Shopify Data Protection & Privacy (DPP) Compliance

- Product catalog and inventory levels for workspace synchronization

• Order headers (totals, status, line-item counts) for operational dashboards
• Allowlisted operational webhook snapshots (order id, order number, line-item titles/SKUs/quantities, financial status, fulfillment status, currency, and totals)

- Encryption: OAuth access and refresh tokens are encrypted at rest using AES-256-GCM with the `enc:v1:` storage prefix. Webhook payloads and unified channel order snapshots use the same encryption standard.

• Transport: All production API traffic uses TLS 1.2+ (HTTPS).
• Webhook verification: Inbound Shopify webhooks require valid HMAC-SHA256 signatures (`X-Shopify-Hmac-Sha256`) over the raw request body. After HMAC success, `X-Shopify-Webhook-Id` is required; deliveries without that identifier are rejected.
• Durable webhook deduplication: Duplicate `X-Shopify-Webhook-Id` values are rejected for the full active webhook ledger lifetime on both operational and GDPR topics. GDPR jobs and `orders/*` deliveries also reject a duplicate payload hash for the full ledger lifetime. Other operational topics use a short-window payload-hash check. After scheduled ledger retention (ciphertext scrub, then hard delete), those identifiers are no longer active. Delayed webhooks cannot rehydrate an order after retention redaction.
• Allowlisted operational ledger: Non-GDPR `orders/*` bodies and unified order snapshots store operational fields only (order id, order number, line-item titles/SKUs/quantities, financial status, fulfillment status, currency, and totals). Product, inventory-level, and App Subscription billing events are stored as operational snapshots (ids, titles/SKUs, quantities, subscription name/status) rather than unrestricted raw dictionaries. Buyer email, phone, and address dictionaries are not stored in those snapshots.
• Inventory idempotency: `write_inventory` decrements at most once per Shopify `order_id`. The ledger commits `_inventory_adjusted_order_id` before the Admin API mutation. A failed ledger lookup or missing event id fails closed and does not call `inventorySetQuantities`.
• OAuth handshake freshness: Shopify OAuth HMAC redirects require a `timestamp` query parameter within ±300 seconds.
• Tenancy: Shopify seller data is B2C user-scoped. When a request supplies `X-Tenant`, Shopify accounts, the `shopify_orders` cache, and webhook ledger rows use a workspace `tenant_id` overlay after membership validation. Unified order snapshots are keyed by merchant user and Shopify order id (not workspace tenant). Missing `X-Tenant` uses the signed-in user's personal scope.

- `customers/data_request` — customer data export requests (persisted before HTTP 200, processed durably). Export is limited to Shopify order and shop records matching `orders_requested` ids. AtlasCore user accounts are not linked by buyer email.

• `customers/redact` — customer data erasure requests. Matching uses Shopify `orders_to_redact` ids.
• `shop/redact` — shop data erasure after app uninstall. Purge is shop-domain scoped (credentials, cached orders, and webhook ledger rows for that `*.myshopify.com` store).

- 30 days post-fulfillment: Encrypted order snapshots and the PII-safe `shopify_orders` cache are redacted or deleted 30 days after AtlasCore's first observation of a terminal state (`fulfillment_status == "fulfilled"` or `financial_status == "refunded"`). Paid-only, `unfulfilled`, and `orders/create` events do not start this clock.

• 90-day unfulfilled ceiling: Orders that never reach a terminal fulfillment or refunded state are redacted or deleted 90 days after unified-snapshot insert time (`created_at`) or cache `created_date` / first pull time.

- Disconnect Shopify in AtlasCore to revoke ongoing sync, purge encrypted credentials for your workspace, and run a shop-domain webhook-ledger lifecycle purge.

• Uninstall the AtlasCore app in Shopify Admin for immediate token invalidation at the source.
• Request account deletion at Delete Account or contact privacy@atlascore-market.com.