Privacy information
Updated 27 September 2026 · Pre-release implementation and adopted retention policy
The legal operator is 鎌田将矢, operating in Japan under the public brand Rillnook Labs. Contact support@rillnook.com for privacy questions. This notice distinguishes adopted policy from verified implementation; it does not assert production compliance. The retention policy and Merchant Data Processing & Privacy Terms are adopted. The latter require each Merchant's explicit authorized Owner acceptance in the app; this notice is not a substitute for that agreement.
Data and purposes
Agreement records bind the tenant/shop, current installation generation, exact document version and digest, acceptance time and authenticated Owner staff identifier, with a minimized audit event. Current acceptance is active service metadata; inactive-tenant cleanup and the adopted audit-history period apply. No existing tenant is automatically treated as accepted.
- Order identifiers, line items, selected artwork specifications, amounts, currency and financial/test/cancellation status support order synchronization, proof jobs and server-side payment checks. Selected custom attributes and artwork/comments can themselves contain personal information.
- Order email addresses are used for transactional proof invitations and revision service workflows. Email is the only protected customer field requested. The app does not intentionally query customer names, telephone numbers, postal addresses or a customer directory.
- Private preview images, production PDFs, revision comments and exact-version approval records support artwork review and staff verification. An artwork approval is not consent to unrelated personal-data processing.
- Shopify staff identity, roles and encrypted authentication credentials support authenticated store access. Subscription identity, plan and period information support app entitlement checks. These are separate from customer approval and payment.
- Minimized privacy request, recovery, delivery and audit records support compliance handling, security and failure recovery. Private subject exports support an authenticated Owner responding to a customer's data request.
Shopify scopes are read_orders for relevant order/status data and write_draft_orders for merchant-quoted revision-service Draft Orders. Initial order import is bounded to 30 days; a manual import is limited to 60 days and 100 orders. These import windows are not deletion periods.
Providers used
| Provider | Actual role |
|---|---|
| Shopify | Store and staff authentication, order/Draft Order APIs, App Pricing and compliance webhooks. |
| Cloudflare | Workers application hosting, D1 tenant records, private R2 artwork/export/recovery storage and this static information site. |
| Resend | Transactional proof email delivery and signed delivery events, plus explicitly Owner-authorized protected-response invitations. Export bodies/files are not email attachments. Recipient mailboxes retain their own invitation copies. |
This describes direct service dependencies, not a complete list of these providers' subprocessors or a promise of Japan-only processing. Provider residual logs, backups, geographic processing and operator-held copies require their own review. These static pages have no app forms, tracking scripts, advertising pixels or application cookies; Cloudflare receives ordinary HTTP connection/request information to serve them. Contacting support creates correspondence outside the app's D1/R2 records.
Access and security
Operator policy limits production-data access to Owner/Admin roles where necessary. Application routes enforce Shopify authentication, tenant/resource correspondence and role checks. Subject-response authorization and acknowledgment are Owner-only. The Owner verifies the recipient, who receives a short-lived scoped invitation and code for direct HTTPS retrieval from private storage. Private R2 objects are not public links. A response offer is not confirmed receipt or fulfillment.
The adopted policy prohibits saving protected exports on the Owner's unencrypted PC or forwarding plaintext attachments. Subject JSON and applicable files are delivered directly in a bounded single-use response; incomplete, oversized or interrupted delivery needs operator handling, not automatic completion or regeneration. Recipient devices and subsequent copies are outside ProofGate's management. Other merchant/staff downloads must not be used to bypass the Owner endpoint policy.
HTTPS protects transport. Cloudflare provides storage-level protections; selected credentials and capabilities are additionally encrypted by the app. This is not a claim that every business field, downloaded file, mailbox copy or backup is application-encrypted.
Protected application reads and actions have minimized audit records, including actor, resource, outcome and time where implemented. No claim is made that application audits cover all provider-console or endpoint access. JSON bodies, customer emails, tokens and private links must not be copied into diagnostic evidence.
Retention and deletion
The Owner adopted the following purpose-specific schedule on 27 September 2026. Active workflow data is retained only while necessary for its disclosed purpose. Technical cleanup blockers are not permission for indefinite retention. The original privacy deletion deadline takes priority over ordinary retention.
| Record | Current implementation |
|---|---|
| Ordinary artwork files | 90 days after the eligible terminal/archive clock: archived time, otherwise cancelled time, otherwise last activity for ARCHIVED/CANCELLED/HANDED_OFF jobs. Inactivity warning at 83 days and archive at 90 days are separate. Customer approval alone does not start a blanket file-deletion clock. |
| Customer export artifacts | The existing 2-day artifact download expiry is retained. Expired/revoked reads are denied; exact-object cleanup includes a 30-day late-writer cleanup responsibility after expiry, not an extension of download access or the original privacy deadline. |
| Protected access logs | Audit/security retention is 180 days from occurrence, including new protected-access events under approved configuration. Earlier immutable development events retain their originally recorded expiry; deleted logs are not reconstructed. The Owner reviews implemented audit monthly and on incidents. |
| Other history, inbox, outbox, audit and request records | General terminal history: 90 days. Inbox: 30 days from terminal processing. Resolved Outbox/delivery history: 30 days from the later completion/update, with secrets purged earlier. Completed privacy records: 30 days from actual completion, not a later cleanup update. Settled replay/deduplication data: 7 days; unfinished privacy obligations are not disposable deduplication data. |
| Recovery, deletion and external copies | Deletion is subject to unfinished privacy duties, redaction/restore fences, replay protection and recoverable-copy lifetimes. Provider logs/backups, email and Owner downloads are separate copies; deleting a D1 row does not erase them. |
Uninstall/inactivity immediately invalidates sessions and authorization. Deletion-target tenant/customer data must be cleaned within 30 days, without erasing a later installation or delaying an original privacy deletion duty. Only documented minimum-necessary legal requirements, active incidents or legal holds permit exceptions.
Bounded application cleanup handles eligible history, ordinary deduplication, files and tenant deletion with privacy and writer safeguards. Authenticated successor-based retirement now covers completed independent receipts, journal entries, obsolete bootstrap references and unused recovery metadata. The implementation and configured dedicated-development paths have passed release and synthetic physical-deletion tests. This is not a claim that every live record is already due, that a production purge has occurred, or that every provider/recipient copy has been physically erased.
Unfinished original privacy duties keep their identity and deadline. Minimum integrity references required by an active duty, the verified recovery window or the existing order-import window are removed after those purposes are settled; ordinary history periods are not silently restarted. Old recovery checkpoints cannot reopen data retired by the independently authenticated successor. Temporary maintenance can restrict access while safe disposal completes; no exact uninterrupted-availability guarantee is made.
The current dedicated development D1 Time Travel window is 7 days; provider-managed recovery copies follow the applicable provider window, not an application deletion timestamp. R2's observed 7-day rule only aborts incomplete multipart uploads, not committed objects. Committed-object cleanup remains the app's responsibility. No unsupported physical-media deletion deadline is promised.
The historical Owner fulfillment copy was deleted. The current subject-response flow does not require another Owner-local copy; protected data must not be saved on the unencrypted Owner PC or forwarded as a plaintext attachment. No unnecessary manual copies or long-term plaintext backups are allowed. Direct recipient-path verification remains a pre-launch evidence requirement. Cloud protection does not encrypt recipient devices or mailbox copies.
Requests and Owner provision
Customers should contact the merchant responsible for their order. Merchants can contact support@rillnook.com for service/privacy assistance without emailing tokens or unrequested sensitive files. Shopify compliance requests are processed through the app's normal queue. The app preserves the original receipt-based 30-day due date through retries and recovery.
A response offer marked PROVIDED does not mean the customer received the data. The Owner authorizes one short-lived invitation for the exact recipient, request and artifact. Its direct response is single-use and bounded; this release does not automatically resend, reissue, regenerate or retry a consumed response. Actual recipient provision and a separate Owner acknowledgment are required to mark fulfillment complete. Development validation does not certify every production request or external delivery channel.
Incident contact and changes
The Rillnook Labs owner/operator is the incident-response contact through support@rillnook.com. This contact assignment is not certification of an independently audited organizational security program. Material service/policy changes will require an updated notice before the affected public service is offered.