We process merchant and store data needed to run synthetic checkout tests: shop domain, product URLs you choose, markets and devices, schedule settings, optional secrets you save (storefront password, Slack webhook, alert email), billing entitlements, and audit results. We do not process shopper payment details or place orders. Scope is read_products only.

• Session videos and failure screenshots are written on our application server (disk under an artifacts directory), not to Shopify. Reports and health scores live in our database.
• Artifact URLs are signed and time-limited. We do not publish a public browse of videos.
• Default retention for videos and screenshots is 30 days (configurable operator setting, 1–365 days), then automated cleanup deletes expired files.
• Uninstall, Shopify shop/redact, or an email to privacy@frictionobservatory.com triggers session revoke, secret wipe, and artifact scrub for that shop.

For store configuration, audit history, and artifacts, you (the merchant) are the controller and Friction Observatory is the processor. We process that data only to provide the app, as instructed by your install and settings, and to meet Shopify’s mandatory privacy webhooks.

We implement customers/data_request, customers/redact, and shop/redact. We do not store live shopper checkout PII, so customer webhooks typically have nothing to export. Shop redact removes the merchant connection and redacts storefront URLs and artifact paths.

This page plus the Privacy Policy is our data-processing statement. For a signed DPA, email privacy@frictionobservatory.com.

• Shopify — install, OAuth, embedded Admin, Billing, privacy webhooks.
• Contabo — application hosting (API, worker, database, Redis, artifact disk).
• Resend — transactional email we send (support-style and alert mail when you configure an alert address).
• Residential proxy provider — when a market check uses a region-pinned proxy, that network sees bot storefront requests, not your customers’ accounts. Provider may change; we do not send customer order data through proxies.
• Slack — only if you save an incoming webhook; payloads go to your workspace.
• Optional AI provider — only if enabled in our environment, limited control-text for selector fallback. Not used for order or card data.

• HTTPS in production; Shopify Admin embedding restricted by CSP frame-ancestors.
• Merchant secrets encrypted at rest when token encryption is enabled.
• Signed artifact URLs; unsigned public artifact paths are not openly served.
• Production API binds to loopback; public traffic terminates on the web proxy.

Live process check: app.frictionobservatory.com/health (ok: true when the API is up). A human-readable summary is on /status. That check is our service, not your storefront.