Privacy Policy

Effective date: 12 October 2026

This policy explains what the app "Mikata PID – EU Customs Check" (the "App"), published by Opifer Studio, an independent developer based in Japan ("we"), does with data when a merchant installs it from the Shopify App Store.

1. The short version

We do not store merchant data or customer data on our servers. The App runs inside your Shopify admin, in your browser. Product data travels only between your browser and Shopify.

2. What the App reads

When you run a check, the App reads product variants from your store through Shopify's Admin API, using Shopify's Direct API access from your browser: product title and handle, variant title and option values, SKU, barcodes (value and type), whether the variant requires shipping and whether the product is a gift card (variants that are not shipped are left out of the check), one metafield that belongs to the App ($app:pid.spid_status), and, if you use a carrier's metafield convention, the metafields custom.ns_manufacturer_pid, custom.std_manufacturer_pid and custom.std_manufacturer_pid_type (read only, never written). It also reads whether your store has an active subscription to the App's Pro plan. The App requests only the access scopes read_products and write_products. It does not read customers, orders, payments or any personal data of your customers.

3. What the App writes

Only when you click "Apply to Shopify" after reviewing a preview, the App writes to the variants you chose: barcodes of type NS_PID and GTIN/EAN/UPC/ISBN, and the App's own metafield that records "no S-PID exists". Nothing is written without that step.

4. Where processing happens

All checking, fixing and CSV generation happen in your browser inside the Shopify admin. CSV files are created in your browser and saved to your device; we never receive them. The App has no database and keeps no session, token or copy of your store's data.

5. Our server

The only server we operate is a Cloudflare Worker. It does three things: it serves the App's static files (HTML, JavaScript, CSS); when the App opens, it checks the short-lived sign-in token that Shopify's App Bridge attaches to the request (this is how Shopify requires embedded apps to confirm that the page is opened by a signed-in user of your store; the token names your store and the staff account, is checked and then discarded, and is never stored or logged); and it receives the three compliance webhooks that Shopify requires every public app to accept. It does not receive product data. We add no analytics or tracking pixels. The App loads no scripts other than its own files and Shopify's App Bridge library, which Shopify serves and requires for apps embedded in the admin. Cloudflare processes requests in order to deliver the files, under its own privacy policy.

6. Compliance webhooks (GDPR and similar laws)

Shopify sends these webhooks to the App:

• customers/data_request: a customer asks for the data an app holds about them;
• customers/redact: a request to delete a customer's data;
• shop/redact: a request to delete a store's data after uninstall.

The App verifies that each request comes from Shopify and responds that it holds no data, because it stores none. There is nothing to export and nothing to erase on our side.

7. Data left in your store

The barcodes you chose to write stay in your Shopify store because they are your product data. The App's metafield ($app:pid.spid_status) lives in a namespace reserved to the App and is not shown on the product page in your admin. While the App is installed, you can remove it from a variant by unticking "No S-PID exists" on the Fix screen and applying. When you uninstall the App, Shopify handles the metafield under its rules for app-owned data: the values are kept for a time without a definition and reattached if the App is reinstalled while they still exist; Shopify does not promise how long they are kept before its clean-up removes them.

8. Billing

Subscriptions are handled by Shopify's billing system. We do not see or store your payment details.

9. Support

If you email dun.der.head11@gmail.com, we keep your message in order to answer it and to improve the App. You can ask us to delete it at any time.

10. Changes

We may update this policy when the App changes. The current version is always at this address; the effective date at the top shows when it was last changed.

11. Contact and governing law

Opifer Studio, Tochigi, Japan, dun.der.head11@gmail.com. Opifer Studio is the trade name of a sole proprietor in Japan; the name and postal address of the person responsible are available on request by e-mail. This policy is governed by the laws of Japan.