Merchant Data Processing & Privacy Terms
Version: PG-MDPT-20260927-v1.0
Operator effective date: 27 September 2026
Operator: 鎌田将矢, operating as Rillnook Labs, Japan
Contact: support@rillnook.com (English)
The Operator adopted this version from draft10 on 27 September 2026. These terms form the merchant data-processing arrangement when an authorized Shopify store Owner expressly accepts them in ProofGate. Publication or installation alone is not acceptance. No existing merchant is deemed to have accepted. Acceptance does not purchase a plan, authorize a charge, submit an app review, release the app publicly or authorize manufacturing.
Canonical URL: https://proofgate.rillnook.com/merchant-data-processing-privacy-terms
Versioned text: https://proofgate.rillnook.com/merchant-data-processing-privacy-terms-v1
1. Parties and roles
The Merchant is the business for the Shopify shop identified in its acceptance record. The Operator provides ProofGate on that Merchant's documented lawful instructions. Where applicable law uses controller/processor terminology, the Merchant determines the purposes and instructions for its customer workflows and the Operator processes on its behalf. Independent legally required or security processing is limited to those purposes; it grants no general right to repurpose customer data. Providers may have separate relationships and legal roles under their applicable terms.
2. Processing description
The service supports bounded order import, proof specifications and private images/PDFs, transactional notifications, revision requests, exact-version approvals, revision-fee Draft Orders and status reconciliation, staff checks, handoff records, privacy requests and service security. Data subjects are merchant customers and authorized staff. Data includes order/item identifiers, selected specifications, customer email, payment/test/refund/cancellation status, files, comments, decisions, staff identity/role, authentication material and minimized audit references. ProofGate intentionally requests customer Email, not customer Name/Phone/Address fields or a customer directory. It does not receive payment-card details through this integration. Merchants must minimize personal data in artwork and free text.
3. Purposes and instructions
Processing is limited to orders, proofs, revisions, fee reconciliation, transactional customer notifications, privacy responses and security, except where law requires otherwise. The Operator informs the Merchant of conflicting instructions or legally required processing where permitted. Data is not sold or used for advertising, targeted advertising, third-party marketing or AI model training. Legally or similarly significant automated profiling/scoring is not a service purpose. The Merchant supplies accurate recipients, required notices, lawful permissions and applicable consent/withdrawal decisions. The Operator respects those decisions; artwork approval is not privacy consent.
4. Responsibilities
The Merchant limits submitted data and staff access, verifies specifications, recipients and PDFs, and handles individuals' requests through authorized channels. Test payments and development rehearsals never authorize real manufacturing. The Operator limits personnel access to necessity, requires confidentiality, maintains the described safeguards, assists with applicable rights/security/incident/impact-assessment duties and provides relevant compliance information. Reasonable assurance and audit arrangements protect other tenants and secrets without excluding mandatory audit rights.
5. Providers and transfers
The Merchant authorizes the following services for their stated purposes:
| Service | Actual role and processing |
|---|---|
| Shopify | Store/staff authentication, order and Draft Order APIs, App Pricing, checkout and compliance events. Its platform role follows applicable Shopify terms; it is not universally described as the Operator's subprocessor. |
| Cloudflare | Workers hosting, D1 records, private R2 files/exports and recovery journal. Hosting/storage provider under applicable provider data-processing terms. |
| Resend | Transactional proof notices, explicit private-response invitations without attachments, and signed email-delivery events. Email delivery provider under applicable provider terms. |
The Operator must establish applicable provider terms and lawful transfer arrangements, bind subprocessors to equivalent applicable protection duties, and remains responsible to the extent required by law. This agreement does not execute a new provider contract or assert an unverified certification, private signature or Japan-only storage location. Before an intended addition or replacement, the Operator notifies the Merchant and provides a meaningful opportunity to object on data-protection grounds before affected processing; a substantiated objection is addressed by an appropriate alternative or ending the affected processing. Provider/account/mailbox residual copies follow their applicable documented policies, not a promise that every provider copy shares the application's deletion period.
6. Security
Controls include HTTPS/TLS, provider-managed D1/R2 encryption at rest, application encryption for selected session/secret/Outbox material, private storage, tenant/resource authorization, online Shopify staff authentication, least privilege, Owner-authorized protected recipient delivery and minimized audit. Individual, nonshared staff accounts, non-reused strong credentials (the adopted password minimum is 14 characters where passwords are used) and provider-supported MFA are required. Implemented audit is reviewed at least monthly and during incidents; this is not a claim that every provider-console or endpoint action is logged. PII, exports, credentials and access capabilities must not enter Git, raw logs, evidence or screenshots.
Protected exports must not be saved on an unencrypted Operator endpoint or forwarded as plaintext email attachments. The current Owner C: drive is not encrypted; that endpoint is not represented as an encryption control. The historical local export was deleted. Subject delivery keeps data in private storage and sends it directly over HTTPS to a Merchant-verified recipient. Recipient devices and copies are outside application management. Not every business field has additional application-level encryption; no certification, universal endpoint protection or absolute security guarantee is asserted.
7. Retention, return and deletion
| Class | Period and start condition |
|---|---|
| General history and eligible proof files | 90 days from implemented terminal-workflow eligibility; active workflow data only while necessary for its purpose |
| Inbox | 30 days from terminal processing |
| Outbox | 30 days from terminal completion; sensitive payloads may be purged earlier |
| Audit/security history | 180 days for new events under the adopted configuration; historical immutable events keep their existing expiry |
| Completed privacy request records | 30 days from genuine completion, with unresolved original duties and necessary recovery barriers protected |
| Privacy export artifact | Existing two-day access expiry; expiry/fulfillment stops access and guarded cleanup removes bytes. The 30-day post-expiry late-writer cleanup duty is not an access extension |
| Replay/deduplication data | 7 days from the implemented replay/terminal clock |
| Inactive/uninstalled tenant deletion targets | Session/authorization invalidation immediately; cleanup within 30 days of inactivity/uninstall |
Original privacy deletion deadlines of 30 days take priority over general retention. Only mandatory legal requirements, active incidents or legal holds permit minimum necessary, purpose-limited exceptions. Technical failure is not permission for indefinite retention. Current acceptance metadata is necessary service metadata while an installation is active; inactive cleanup applies to it, and historical acceptance audit follows the audit period above.
At service end the Merchant may lawfully request secure return or deletion, including Operator copies except required legal retention. Retained data is isolated and purpose-limited. Normal recovery uses provider-managed recovery, not independent plaintext backups. The dedicated development D1 Time Travel window was verified as seven days; production/provider windows must be checked for the applicable service. Recovery copies expire under the provider's actual window and must not restore erased data to active service without the existing privacy reconciliation barrier. R2 multipart-abort rules are not deletion rules for committed objects: application cleanup remains responsible for those.
8. Privacy requests and protected delivery
The Merchant handles individuals' requests with Operator assistance. Shopify privacy requests retain their original receipt-based 30-day deadline through queue, retry and recovery. An authenticated Owner verifies and authorizes the recipient for an exact tenant/request/artifact without viewing or saving the export. A high-entropy, scoped 15-minute single-use capability permits direct HTTPS acquisition; expiry, revocation and scope mismatch fail closed. Export and associated files remain private and subject to finite expiry/cleanup. The current bounded response supports up to six associated files and 20 MiB; incomplete, oversized or interrupted responses require authorized handling, not a claim of complete provision. Safe reissue never regenerates an export or silently changes its deadline. PROVIDED, an HTTP response or a download offer is not confirmed receipt. Actual provision and separate Owner acknowledgment are required; fulfillment records must reflect what occurred.
9. Incidents
Incident owner: 鎌田将矢. The sequence is detect, contain/revoke access, rotate affected secrets, preserve relevant audit, assess affected data and tenants, notify Shopify/Merchant/other parties where required, remediate and document follow-up. Material facts and required updates are communicated without exposing other tenants. No invented fixed notification-time guarantee replaces applicable mandatory duties.
10. Acceptance, changes and mandatory rights
An authorized Shopify store Owner accepts using an unchecked clickwrap control linked to these terms, the Service Terms and Privacy Policy. The record binds tenant/shop, installation generation, exact agreement version and document digest, server acceptance time and authenticated staff identifier, with a corresponding audit event. Other staff cannot accept on the Owner's behalf. Business use is blocked until current acceptance. Statutory privacy processing, security, cleanup and existing payment-integrity reconciliation are not withheld for lack of agreement acceptance.
A material change requires a newly versioned text and explicit reacceptance; historical text and audit are not silently rewritten. A new installation also requires acceptance. No deployment, migration, prior use, plan or default checkbox constitutes acceptance. These terms do not waive mandatory rights, exclude non-excludable duties or prevent lawful cooperation. Applicable mandatory data-processing/transfer terms prevail where required. No new governing-law, dispute, commercial refund or manufacturing guarantee is invented.
Service Terms: https://proofgate.rillnook.com/terms
Privacy Policy: https://proofgate.rillnook.com/privacy
Support: https://proofgate.rillnook.com/support
Development/test evidence proves only the stated tested scope, not universal production/provider erasure, successful real payment, public launch or manufacturing authority.