Privacy Policy — Adulto for Shopify
Last updated: 2026-06-26
1. Who we are
Adulto for Shopify (“the App”) is published by 3node s.r.o. (“we”, “us”).
Contact: [email protected]
2. What data the App processes
2.1 Buyer data (stored in Shopify)
When a buyer completes age verification through the Adulto widget, the App writes the following to the buyer’s Shopify customer record:
| Field | Where | Content |
|---|---|---|
Customer metafield $app/adulto_verification | Shopify customer object | JSON: { uid, verified_at, status } |
| Customer tag | Shopify customer tags | adulto-verified |
No identity documents are ever stored by the App. Identity documents (e.g. national ID, passport scan) are submitted directly to the Adulto widget operated by M2A s.r.o. and never reach this App’s servers. The App receives only the opaque uid token that Adulto issues after a successful check.
2.2 Merchant data (stored in the App database)
| Field | Where | Content |
|---|---|---|
| Adulto sitekey | App database (AdultoConfig table) | Plain text (public identifier) |
| Adulto API key | App database (AdultoConfig table) | AES-256-GCM encrypted at rest using ADULTO_ENC_KEY |
| Shopify session tokens | App database (Session table) | Standard Shopify session data |
2.3 Data the App does NOT store
- Buyer names, email addresses, phone numbers, or other PII — these remain in Shopify
- Identity documents or biometric data — these remain with Adulto / M2A s.r.o.
- Payment information
3. Legal basis
The App is designed to help Czech merchants comply with Act No. 65/2017 Coll. on the Protection of Health from Harmful Effects of Addictive Substances and related Czech age-restriction legislation, which require merchants to verify that buyers of restricted goods (tobacco, alcohol, etc.) are 18 years of age or older.
The legal basis for processing is compliance with a legal obligation (Art. 6(1)(c) GDPR) and legitimate interests of the merchant in limiting liability (Art. 6(1)(f) GDPR).
4. Sub-processors
| Sub-processor | Role | Location |
|---|---|---|
| Shopify Inc. | E-commerce platform; stores customer metafields and tags | Multinational (data processed per merchant’s Shopify data region) |
| M2A s.r.o. (Adulto) | Age verification service; issues verification uid | Czech Republic |
5. Data retention
- Buyer verification data (metafield + tag) lives with the Shopify customer record and follows Shopify’s own retention policies. Merchants may delete individual customer records from their Shopify admin at any time.
- App configuration data (sitekey, encrypted API key) is deleted when a merchant uninstalls the App and the
shop/redactGDPR webhook is processed (within 48 hours of the request). - Shopify session data is deleted on
shop/redactalongside the configuration data.
6. GDPR webhooks
The App implements all three mandatory Shopify GDPR compliance webhooks:
customers/data_request— Acknowledges the request (HTTP 200). The customer’s verification data (the$app/adulto_verificationmetafield andadulto-verifiedtag) is held within Shopify’s own customer record, not in this app’s database, and can be provided by the merchant directly from their Shopify admin.customers/redact— confirms that the App holds no PII for the buyer (the uid token is not linked to identity by the App).shop/redact— deletes allAdultoConfigandSessionrows for the shop.
7. Buyer rights
Buyers wishing to exercise rights under GDPR (access, erasure, portability) should contact the merchant (the data controller) via the merchant’s own privacy policy. Merchants may then remove the metafield and tag from the customer record in their Shopify admin.
8. Security
Merchant API keys are encrypted with AES-256-GCM before being written to the database. The encryption key (ADULTO_ENC_KEY) is never stored in the database and must be managed as a secret environment variable by the App operator.
9. Contact
For privacy enquiries related to this App:
3node s.r.o. — [email protected]