Privacy Policy — Castavor: PayMask
Last updated: 30 August 2026
Provider: Zeynep Balcıoğlu — Mehterçeşme Mah. Ufuk Cad. No:81C A3 Blok D:10, Esenyurt, İstanbul, Türkiye
Privacy contact: info@castavor.com
1. What this app does
PayMask is a Shopify app that lets a merchant hide, reorder, or rename payment methods at checkout based on conditions the merchant defines — for example, hiding Cash on Delivery for certain postal codes.
The rules are written by the merchant in the app's admin interface. They are evaluated at checkout by a Shopify Function, which runs inside Shopify's own sandboxed runtime.
2. Personal data the app accesses
The Shopify Function requests exactly the following customer-related fields from Shopify's checkout API:
| Field | What it is |
|---|---|
customer.displayName | The customer's name as shown in the Shopify admin |
customer.hasTags(...) | For each tag the merchant listed in their rule, a true/false answer as to whether the customer carries it |
deliveryAddress.countryCode | Delivery country |
deliveryAddress.provinceCode | Delivery province or state |
deliveryAddress.zip | Delivery postal code |
deliveryAddress.address1 | Delivery street address, first line |
Two points about the tag field: it returns only true/false answers about tags the merchant already named in their own rule. The customer's full tag list is never retrieved.
Fields the app does not access
The app does not request, receive, or process any of the following:
- Email address
- Phone number
- Customer ID
- Order history or past purchases
- Payment details, card numbers, or payment credentials
- Second address line, city, or company name
- Any customer field not listed in the table above
3. Why the app processes this data
Solely to evaluate the payment rules the merchant configured. If a merchant writes "hide Cash on Delivery when the delivery country is outside Turkey", the delivery country must be read at checkout for that rule to work.
The data is used for no other purpose. The app performs no marketing, no analytics, no advertising, no profiling, and no tracking of any kind.
4. Where processing happens, and for how long
Processing happens entirely inside Shopify's Function runtime during a single checkout evaluation. Shopify Functions cannot make network calls.
The fields listed in section 2 are:
- never written to the app's database — no table contains a customer name, address, tag, cart, or order;
- never written to the app's logs — the app's server-side logs record only the shop domain, webhook topic, subscription plan, counts of rules affected, and error messages;
- never included in the function's output — the function returns only instructions to hide, move, or rename a payment method;
- never transmitted to any third party — the application makes no outbound requests to any service other than Shopify's own APIs.
The data exists only for the duration of one checkout evaluation and is discarded when that evaluation ends. There is therefore no retention period for customer personal data: it is not retained at all.
5. What the app does store
The app stores merchant and configuration data only:
| Data | Purpose |
|---|---|
| Shop domain | Identifies the merchant's store |
| Shopify session and access token | Authenticates the app to Shopify |
| Subscription plan, interface language, time zone | App settings |
| Rule definitions (conditions, actions, priority) | The merchant's own configuration |
| Rule change history (rule name, action taken, timestamp) | Lets the merchant see what changed and when |
Values inside a rule — such as a tag name or a postal code the merchant typed — are the merchant's own configuration text, not a record about any individual customer.
Merchant data is stored in a Microsoft SQL Server database hosted in Türkiye.
6. Sharing with third parties
The app shares personal data with no one. There are no analytics providers, no error-tracking services, no advertising networks, and no subprocessors handling customer personal data. The application's only outbound network calls go to Shopify's own APIs.
7. Shopify Function run logs
Shopify's own Dev Dashboard records individual Function executions for debugging and, per Shopify's documentation, makes the JSON-formatted input of a function run viewable to the app's developers. That input includes the fields listed in section 2.
This is a platform capability provided and controlled by Shopify, not a log the app writes. The app itself emits no output from within the Function: the Function's source code contains no logging statements of any kind.
This dashboard is used only to diagnose reported faults.
8. Data subject requests (GDPR / CCPA)
The app implements Shopify's three mandatory compliance webhooks:
| Endpoint | Behaviour |
|---|---|
customers/data_request | Returns success and reports that no customer data is stored. This is accurate: no table in the app holds customer records. |
customers/redact | Returns success. There is nothing to erase, because nothing about a customer was ever written. |
shop/redact | Permanently deletes all data belonging to that shop — rules, rule history, settings, and sessions. |
shop/redact arrives 48 hours after a merchant uninstalls the app. The app deliberately keeps rule definitions during that window so a merchant who reinstalls finds their configuration intact; after the window, deletion is complete and irreversible. If the app has been reinstalled in the meantime, deletion is skipped so that a working installation is not destroyed.
A customer who wishes to exercise their rights should contact the merchant whose store they shopped at, since the merchant is the data controller. The merchant may contact us at info@castavor.com.
9. Merchant responsibilities
The merchant is the data controller for their customers' personal data; the app acts as a processor on the merchant's instructions, which take the form of the rules they configure. Merchants are responsible for disclosing in their own privacy policy that payment options at checkout may vary based on order and customer attributes.
10. Security
The statements below describe the state of the system as verified on 30 August 2026. They are deliberately specific rather than reassuring.
In transit. All traffic between Shopify and the app is encrypted over HTTPS.
At rest. The application database runs on Microsoft SQL Server 2019 Standard Edition. Transparent Data Encryption (TDE) is not enabled, so the database files are not encrypted on disk. This is a deliberate choice: the database shares a SQL Server instance with other production systems, and enabling TDE on any single database also encrypts the shared tempdb, which would affect every other system on that instance. Note that no customer personal data is stored in this database at all (see section 4); what it holds is merchant configuration and Shopify access tokens.
Database access. The application connects with a dedicated SQL login (payrules_app) that holds no server-level role. Within its own database that login has the db_owner role, which is broader than the application strictly requires; reducing it is a planned improvement. Separately, accounts holding the SQL Server sysadmin server role can read any database on the instance regardless of database-level permissions.
Backups. The database is backed up daily. Each backup is encrypted with AES-256 using a server certificate, is compressed, and is verified immediately after it is written with RESTORE VERIFYONLY, so an unreadable backup cannot accumulate unnoticed. Backups are retained for 30 days. The certificate needed to restore them is held separately from the server. This has been in operation since 30 August 2026.
Because the database runs in SQL Server's SIMPLE recovery model, recovery is to the most recent daily backup rather than to an arbitrary point in time.
Incident response. A written incident response procedure exists (docs/incident-response.md): what counts as an incident, how scope is determined, how access is cut, and how affected merchants are notified. As a processor, we notify the merchant — who is the data controller — without undue delay so that their own regulatory deadline can be met.
11. Changes to this policy
Material changes will be published on this page with an updated "Last updated" date. Merchants will be notified through the app or by email where the change affects how personal data is processed.
12. Contact
Zeynep Balcıoğlu
Mehterçeşme Mah. Ufuk Cad. No:81C A3 Blok D:10, Esenyurt, İstanbul, Türkiye
info@castavor.com