Privacy policy

This policy describes what Checkout Doctor collects from Shopify stores, why, who processes it, and how to have it removed. Checkout Doctor is operated by Agentic Labs LLC (agntwrk). Last updated 2026-10-03.

What we collect

When you install the app on a Shopify store we store the store's domain, an offline access token, the access scopes granted, and the plan you chose. With the scopes listed below we keep a copy of your catalog, discounts, shipping, markets, and themes, and of your orders from the last 60 days. Shopify webhooks and a nightly reconcile keep the copy in step. From it we produce findings (the problems the checks find, with their evidence, an estimated dollar figure, status, and history), a record of recent changes in your store such as a discount created or a theme published, the journeys learned for your store, an activity log, and the settings you enter. Protected customer data: to spot duplicate orders and repeated refunds we read the customer email on each order from the last 60 days and keep only a one-way hash of it (a shortened SHA-256 value that cannot be turned back into the address), with the order number, dates, status, totals, discounts, refunds, and line items. We do not store customer names, addresses, or phone numbers, or the email itself. Orders older than 60 days are removed from our copy by the nightly reconcile. Signing in to the app sets a cookie named session (HTTP-only, 30 days) that holds your email, a hashed person id, and the store you are working in. Standard server logs record the IP address, user agent, and request path, and expire after 30 days. We do not sell personal data and do not use it for advertising.

What each access scope reads

read_products: products and variants (title, handle, vendor, type, SKU, barcode, price, compare-at price, inventory policy, weight), status, and media count, plus collections and their rules. read_inventory: inventory items and levels by location, and the unit cost of an item. read_discounts: discount titles, codes, status, dates, usage, value, minimum, and how discounts combine. read_shipping: shipping profiles, zones, countries, and rates with their free-shipping thresholds. read_markets: markets, regions, currencies, domains, and each market's shipping options, rates, and free-shipping minimums. read_themes: theme names, roles, and update times. read_orders: orders of the last 60 days, as described above. unauthenticated_read_product_listings, unauthenticated_read_checkouts, and unauthenticated_write_checkouts: the Storefront API, used to build test carts and read their prices, discounts, and shipping rates for sample destinations (a country, province, and postal code, never a person's address). On a password-protected store the app creates one Storefront access token named Checkout Doctor for this. The app never completes a checkout or places an order, and it does not change your products, prices, orders, or settings.

How we use it

To run the storefront tests and checks against your store data, show you the findings and their proof, send the alerts you configure, bill the plan you chose through Shopify, and secure the service. We use store data only to provide the app to that store.

Store staff

When a staff member or collaborator opens the app from a store's Shopify admin with a verified Shopify account, we store their email, their name as Shopify gives it, a hash of the email used as an id, the store they opened it from, their role there, and when they last opened it. Shopify's online session for that person also holds their Shopify user id, name, and email while it is valid. We use this to show the stores a person manages in one view (a store stays in that view for 30 days after the person last opened the app from it), and to show who made a change in the store's activity log. If you save a client report title or agency name, it is stored with that record. A person's record is deleted with the last store they were linked to.

Storefront tests

On a schedule, and after a theme publish on plans that include it, a test browser opens your public storefront on a desktop and a phone, adds a product to the cart, and walks to checkout, typing a fixed test contact (not a real customer) into the contact and shipping fields. Each run keeps screenshots of every step, a video, the browser console, and a report of the steps. They show what is visible on your public storefront and checkout pages up to the payment step, and they are deleted from storage 30 days after they are written. The test browser never enters card or wallet details, never pays, and never places an order. If your storefront is password protected, you can save the storefront password in the app's settings so the test browser can sign in. If you add a Shopify crawler access signature (three request headers), the test browser sends it to that one domain of your store only. The password and signature are stored for your store only, are never logged, and are not put in screenshots or reports. The test browser is described in full at https://checkoutdoctor.agntwrk.com/docs/how-it-works.

Email

We send alert emails when the checks open or resolve findings, and a weekly digest, through Resend, which receives the recipient address and the message (finding titles, severity, estimated impact, and links). We email only the addresses you enter in the app's settings. Every email has an unsubscribe link, and you can remove an address in the settings. If you unsubscribe, we keep that address so we do not email it again. If you add a Slack webhook URL, the same alert messages go to Slack. On plans that include Shopify Flow, a trigger with the finding's id, title, severity, impact, and link is sent to Flow in your store.

AI features

When the app learns journeys through your own store (when your plan first includes journeys, after a theme publish, and when you ask for it in the dashboard), it sends your store's web address and a text summary of up to 8 public storefront pages to a language model provider: page paths, titles, headings, and the names of links, buttons, form fields, and drop-down options, at most about 12,000 characters, to generate a list of journeys. The app is set up with Anthropic, Google, and OpenAI. It calls one at a time, Anthropic first, and tries the next only if a call fails. No customer, order, or Admin data is included, and no screenshots and no password or card fields are sent. The provider handles the text under its own terms. We do not use your store's data to train models. If no provider is available, built-in default journeys are used and nothing is sent. Review generated journeys before relying on them.

AI assistants

You can connect an AI assistant, such as Claude or ChatGPT, to the app's MCP server at https://checkoutdoctor.agntwrk.com/mcp. When you do, the assistant's provider receives the findings, catalog data, and settings that your requests return and handles them under its own terms and privacy policy. Access is per user through OAuth and limited to the store you approve. To authorize an assistant we store its registration (name and redirect addresses), a single-use authorization code that expires after 10 minutes, and a hash of its access token together with the email, hashed person id, and store of the person who approved it. The token expires after 30 days. You end access by removing the connector in your assistant. Shopify Sidekick can also read your store's findings through the app's read-only Sidekick extension when you use Sidekick. The app does not send your data to an AI provider on its own, apart from the public storefront summary described above.

Service providers

We host the app on Google Cloud in the United States (us-central1): Cloud Run runs the app and its scheduled jobs, Firestore holds the data, Cloud Storage holds test-run files, Secret Manager holds credentials, Cloud Scheduler starts the jobs, and Cloud Logging holds logs. Shopify handles installation, sign-in, and billing. Resend delivers email. Anthropic, Google, and OpenAI receive the storefront text summary described under AI features. Slack receives alerts only if you add a webhook URL. These providers process data only to run the app.

Analytics

The public pages of this website (home, privacy policy, how it works, and the assistant docs) use Google Analytics 4 to count visits, which uses cookies; Google Analytics does not log or store IP addresses. The app inside your Shopify admin, the signed-in dashboard, the sign-in pages, the assistant connection pages, and the email unsubscribe page do not use analytics.

Retention and deletion

We keep store data while the app is installed. Uninstalling the app deletes everything we hold for the store at once: its copy of your data, findings, journeys, settings, activity log, Shopify sessions, MCP tokens, and the links between people and the store. Shopify's shop erasure request, sent 48 hours after uninstall, runs the same deletion again. Test-run files expire from storage 30 days after they were written, so they are gone within 30 days of an uninstall. Activity log entries are deleted after 90 days, and logs after 30 days. Shopify's customer erasure request deletes the listed orders from our copy and every finding that references those orders or that customer's email hash. Shopify's customer data request is acknowledged and recorded in the activity log: we hold no customer name, address, or phone number, and the order records we hold are data you already have in Shopify. Write to us to have anything removed sooner.

Your store's customers

For customer data in your store you are the controller and we process it on your behalf. Customers who want to see or delete their data should contact the store; we act on the requests Shopify forwards to us.

Security

Data is encrypted in transit and at rest. Access tokens are stored server-side and never sent to the browser. Storefront passwords, signatures, and keys are never written to logs. Access to production data is limited to the people who operate the app.

Changes

We update this page when the app's data handling changes and change the date above.

Contact

hello@agntwrk.com