Privacy Policy
On this page
1. Introduction
This Privacy Policy explains how AdaChecked ("AdaChecked," "we," "us," or "our") collects, uses, discloses, and protects information when you install or use the AdaChecked application for Shopify (the "App"), visit our website, engage our services, or contact us (together, the "Service"). By using any part of the Service, you acknowledge the practices described here.
This Policy applies only to information handled by AdaChecked. It does not apply to information handled by Shopify or any other third party, including any third-party site you reach from ours. Your use of Shopify is governed by Shopify's own privacy policy.
2. Information we collect
Information you provide
When you contact us, request a scan or audit, sign up for a plan, or engage our services, we collect the information you choose to share — typically your name, email address, company or store name, website URL(s), the contents of your message, and, for directly-billed services, billing details.
Shopify store data (the App)
When you install the App, Shopify provides us with your store's .myshopify.com domain, your store's primary storefront domain, basic shop details (store name and the account owner's email, where Shopify supplies them), and an offline access token. Using only the scopes you approve at install — read_themes, read_products, read_content, and read_locales — we read your storefront's themes, products, pages, content, and locales for the sole purpose of running accessibility scans. We do not request, access, or store your customers' personal data or your order data. The App does not ask for any customer or order scopes.
Websites you submit (services)
To deliver audit, remediation, and monitoring services, we crawl, scan, and analyze the public-facing pages of the website(s) you submit or that we are engaged to review. We may store the resulting data — page URLs, structure and metadata, and accessibility findings — for the duration of your engagement.
Scan data
We store the results we generate — page data, accessibility findings, scores and verdicts, and the reports and accessibility statements we produce — for as long as the App is installed or your engagement is active.
Automatic information
When you visit our website we automatically collect technical information such as IP address, browser and device type, referring URLs, and pages viewed, via cookies and server logs.
3. How we use information
We use the information we collect to:
- provide, operate, maintain, secure, and improve the App, the website, and our services;
- run scans and produce scores, reports, remediation guidance, and accessibility statements;
- respond to inquiries and provide support, audits, and remediation services;
- administer billing (through Shopify for the App, and directly for services) and send service-related notices;
- monitor and analyze usage to improve our offerings and develop new features;
- detect, investigate, and prevent fraud, abuse, security incidents, or illegal activity; and
- comply with legal obligations and enforce our agreements.
We rely on these lawful bases where they apply: performance of our contract with you, our legitimate interests in operating and securing the Service, your consent (e.g. for marketing email), and compliance with law.
4. Sharing and disclosure
We do not sell your personal information. We share information only as follows:
Service providers / subprocessors. We share information with vendors who help us operate, including cloud hosting and database services (Fly.io), website hosting (Vercel), and our own accessibility scanning engine. We do not currently use a third-party email-delivery or email-marketing provider. If we add one in future — for example, to send transactional notifications, or an email-marketing platform (such as Klaviyo) for opt-in marketing — we will update this Policy and the list of subprocessors accordingly, and any marketing email will be sent only with the consent required by law (see Section 10, Marketing communications). These providers are bound by confidentiality and data-protection obligations and may process information only on our instructions.
Shopify. The App runs on Shopify and relies on Shopify for installation, authentication, and billing. Information necessary for those functions is exchanged with Shopify.
Business transfers. If we are involved in a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred as part of that transaction.
Legal requirements. We may disclose information where required by law or legal process, or to protect our rights, property, or safety, or that of others.
Aggregated or de-identified data. We may share data that cannot reasonably be used to identify you.
5. Cookies and tracking
The App uses a signed session cookie to keep you authenticated after you install and open it from Shopify. Our website uses essential cookies and standard server logs to operate the site, remember basic preferences, and understand aggregate traffic. If we introduce analytics or advertising cookies in the future, we will update this Policy and, where required, obtain consent. You can control cookies through your browser; disabling them may affect functionality.
6. Data retention and deletion
We retain your store, submitted-site, and scan data for as long as the App remains installed or your engagement is active. When you uninstall the App, we stop scheduled scans, delete your sessions, and mark the store uninstalled; Shopify then sends a shop-redaction request (typically about 48 hours later), at which point we permanently erase that store's scans, pages, issues, leads, and remaining records. On completion or termination of a services engagement, we delete or de-identify the associated data on request. We may retain limited records where necessary to comply with legal obligations, resolve disputes, or enforce our agreements, after which they are deleted or de-identified.
7. Security
We use commercially reasonable technical and organizational measures to protect information, including transmitting data over encrypted connections (TLS), HMAC-signing communications between the App and the scanning engine, restricting and controlling access to data, and hosting with reputable cloud providers. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. In the event of a security incident affecting personal information, we will comply with applicable breach-notification laws.
8. International data transfers
We and our service providers may process and store information in countries other than your own, including within the European Union, the United States, and Canada, depending on where our cloud provider and subprocessors operate. Where data is transferred across borders, it may be subject to the laws of, and lawful access by authorities in, those countries. We take steps to ensure such transfers are subject to appropriate safeguards. By using the Service you understand that your information may be transferred to and processed in those locations.
9. Your privacy rights
Depending on where you live, you may have rights to access, correct, update, delete, or restrict processing of your personal information, to withdraw consent, and to data portability. To exercise any right, contact us at hello@adachecked.com; we will respond as required by applicable law and may need to verify your identity first.
Canada (PIPEDA). You may request access to the personal information we hold about you and ask us to correct it. You may also raise concerns with the Office of the Privacy Commissioner of Canada.
Shopify data-protection webhooks. We honor Shopify's mandatory webhooks — shop/redact, customers/redact, and customers/data_request. Because the App holds no customer data, customers/redact and customers/data_request are answered as no-ops, while shop/redact deletes your store's data as described in Section 6 (Data retention and deletion).
EEA / UK / California. Users in these regions may have additional rights under the GDPR, UK GDPR, or CCPA/CPRA, which we honor as required by law.
10. Marketing communications (CASL)
If we send you commercial electronic messages, we do so consistent with Canada's Anti-Spam Legislation (CASL): we send them only with the required consent, we identify ourselves and provide our contact information, and every such message includes an easy way to unsubscribe. Service and transactional messages (e.g. scan results, billing, security notices) are not marketing and may still be sent.
11. Children's privacy
The Service is not directed to children under 16, and we do not knowingly collect personal information from them. If we learn we have, we will delete it.
12. Changes to this policy
We may update this Policy from time to time. The "Effective" date at the top reflects the most recent revision. Material changes will be communicated by reasonable means, including posting the updated Policy. Your continued use of the Service after changes take effect constitutes acknowledgement of the revised Policy.