ENDE
Install on Shopify

Legal

Privacy Policy

Last updated: 4 October 2026

Disclaro (“we”, “us”, “our”) provides a Shopify application that helps merchants review their storefront content for potential regulatory compliance issues.

Information we access

When a merchant installs Disclaro, the app may access Shopify store information necessary to provide the service, including:

  • Store domain and basic shop information
  • Product titles and descriptions
  • Pages and collection content
  • Relevant product meta fields
  • Merchant-provided compliance answers and settings

Disclaro does not require or intentionally collect customer personal information such as customer names, addresses, payment information or order histories for its current compliance-scanning functionality.

How we use store information

We use store information to:

  • Scan storefront content for potential compliance issues
  • Generate and display findings to the merchant
  • Identify which storefront surfaces may require review
  • Support rescanning and detect when relevant store content changes
  • Maintain evidence associated with compliance findings

Information we store

Disclaro may store:

  • Shopify store identifier/domain
  • Compliance findings
  • Rule and ruleset versions used during scans
  • Content hashes used to detect changes
  • Matched evidence, including limited text snippets copied from merchant-authored storefront content where needed to explain a finding
  • Merchant compliance answers and fact-set history
  • Finding status, including dismissals and review actions

We aim to store only the information required to operate the service and provide reproducible compliance findings.

Customer data

Disclaro’s current functionality does not use Shopify customer or order data to perform compliance scans.

Shopify may nevertheless send mandatory privacy requests to Disclaro. We maintain the required Shopify privacy webhooks for customer data requests, customer deletion requests and shop deletion requests.

Data retention and deletion

When Shopify sends a valid shop deletion request following uninstall, Disclaro deletes the stored data associated with that shop.

We maintain encrypted backups of our production database for security, resilience and disaster recovery. Backups are encrypted before being stored with Amazon S3 in the EU and are automatically deleted after approximately 31 days, subject to temporary retention protections designed to prevent accidental or unauthorised deletion.

Merchants may also contact us to request access to, or deletion of information associated with their Disclaro account.

Data sharing

We do not sell merchant or customer personal information.

We use service providers necessary to operate Disclaro. Our production application and database infrastructure are hosted through Railway, we use Amazon S3 for encrypted database backups, and we use Sentry for production error monitoring and diagnostics. Service providers may process information only as necessary to provide their services to us.

We may also disclose information where required by law or where necessary to protect the security, rights or integrity of Disclaro and its users.

Error monitoring and diagnostics

We use Sentry to detect and diagnose unexpected technical errors in Disclaro. For this purpose, Sentry may receive limited operational information such as the Shopify store domain, affected route or operation, error type, scan stage, and limited technical counts used to understand a failure.

Disclaro is configured not to intentionally send scanned storefront content, finding evidence, merchant compliance answers, request bodies, cookies, authentication tokens, customer or staff names or email addresses, or Shopify authentication query parameters to Sentry.

Security

We use reasonable technical and organisational measures designed to protect information processed by Disclaro from unauthorised access, loss, misuse or alteration.

International processing

Disclaro’s production application and database infrastructure are hosted by Railway in its EU West region in Amsterdam, Netherlands.

Encrypted production database backups are stored using Amazon S3 in the EU (Stockholm, Sweden).

Sentry error-monitoring data is configured for processing in Sentry’s EU/Germany region.

Information may also be processed in other countries where Disclaro or its service providers operate. Where required by applicable data protection law, appropriate safeguards are used for international transfers of personal information.

Merchant responsibilities

Disclaro provides tools to assist merchants with reviewing potential compliance issues.

Merchants remain responsible for their own legal compliance and for determining whether changes to their storefront are required.

Your rights

Depending on your location, you may have rights relating to personal information, including rights to access, correct, delete or restrict its processing.

To make a privacy request, contact us using the details below.

Changes to this policy

We may update this Privacy Policy from time to time.

The latest version will be published at the same Privacy Policy URL with an updated revision date.

Contact

Disclaro
Email: hello@disclaro.com