Français · English · Nederlands · Español

Privacy policy — Plotseal

10 October 2026

Plotseal helps operators file due diligence statements (DDS) under the EU deforestation regulation. The operator remains responsible for every statement. This text is not legal advice.

Who controls the data

The Shopify merchant controls the data they enter (operator profile, suppliers, plots, DDS). The app publisher stores it for them. The support address is contact@aoex.be.

Data we process

• Shop: myshopify domain, Shopify shop id, language, and a cache of the app subscription plan.
• Operator profile: name, identifier type and value (EORI, VAT, and so on), address, email, phone.
• TRACES connection: username and authentication key encrypted with AES-256-GCM. The key is never sent back to the browser.
• Catalogue: product and variant titles and ids, and harmonized system codes. The only scope is read_products. Orders and customer data are not read.
• Suppliers: name, email, country, address, notes. Plots: producer name, country, GeoJSON, area.
• DDS: statement contents, reference and verification numbers, status, and the audit log.
• OAuth sessions for the app (Shopify access tokens), deleted on uninstall.

Purposes

Catalogue scan, supplier and plot register, DDS filing and status, exports the merchant asks for, and billing through Shopify App Pricing.

Recipients

Shopify (install, webhooks, plan page). The host of the app and its Postgres database. The European Commission's TRACES API when the merchant files a DDS outside demo mode. Demo mode sends no statement to the EU.

Retention

OAuth sessions (Shopify access tokens) are deleted when you uninstall the app. About 48 hours later, Shopify sends shop/redact: access credentials and the encrypted TRACES key are deleted then. Compliance records (DDS, received references, the audit log, and plots) are kept only for the five years required by EUDR Article 12, and then deleted. You can ask for earlier deletion at contact@aoex.be.

Rights

You can download a JSON export from the Plans page. customers/data_request and customers/redact are acknowledged: the app stores no customer data. You can ask for earlier deletion of compliance records at contact@aoex.be.

Language shown: English.