Privacy Policy

Carded ("Carded", "we", "us") is a Shopify app, listed as "Carded: Age Verification & ID", that helps US merchants selling age-restricted products confirm that their customers meet a minimum age before an order is fulfilled. This policy explains what personal data the app handles, why, who it is shared with, how long it is kept, and the choices available to merchants and their customers.

1. Who we are and our role

Carded is operated by Rolling Pandas, July 27 Street, 9000 Varna, Bulgaria. EU representative: not applicable, because Rolling Pandas is established in the European Union.

Merchants are in control of their customers' data. When a merchant installs Carded, the merchant decides to verify its customers' age and sets the rules (minimum age, which products need a check, what happens to orders that fail). For the personal data of the merchant's customers, the merchant is the controller (or "business") and Carded acts as its processor (or "service provider"), handling that data only to provide the app to the merchant.

For the data of the merchants themselves (their store and account information), Rolling Pandas is the controller.

If you are a shopper, the store you bought from is your first point of contact for privacy questions and requests; its own privacy policy also applies.

2. Data we process

2.1 From merchants

Store domain, store name and Shopify shop ID.
The Shopify API access token issued when the app is installed.
App settings: minimum age, which products or collections require verification, states shipped to, how to handle failed or expired verifications, branding (for example a logo URL), and a support email if one is entered.
Plan and billing status and the number of completed verifications. Charges are billed through Shopify; Carded never receives the merchant's payment card details.
Manual decisions taken in the app (approve/reject an order) and the note entered with them.

2.2 About merchants' customers (shoppers)

From the Shopify order, when an order containing an age-restricted product is placed: the order ID, the customer's email address, the customer's first and last name (from the customer record or billing address), the products in the order (to decide whether a check is needed) and the order's tags, fulfillment and cancellation status. The name is passed to the ID verification provider so it can be compared with the name on the ID; we do not store it from the order.

Shipping state. When the merchant has turned on state rules (orders shipping to US states the merchant blocks, or a higher minimum age / narrower ID types for a state), we read the order's shipping country and state/province from the shipping address and store the US state code with the order record ("shipState") so those rules can be applied and shown to the merchant. When the merchant has chosen the countries they sell to, an order shipping to any other country is recorded with its country code ("shipCountry") instead. We do not read or store the rest of the address (name, street, city, postcode or phone). For merchants who have state rules turned off, the shipping address is not used or stored.

From the ID check. The customer completes the check on a page hosted by our ID verification provider (see section 6), where they photograph a government-issued photo ID. The check is document-only: the app does not ask for a selfie or a face scan. The provider sends us the result, and we store:

the decision (approved, declined or needs review) and any warning/failure codes;
the first and last name, date of birth, document number, issuing state, country and expiry date read from the ID;
a link to the document image, which stays with the provider. We do not store ID document images on our servers; only the link is kept, and it is erased with the other personal fields after 90 days.

We keep only these fields from the provider's response, not the full response it sends us.

What the provider collects directly. The provider's verification page receives the ID images the customer captures and the technical information any website receives (such as IP address and browser details). The provider handles that data as our sub-processor; see sections 6 and 8.

Technical data. We do not store shoppers' IP addresses in our database. The IP address of a request to a verification link is held briefly in server memory to limit abuse (rate limiting). Our hosting provider may record standard request logs. Our application logs are written to leave out names, dates of birth and document numbers, and to mask email addresses.

2.3 What the app writes back to the merchant's Shopify store

To show results where the merchant works, the app adds verification tags to orders (for example "Age Verified", "age-pending", "age-failed"), saves the verification link, status and reference on the order, saves a verification status on the Shopify customer record, adds a high-risk assessment to an order whose verification expired, and holds or cancels orders when the merchant has chosen that. This data then lives in the merchant's Shopify store.

3. How we use data

To check whether an order needs verification and, if so, create an ID check for it.
To recognise a customer who has already passed at the same store (by their email address, or by a past order in that store tagged "Age Verified"), so they are not asked again. This is per store: passing at one store does not approve you at another.
To send emails on the merchant's behalf: the verification request, reminders, and the result (approved, declined, or cancelled because the check was not completed in time). At a merchant's request, the follow-up emails can be switched off for its store.
To apply the merchant's chosen actions (tag, hold, cancel) and show results in the app.
To let the merchant review records and make manual decisions.
To bill merchants through Shopify. Each completed check is reported as a usage event (store ID, verification reference number, time); no names or email addresses.
To keep the service secure, prevent abuse, fix problems, and meet legal obligations.

We do not sell personal data, use it for advertising, build marketing profiles, or combine one merchant's customer data with another's.

4. Legal bases (GDPR / UK GDPR)

Where the GDPR or UK GDPR applies: for shoppers' data, the merchant (as controller) decides the legal basis, typically compliance with a legal obligation to verify age for restricted products, or performance of the sales contract. We process that data on the merchant's documented instructions.

For merchants' data, we rely on performance of our contract with the merchant (providing the app), our legitimate interests (keeping the service secure and working), and legal obligations (for example record-keeping).

5. US state privacy laws (including CCPA/CPRA)

For shoppers' personal information we act as a service provider/processor for the merchant. We use it only to provide the app to that merchant, as described in this policy. We do not sell or "share" it (for cross-context behavioral advertising). Government ID details are treated as sensitive personal information and are used only to perform the age and identity check the merchant requested.

Requests to know, correct or delete should be made to the merchant, who can act on them with our help (see section 9).

7. International transfers

Rolling Pandas is established in the European Union (Bulgaria). Carded is built for US merchants, and our sub-processors may process data in the United States and other countries. Where personal data covered by the GDPR or UK GDPR is transferred to a country without an adequacy decision, we rely on a transfer safeguard recognised under those laws, such as the EU-US Data Privacy Framework where the recipient is certified under it, or the European Commission's Standard Contractual Clauses.

8. Retention

Verification detail record

Holds: Name, date of birth, document number and expiry date read from the ID; customer email; a link to the document image held by the ID verification provider; the provider's decision and warning codes.

Kept: Personal fields are erased automatically once the record is 90 days old (by a scheduled clean-up job). What remains holds no name, date of birth, document number, email or image link: the outcome, failure code, issuing state/country, number of attempts, order ID, provider reference, any manual-review note, and timestamps. The record is deleted on customers/redact, when the merchant deletes all verification data in the app (unless its order is still in progress), and on shop/redact.

Order verification status

Holds: Shopify order ID, customer email, verification status, reminder timestamps, and (only when the merchant uses state rules) the US shipping state code (shipState) or, for an order to a country the merchant doesn't sell to, the shipping country code (shipCountry), and what the app did for it.

Kept: Until the merchant's customer-erasure request (customers/redact), the merchant deletes all verification data in the app, or deletion of the merchant's data (shop/redact). The in-app delete keeps orders that are still in progress (waiting for the customer's ID check, waiting for the merchant's review, on hold, or waiting for a plan) so they can still be completed.

Returning-customer record

Holds: Customer email, verification status, verification date and reference, per store.

Kept: Until customers/redact, the merchant deletes all verification data in the app, or shop/redact. It lets a customer who already passed at a store skip re-verification on later orders at that same store.

Audit trail

Holds: Event type (for example verification completed, manual override), decision, provider reference, and the merchant's override note. No names, dates of birth or document numbers.

Kept: Entries tied to a deleted verification or order (including the merchant's override notes on it) are removed with it on customers/redact. When the merchant deletes all verification data in the app, entries are removed except those for orders still in progress and a record of each deletion (counts only, no personal data). All entries are removed on shop/redact.

Billing records

Holds: Shopify order ID, provider reference, approved/declined, plan, reporting status, the minimum age and ID types the check was created with and (only when the merchant uses state rules) the US shipping state code they came from. No customer email or name.

Kept: Until shop/redact. They are kept when the merchant deletes verification data in the app, because Shopify usage billing is calculated from them.

Merchant account and settings

Holds: Store domain, store name, Shopify shop ID, Shopify API access token, plan and billing status, app settings.

Kept: Access tokens/sessions are deleted when the app is uninstalled; everything else is deleted when Shopify sends shop/redact (about 48 hours after uninstall).

Held by the ID verification provider: ID images and data captured during the check are stored by the provider and kept under its retention terms and the storage settings of our account, until they are deleted at our request or under those terms. Deleting or anonymizing a record in our database does not by itself delete the provider's copy.

In the merchant's Shopify store: tags and fields the app wrote to orders and customers (section 2.3) stay in the store until the merchant or Shopify removes them.

Email delivery records and server logs are kept by Resend and Railway under their own retention terms.

9. Your rights and how to make a request

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal data, to object to or restrict its use, and to complain to a data protection authority. We will not discriminate against you for exercising these rights.

Our supervisory authority is the Commission for Personal Data Protection (Bulgaria). You can also complain to the data protection authority where you live or work.

Shoppers

Please send your request to the store you ordered from. Shopify then passes the merchant's request to us, and the app handles it as follows:

Access (customers/data_request): we record that the request was received. The merchant can find everything we hold about you in the app (records are searchable by email) and provide it to you.
Deletion (customers/redact): we delete your verification detail records, their audit entries (including any manual-decision notes the merchant wrote on your orders), your returning-customer record, and your order verification records, matched on your email and on the orders named in the request. Billing records, which hold no email or name, are kept until the store's data is deleted.

You may also contact us directly (section 14); we will normally pass your request to the relevant merchant, since we act on its behalf.

Merchants

In the app, under Settings → Privacy & data, you can download a CSV copy of the verification data we store for your store, and permanently delete it. Deleting keeps your app settings and the billing records Shopify usage billing is calculated from (they hold no customer email or ID details), orders that are still in progress (so they can still be completed), and a record that the deletion happened (counts only). It does not remove the tags and fields the app wrote to your Shopify orders and customers, so customers with an earlier order tagged "Age Verified" are still recognised as returning customers. You can also contact us. When you uninstall Carded, we delete your Shopify access tokens straight away; when Shopify sends the shop/redact request (about 48 hours after uninstall), we delete all data we hold for your store.

10. Security

Measures in place today include:

Encryption in transit (HTTPS/TLS) for the app, its webhooks and its calls to sub-processors.
Signature verification on Shopify webhooks and on storefront requests that can start a check or change data (the one unsigned storefront endpoint, used by the checkout page to show a QR code, is rate-limited and cannot start a check or change verification data), and a secret token, compared in constant time, on result callbacks from the ID verification provider and on our scheduled jobs. Those two reject every request if the secret is not configured.
Merchant access to the app only through Shopify's authenticated admin, scoped to their own store.
Rate limits on public verification links.
Data minimisation: no ID images on our servers, only the needed fields kept from the provider's response, automatic erasure of ID details after 90 days, and logs that leave out ID details and mask email addresses.

No system is perfectly secure, but we work to protect the data we hold.

11. Cookies and tracking

Carded does not use advertising or analytics cookies, tracking pixels or third-party analytics on its verification links, result pages, emails or on this website. This website serves its own fonts and sets no cookies; its hosting provider may record standard request logs. Shopify's sign-in process may set strictly necessary cookies when a merchant installs or opens the app. The app's own public pages load a web font from Shopify's content delivery network. The ID verification provider's page and the merchant's storefront are run by those parties under their own cookie policies.

12. Children and minors

Carded is a service for businesses, and its purpose is to stop people below a merchant's minimum age (usually 21) from receiving age-restricted products. We do not knowingly collect personal data from children except where a person under the minimum age attempts a verification. In that case the ID is processed only to reach a decision, and the resulting record (including the decline) is kept on the merchant's behalf under the same retention and deletion rules as any other record. It is not used for any other purpose.

13. Changes to this policy

We may update this policy as the app changes. We will post the new version on this page and update the effective date above. If a change materially affects how merchants' or shoppers' data is handled, we will also tell merchants in the app or by email.

14. Contact us

Questions or requests about this policy or your data: privacy@getcarded.io.

Postal address: Rolling Pandas, July 27 Street, 9000 Varna, Bulgaria.