Slurvo AddressGateWho we are and what this policy covers
Slurvo FZ-LLC operates Slurvo AddressGate, a Shopify app that lets merchants define approved delivery addresses and, on supported checkouts, ask buyers for additional order details. Our business address is SFFO0050, Compass Building, Al Shohada Road, Al Hamra Industrial Zone-FZ, Ras Al Khaimah, United Arab Emirates.
This policy covers the AddressGate app and its hosted privacy request page. It does not replace a merchant's store privacy policy or Shopify's privacy information.
Our role and the merchant's role
The merchant decides which destinations are approved, which optional checkout questions to ask, and how to use buyer answers to fulfill orders. The merchant is responsible for its customer relationships and for explaining those choices in its store privacy notice. We process information to provide and support the app on the merchant's behalf. Shopify hosts checkout, orders, and the app-owned metafields described below.
Information we process
Store settings and administrator sessions
Approved destination names and postal addresses, checkout question definitions, and enforcement settings are stored in app-owned Shopify shop metafields. Our hosted database stores Shopify authentication sessions needed to operate the app. A session can include the shop domain, access token, and Shopify staff identity fields.
Checkout addresses and answers
The checkout extension reads a buyer's shipping address to show the selected destination. A Shopify validation Function checks the final shipping address against the merchant's approved list. When a buyer selects an approved destination, the extension can set the merchant-approved company and postal address fields.
If the merchant enables checkout questions, buyers' answers are stored in an app-owned Shopify cart metafield and copied to an app-owned order metafield. A merchant might ask for a student name, employee ID, department, or similar information. The checkout extension does not send buyer addresses or answers to our hosted web service, and our hosted database does not keep a separate table of those answers.
Privacy requests and access records
When Shopify sends a customer data request, our database stores the request ID, customer ID, requested order IDs, shop domain, and receipt time for the merchant's private response queue. The queue does not copy the customer's email, phone number, address, or checkout answers.
When an authenticated merchant administrator opens or acts on that queue, we record the shop domain, app session ID, verified Shopify staff user ID, action, and time. This access record does not contain buyer addresses, answers, customer IDs, or order IDs.
How we use information
- Show approved delivery destinations and apply the merchant's checkout settings.
- Block shipped orders whose final address is outside the merchant's approved list when the rule is enabled.
- Save merchant-requested checkout answers with the Shopify order.
- Authenticate merchant administrators, show customer data requests, support the app, and investigate access to the request queue.
We do not sell buyer information or use checkout answers for advertising. The current app does not install an independent advertising pixel or analytics tracker. Shopify and hosting providers may process necessary technical information to operate and secure their services.
Service providers and international processing
| Provider | What it does |
|---|---|
| Shopify | Provides merchant authentication, checkout, orders, app-owned metafields, and privacy webhooks. |
| Railway | Hosts the AddressGate web app and its dedicated Postgres database for sessions, request metadata, and access records. |
| Business email provider | Receives messages you choose to send to our support address. |
Our company is based in the United Arab Emirates. Shopify, Railway, and email infrastructure may process information in other countries under their applicable terms and safeguards. We may also disclose information when required by law or to investigate a security incident.
Retention and deletion
Merchant settings and buyer answers remain in Shopify according to Shopify's order and app-data handling and the merchant's use of Shopify. We delete hosted authentication sessions when the app is uninstalled or when Shopify sends a verified shop-redaction request.
Customer data request metadata stays in the merchant's queue until the merchant marks the request addressed, a matching customer-redaction or shop-redaction request removes it, or 60 days pass. Privacy queue access records are retained for up to 120 days so they remain available for quarterly review, and removed sooner on verified shop redaction. The app runs a daily cleanup for expired request and access records.
When Shopify sends a verified customer-redaction request with order IDs while the store still authorizes the app, AddressGate removes its checkout-details metafield from those orders. Shopify may finish cleanup of app-owned data asynchronously after uninstall.
Security
We limit the hosted privacy queue to authenticated administrators of the relevant shop, verify Shopify privacy webhooks, and record access to that queue. The app uses HTTPS for its public web service. No internet service can guarantee absolute security. Please report a suspected AddressGate security issue to support@slurvo.com.
Privacy requests and choices
If you bought from a store using AddressGate, contact that merchant about your order or a request to access, correct, or erase its information. The merchant can review AddressGate checkout answers in the order's read-only app metafield in Shopify Admin and respond through its customer privacy process. Shopify customer data requests also appear in the merchant's AddressGate admin.
Merchants can use Shopify's customer privacy request flow or contact us for help with AddressGate data. You may also contact us to ask about personal information we hold in operating the app. We will review requests under applicable law and may need to verify your identity and the store involved.
Merchants should ask only the checkout questions they need and should not request payment credentials or sensitive information through AddressGate fields. The app is intended for merchants and their buyers, and is not designed as a service for children.
Changes and contact
We may update this policy when the app or its providers change. The effective date at the top shows the latest version. For privacy, security, or support questions, email support@slurvo.com.