Short version: when a shopper searches, the search text is sent to our server, used to look up an address, and discarded. We do not log it or store it. We do not store shoppers' names, addresses, phone numbers or emails. Addresses that customers save on the Profile page are stored by Shopify, not by us.
What passes through our server
When a shopper or customer types in the address search, the extension sends the search text (for example 테헤란로 152) in the body of a POST request to our server, together with Shopify's session token. The server uses the token to find out which store the request comes from and whether that store has a subscription.
The search text is read, cleaned, passed to a database query as a parameter, and dropped when the request ends. It is held in memory only. It is not written to our logs, our database or any other store, and it is not sent to any third party.
For each request we write one log line with: the surface (checkout suggestion, checkout button or Profile page), the result status, whether anything matched, the number of results, the duration, and the shop domain. The line contains no search text, no customer identifier and no IP address. Rate limiting keeps IP addresses in memory for about two minutes and never writes them down. Our web server's access log records the IP address, the request method, the path without its query string, the status and the timing, and keeps them for 14 days. It never records request bodies, so search text cannot reach it.
What we store
For each store that installs the app (merchant business data):
- the shop domain, install and uninstall dates, and the store's plan flags (for example whether it is a Shopify Plus or development store);
- the subscription state (plan, status, whether it is a test charge);
- the Shopify session for the app, which the app needs in order to read the plan and manage billing;
- anonymous daily counts of events (for example suggestions shown, suggestions picked, errors). A count carries no search text and no shopper information.
What we do not store
- Search text typed by shoppers or customers.
- Shoppers' names, phone numbers or email addresses, and the addresses they save. The only shopper input our server receives is the address fragment typed into the search box; it is used to answer that request and we do not keep it.
- Addresses saved on the customer account Profile page. The extension saves them directly to Shopify using Shopify's Customer Account API. They live in Shopify only, and Shopify's own privacy terms apply to them.
Address data source
Suggestions are built from the Ministry of the Interior and Safety (행정안전부) road-name address database, business.juso.go.kr. This is public data published by the Korean government. We load it into our own database and update it with the published monthly and daily files. Searches are answered from that database; we do not send searches to the ministry or to any other address provider.
Shopify privacy requests and deletion
We handle Shopify's mandatory privacy webhooks:
- customer data request and customer redact: we hold no data about individual shoppers, so there is nothing to export or erase; we confirm the request;
- shop redact: we delete the store's record, sessions and event counts;
- app uninstall: we delete the store's sessions and clear its subscription fields; the store record is deleted when Shopify sends the shop redact request.
Webhooks are accepted only when their Shopify signature is valid.
Hosting and sharing
The app runs on its own server (koraddress-plus.apsentic.com), hosted on Oracle Cloud Infrastructure in the United States (Ashburn, Virginia). We share data only with the providers that run the app, which are Shopify and Oracle. We do not sell data and we do not share merchant data with advertisers. Shopify processes billing.
Changes
If this policy changes in a way that affects what we collect, we will update this page and its effective date.