AtlasCore Market

Shopify Legal addendum · Legal version v1 · Last updated: July 13, 2026

Shopify API Terms & Compliance

Last updated: August 23, 2026

This addendum summarizes AtlasCore alignment with the Shopify API License and Terms of Use and Partner Program requirements for connected Shopify stores.

Independent application status

AtlasCore is an independent software application. Shopify and related marks are trademarks of Shopify Inc. AtlasCore is not sponsored, endorsed, or affiliated with Shopify.

Authorized API use

AtlasCore accesses Shopify Admin API data only after explicit merchant OAuth consent. Scopes requested are limited to operational features enabled in the connected dashboard (catalog, orders, inventory where authorized). Live writes use `write_products` (catalog create/update) and `write_inventory` (at most one inventory decrement per Shopify `order_id` across `orders/create` and `orders/paid`; the ledger mark is committed before `inventorySetQuantities`; lookup failures fail closed). Shopify OAuth HMAC redirects require a present `timestamp` within ±300 seconds.

Data handling controls

- Token encryption: OAuth access and refresh tokens are encrypted at rest (AES-256-GCM).

  • Transport security: Production traffic uses TLS 1.2+.
  • Tenancy: Each AtlasCore user may link their own Shopify store (B2C user scope); cross-user store access is denied at the API layer. When `X-Tenant` is supplied, Shopify accounts, the order cache, and webhook ledger rows use a workspace `tenant_id` overlay after membership validation. Unified order snapshots remain keyed by merchant user and Shopify order id.
  • Webhooks: Incoming Shopify webhooks are verified with HMAC-SHA256. After HMAC success, `X-Shopify-Webhook-Id` is required. Duplicate webhook ids are rejected for the full active ledger lifetime on operational and GDPR topics. GDPR and `orders/*` payload hashes are also rejected for the full ledger lifetime. Merchant disconnect and `shop/redact` purge webhook ledger rows by shop domain. Delayed webhooks cannot restore fields after retention redaction.
  • Allowlisted operational snapshots: Unified Shopify order storage, `orders/*` ledger rows, and product / inventory / billing webhook rows keep operational fields only. Buyer email, phone, and full shipping or billing address dictionaries are not stored in those snapshots.
  • Mandatory GDPR webhooks: AtlasCore registers Shopify `customers/data_request`, `customers/redact`, and `shop/redact` endpoints. Customer redact/export matching uses Shopify-provided `orders_to_redact` / `orders_requested` ids only and does not link AtlasCore user accounts by buyer email. If those id lists are omitted, the job completes without scanning minimized snapshots by email. Data subject requests may also be fulfilled via AtlasCore Export My Data when authenticated.

Protected customer data

Where Shopify protected customer data is accessed, AtlasCore minimizes local caching and honors merchant disconnect and shop redact workflows.

Retention uses a 30-day post-fulfillment clock that starts at AtlasCore's first observation of an exact-match terminal state (`fulfillment_status == "fulfilled"` or `financial_status == "refunded"`) and a 90-day unfulfilled ceiling from unified-snapshot insert time / cache `created_date` or first pull time. Paid-only and `orders/create` states do not count as fulfilled.

Seller controls

- Disconnect Shopify in AtlasCore to stop sync, purge stored credentials, and run a shop-domain webhook-ledger lifecycle purge.

  • Uninstall the AtlasCore app from Shopify Admin to revoke tokens at the source.
  • Contact privacy@atlascore-market.com for data subject requests.

See our Privacy Policy and Disconnect Marketplace guide.