sK Shipping Restrictions – Privacy Policy

Last updated: 3 October 2026

sK Shipping Restrictions stops checkout with a clear message when a product can't be shipped to the address a shopper entered. This policy explains what the app stores, what it reads, and what it never touches.

Shopper addresses

Your rules run as a Shopify Function inside Shopify's checkout. The Function receives the cart lines and the delivery address from Shopify, compares them with your rules and returns a message if something can't ship. Addresses are never sent to our servers and never stored by us. The Function makes no network calls.

What the app stores

• Your store domain (for example your-store.myshopify.com).
• The offline access token Shopify issues at install.
• Your rules: rule names, product tags, the countries, regions, postal code prefixes and address types they block, and your custom messages. A copy is also stored in your store, on the checkout rule itself, so checkout can read it.

What the app reads but does not store

With the read_products scope, the app reads your active products' titles and tags to show which products a rule covers and to test an address in the app. This is read when you open the app and is not stored.

What the app never accesses

• No customer records, orders or payment data. The app requests no customer or order access scope.
• No storefront tracking. The app adds nothing to your online store.

Shopify’s mandatory privacy webhooks

• customers/data_request — the app holds no customer data, so there is nothing to return.
• customers/redact — the app holds no customer data, so there is nothing to delete.
• shop/redact — your store record and rules are deleted.

Where data is stored

Your store domain, access token and rules are held in a Postgres database hosted in the European Union (Frankfurt region). Data is transmitted over TLS.

How long data is kept

Your access token is deleted immediately when you uninstall the app. Your store record and rules are deleted when Shopify sends the shop/redact request, which happens 48 hours after uninstall.

Sub-processors

Provider	Purpose	Location
Shopify	App platform	Global
Neon	Postgres database	EU (Frankfurt)
Vercel	Application hosting	EU

No other party receives any data.

Changes to this policy

If this policy changes in a way that affects what we store, we will update the date at the top of this page.

Contact

Questions about this policy: info@saitkatmerlikaya.com