks and comparative analyses of checkout performance, as well as prepare, publish, and distribute studies, reports, indices, and materials about the e-commerce market and checkout performance, always from aggregated and anonymized data that does not allow identification of the Merchant, the Store, or the Consumers, pursuant to Clause 8.3 of the Terms of Use.

4. Legal bases (LGPD, art. 7 and art. 11)

Processing relies, as applicable, on the following legal bases:

• Performance of a contract (art. 7, V) — to provide the features contracted by the Merchant;
• Legitimate interest (art. 7, IX) — for security, fraud prevention, improvement of the App, and the production of aggregated and anonymized analyses and studies, always with impact assessment and safeguards;
• Compliance with a legal or regulatory obligation (art. 7, II);
• Consent (art. 7, I, and art. 11, I), where required.

With respect to Consumer Data, defining the legal basis is the responsibility of the Merchant, in its capacity as Controller. IDCLIP processes such data under the Merchant's instructions.

5. Sharing and sub-processors

5.1. IDCLIP does not sell Personal Data. Sharing occurs only in the cases below:

• Infrastructure providers acting as sub-processors, under contract and security and confidentiality obligations — Cloudflare (data ingestion) and Supabase (data persistence/storage);
• Shopify, as the platform on which the App operates;
• Alert channel providers chosen by the Merchant (for example, Slack, email provider, and WhatsApp), when the Merchant configures them;
• Public authorities, when required by law, court order, or legitimate request;
• In corporate reorganizations, with the obligations of this Policy maintained.

The list of sub-processors is detailed in the Data Processing Addendum (DPA).

6. International data transfers

6.1. Cloud providers and Shopify may process or store data outside Brazil. In such cases, IDCLIP adopts safeguards compatible with the LGPD (art. 33), such as adequate contractual clauses and the engagement of providers offering equivalent protection guarantees.

7. Retention and deletion

7.1. Personal Data is kept only for as long as necessary for the purposes of this Policy. Checkout event history is retained according to the period of the plan contracted by the Merchant (for example, 30, 60, 90, or 180 days), after which it is deleted or anonymized.

7.2. Some data may be kept for longer when necessary to comply with a legal obligation, to exercise rights, or by order of an authority.

7.3. Once the relationship with the Merchant ends, Personal Data processed as Processor is deleted or returned as set out in the DPA, except where retention is legally required.

7.4. The deletion of Personal Data does not affect previously aggregated and anonymized data which, because it does not allow identification of a natural person, may be kept and used by IDCLIP under item 3 of this Policy and Clause 8.3 of the Terms of Use.

8. Information security

8.1. IDCLIP adopts technical and administrative measures to protect Personal Data, including:

• Encryption of data in transit and at rest;
• Access control based on the principle of least privilege, and authentication;
• Logging, monitoring, and environment segregation;
• Internal security and confidentiality policies and periodic supplier assessment.

8.2. No system is completely immune to incidents. In the event of a security incident that may pose a relevant risk to data subjects, IDCLIP will notify the Merchant and, where applicable, the Brazilian National Data Protection Authority (ANPD) and the data subjects, under the LGPD.

9. Data subject rights

9.1. Under art. 18 of the LGPD, the data subject may request: confirmation that processing exists; access to the data; correction; anonymization, blocking, or deletion of unnecessary data or data processed in non-compliance; portability; information about sharing; and withdrawal of consent.

9.2. When IDCLIP acts as Processor, Consumer requests should, as a rule, be addressed to the Merchant (Controller). IDCLIP will assist the Merchant in responding, as set out in the DPA.

9.3. Requests may be sent to the Data Protection Officer at dpo@checkoutsentry.com. We may request information to confirm the requester's identity.

10. Cookies and technologies in the dashboard

10.1. The App's dashboard may use cookies and similar technologies strictly necessary for authentication, security, and operation of the service. Non-essential cookies, if used, will follow the applicable legal bases.

11. Data Protection Officer (DPO)

11.1. IDCLIP provides a channel for matters related to Personal Data and to this Policy:

• Data Protection Officer (DPO): dpo@checkoutsentry.com
• Controller: IDCLIP APLICATIVOS E SOLUÇÕES LTDA — Rua Areobaldo Pinto dos Santos, nº 04, Santos Dumont, Vila Velha/ES, CEP 29.109-340, Brazil

12. Changes to this Policy

12.1. This Policy may be updated at any time. The current version will always be identified by the “last updated” date and made available on the App's page and on the official website. Material changes will be communicated through reasonable means.

13. Governing law and venue

13.1. This Policy is governed by Brazilian law, with the courts of the District of Vila Velha, State of Espírito Santo, elected, without prejudice to legally mandatory venues, such as that of the consumer's domicile.