Privacy Policy — Disciplina EAA Audit

Last updated: 14 August 2026

Disciplina EAA Audit ("the app") is a Shopify app operated by Disciplina (individual entrepreneur, Tbilisi, Georgia). It scans a store's published theme against WCAG 2.1 AA and produces audit reports and accessibility statements.

The short version: the app reads your theme with read-only permissions, stores only the scan findings, and never collects or stores your customers' personal data. When you uninstall, access is cut immediately and stored scan data is permanently erased through Shopify's mandated erasure process.

Data we collect from your store

Shop domain and an API access token — created by Shopify when you install the app, used solely to read your published theme. The app requests a single read-only scope (read_themes) and never writes to your store.
Scan results — for each accessibility issue found: the theme file path, line and column, the affected code snippet, the WCAG criterion and severity.
Subscription status — billing is handled entirely by Shopify. We never see or store your payment details.

Data we do not collect

No customer personal data. The app never requests access to customer records, orders, names, emails or addresses.
No advertising or analytics trackers. The only cookie is the transient one Shopify's sign-in flow requires.

How your data is processed and stored

Theme files are fetched through the Shopify API, analysed, and discarded — only the findings listed above are persisted. Data is stored on servers operated by Fly.io in Frankfurt, Germany (EU).

Retention and deletion

When you uninstall the app, the API access token is deleted immediately.
48 hours after uninstall, Shopify sends the mandated shop/redact request and the app permanently erases all remaining data for your shop: scans, issues, checksums and sessions. If erasure fails, the app reports failure to Shopify so the request is retried — it never falsely confirms deletion.
A minimal compliance log (topic, shop domain, shop ID, timestamp, outcome) is retained as proof that erasure requests were honoured. It contains no personal data.

GDPR requests

The app implements all three of Shopify's mandatory compliance webhooks with cryptographic (HMAC) verification: customers/data_request, customers/redact and shop/redact. Because the app holds no customer personal data, customer data requests and redactions are acknowledged and logged with nothing to disclose or delete.

Who we share data with

Shopify — the platform the app runs on.
Fly.io — hosting provider (Frankfurt, EU region).
We do not sell or share data with anyone else.

Contact

For any privacy question or request, email mishikochkhvirkia@gmail.com.