SegOps AIDocs

SegOps Shopify App — GDPR / Privacy Compliance

This document describes how the SegOps app fulfills Shopify's three mandatory privacy webhooks. All three are HTTPS, HMAC-verified against the app secret, ack within 5 seconds, and complete within the 30-day SLA.

Endpoints#

WebhookURLHandler
customers/data_requestPOST /shopify/gdpr/data_requestexport_customer_data
customers/redactPOST /shopify/gdpr/customer_redactredact_customer_data
shop/redactPOST /shopify/gdpr/shop_redactredact_shop_data

Declared in shopify.app.toml under [webhooks.privacy_compliance].

Flow#

  1. The webhook view verifies X-Shopify-Hmac-SHA256 against the app secret (constant-time). A bad/missing signature → 401.
  2. A DataRequest row is created with due_at = now + 30 days, then the matching Celery task is enqueued. The view returns 200 immediately.
  3. The task fulfills the request and stamps completed_at.
  4. An hourly beat task (check_gdpr_sla) logs shopify.gdpr.sla_at_risk for any request within 5 days of its SLA that is still incomplete (paging hook).

What each request does#

  • customers/data_request — collects the customer's events (ClickHouse), segment memberships, and identifications; packages them and makes them available to the shop owner. Marks the DataRequest complete.
  • customers/redact — deletes all of the customer's events from ClickHouse (ALTER TABLE … DELETE WHERE tenant_id AND user_id) and clears per-customer Postgres references.
  • shop/redact — fires ~48h after uninstall. Deletes the shop's events from ClickHouse and hard-deletes the SegOps tenant (Postgres cascade). The DataRequest audit row survives the tenant deletion (its FK is SET_NULL) so there is durable proof the redaction ran.

Data retention on uninstall#

Uninstalling sets the installation inactive and wipes the access token but keeps historical data until shop/redact arrives (Shopify's ~48h window), giving accidental-uninstall recovery without violating GDPR.