Privacy Policy

CheckMate by NerdLabs — Last updated: September 3, 2026

1. Introduction

CheckMate ("we", "our", "us") is a Shopify app developed by NerdLabs that provides terms acceptance and age verification for Shopify merchants. This privacy policy explains how we handle data.

2. Data We Collect

Store configuration: Your app settings including checkbox text, age verification thresholds, and custom legal text. Stored in our database to power the app.
Acceptance records: When a customer accepts your terms or confirms their age, we record it in our own database: your shop domain, the time of acceptance, which checkbox was accepted, and — where your store provides them — the order ID and name, product ID, customer ID, customer email, IP address and browser user agent. Acceptance logging is available from the Pro plan; on the Free and Starter plans the acceptance request is received and immediately discarded — nothing is stored.
Session data: Shopify session tokens required for app authentication.

3. Data We Do NOT Collect

CheckMate does not collect or store:

Payment or billing information
Browsing behavior, analytics or tracking data
Customer names, addresses or phone numbers

4. How We Use Data

We use collected data solely to:

Display and enforce your configured checkout requirements
Provide the app's functionality and customer support

5. Data Sharing

We do not sell or rent your data, and we do not share it with third parties for their own use. One functional exception: on the Pro plan and above, your customer's IP address is sent to the geolocation service ip-api.com to determine their country for country-based age rules — this happens whether or not you have configured any such rules. Nothing else is shared, and your configuration is only accessible to you through the CheckMate admin.

6. Data Retention & Deletion

We retain your data while CheckMate is installed. On uninstall, session data is deleted. On a customer redaction request from Shopify we delete that customer's acceptance records. On a shop redaction request from Shopify, or a direct request from you, we delete all data associated with your store — settings, rules, custom checkboxes and every acceptance record.

7. Data Security

Traffic between your store, your customers and CheckMate is transmitted over HTTPS, and data is stored on secure servers following industry-standard practices. One exception: the geolocation lookup described above is sent to ip-api.com over an unencrypted (HTTP) connection.

8. GDPR Compliance

CheckMate supports Shopify's mandatory GDPR webhooks:

Customer data request: We return the acceptance records we hold for that customer.
Customer erasure: We delete that customer's acceptance records.
Shop data erasure: All store data is deleted upon request.

9. Changes

We may update this policy from time to time. Significant changes will be communicated through the app.

10. Contact

Questions? Contact us at support@nerdlabs.us

NerdLabs — nerdlabs.us