Privacy Policy

Last updated: September 22, 2026

This Privacy Policy describes how Plasmatio, LLC ("we", "us", "our"), an Indiana limited liability company, collects, uses, and shares information when merchants install and use the Plasmatio PayGate app ("the App") on their Shopify store.

1. Information we collect

PayGate collects only the information required to operate the App's payment-method-hiding features:

• Shop identifier — your *.myshopify.com domain, used to associate rules and settings with your store.
• OAuth access tokens — issued by Shopify when you install the App, used to make Admin API calls on your behalf. Stored encrypted at rest.
• Rule configuration — the payment-blocking rules you create in the App (product / collection / tag / vendor / type scopes and the payment methods to hide).
• Product metadata — product IDs, titles, types, vendors, and image URLs fetched via the Shopify Admin API for rule scoping and warning-message display. This is read-only reference data — we do not modify your products.
• Order attributes at Thank-You render — when a shopper completes checkout, we read the checkout attribute set by the split-cart flow (paygate_pending_restore) so we can offer them a link to complete a follow-up order. We do not persist any order or customer PII.
• Payment gateway names from recent orders — when you click "Detect methods" in the rule editor, we read only the paymentGatewayNames field of your recent orders to suggest which payment methods you can block. No customer details are read, and nothing from those orders is stored.
• Aggregate rule-match counts — via Shopify's carts/update webhook, we compare the products in a shopper's cart against your rules in memory and increment a per-rule counter (matchCount) and last-matched timestamp whenever a rule matches. No cart contents, customer identifiers, cart tokens, or line-item details are stored. The counter and timestamp are the only persisted output.

What we do NOT collect

• Customer names, emails, addresses, or payment details
• Full order records or line-item history
• Per-shopper analytics, tracking pixels, or session-recording data
• Any data from stores that have not installed the App

2. How we use information

We use the information above solely to:

• Enforce your payment-blocking rules at checkout via Shopify's Payment Customization Function.
• Render customer-facing warnings on product pages, the cart, and checkout (via theme app extensions and checkout UI extensions).
• Provide the "Remove and continue" split-cart flow and the post-purchase restore prompt.
• Respond to your support requests.

We do not use your data for advertising, marketing, profiling, or model training. We do not sell or rent your data.

3. Data sharing

We share information only with:

• Shopify — through the standard Shopify Admin API, Payment Customization Function, and UI Extensions. All data transmission is over TLS and scoped to your own store.
• Our hosting infrastructure — Fly.io (application hosting) and Fly Managed Postgres (database). Both are subject to their own security controls and data-processing agreements.

We do not sell, rent, trade, or otherwise transfer your information to any third party for marketing, analytics, or resale purposes.

4. Data retention and deletion

We keep your data only for as long as the App is installed on your store. We honor the following Shopify GDPR compliance webhooks:

• shop/redact — when you uninstall the App, we delete all rules, settings, session tokens, and metafield mirrors associated with your shop within 48 hours.
• customers/redact — we do not store customer data, so this webhook is acknowledged as a no-op.
• customers/data_request — we do not store customer data; a request is acknowledged with a confirmation that no customer data exists to disclose.

You may also request early deletion by emailing AppSupport@plasmatio.com — we will confirm within one business day.

5. Security

Data is stored in a managed PostgreSQL database with encryption at rest. All application traffic is served over HTTPS. Shopify OAuth tokens are stored in a session table isolated per shop. Only authorized Plasmatio, LLC personnel have access to production infrastructure.

6. Your rights

Depending on your jurisdiction, you may have rights to access, correct, delete, or receive a copy of the personal data we hold about you. Because PayGate stores only merchant-level configuration and no personal data beyond OAuth tokens, most of these rights are already satisfied by uninstalling the App (which triggers deletion via the shop/redact webhook). To exercise any right directly, contact us at AppSupport@plasmatio.com.

7. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will change the "Last updated" date at the top of this page. If the change is material (e.g., we add a new data-collection practice) we will additionally notify installed merchants via the email on file with Shopify.

8. Contact

For privacy questions or data requests, contact:
AppSupport@plasmatio.com