Privacy Policy

Lockage ("the App") provides age verification gating ("the Service") to merchants who use Shopify to power their stores. This Privacy Policy describes how personal information is collected, used, and shared when you install or use the App in connection with your Shopify-supported store.

Personal Information the App Collects

When you install the App, we are automatically able to access certain types of information from your Shopify account:

• Shop — Information about your store (name, domain, plan, timezone)
• Products — Information about your products (IDs, titles, vendors, tags)
• Collections — Information about your collections
• Themes — Information about your store's active theme (for Theme App Extension delivery)

Additionally, we collect the following information once you have installed the App:

• Install and uninstall date and time
• Age restriction configuration (minimum age, targeted products/collections/vendors)
• Customisation settings (background image references, colours, text)
• IP addresses of storefront visitors (used for rate-limiting and analytics; not stored long-term)

We collect personal information using the following technologies:

• Cookies — A session cookie is set in your customer's browser after they confirm their age, remembering their verification for the duration of that browser session.
• Log files — Server logs track actions and collect data including IP address, browser type, and timestamps.

How Do We Use Your Personal Information?

We use the personal information we collect in order to provide the Service and to operate the App. Specifically:

• To display the age gate on the correct product pages based on your configuration
• To remember that a visitor has already confirmed their age for the current session
• To allow you to configure and manage age restriction rules in the Lockage admin

We do not sell your personal information or your customers' personal information to third parties.

Sharing Your Personal Information

We share your Personal Information with third parties only to help us provide our services:

• Shopify — We operate on the Shopify platform and share information as necessary to provide the App.
• Fly.io — Our application infrastructure provider.
• Neon — Our managed Postgres database provider where app configuration is stored securely.

We may also share your Personal Information to comply with applicable laws and regulations, to respond to a subpoena, search warrant or other lawful request, or to otherwise protect our rights.

Your Rights

If you are a European resident, you have the right to access personal information we hold about you and to ask that your personal information be corrected, updated, or deleted. Please contact us using the information below to exercise these rights.

Data Retention

We maintain your configuration data for as long as you have the App installed. When you uninstall the App, we will delete your data within 30 days, unless we are required by law to retain it. Visitor session cookies expire when the browser is closed.

GDPR Data Requests

Lockage processes mandatory Shopify GDPR webhooks:

• Customer data request — We will provide a summary of any customer data we hold upon request.
• Customer data erasure — We will delete all data associated with a specific customer upon request.
• Shop data erasure — We will delete all store data within 30 days of a shop redact request.

Changes

We may update this privacy policy from time to time to reflect changes to our practices or for other operational, legal, or regulatory reasons.