Privacy policy
Effective date: September 15, 2026
This policy explains what data Optan Age Verification (the “App”), a
Shopify application published by Optan (“we”, “us”), processes, why, and what
your rights are. It covers the App and this website
(optanapps.com/age-verification). Questions are welcome at any time:
support@optanapps.com.
The short version
Section titled “The short version”- We collect no personal data about storefront visitors. No names, no emails, no IP addresses, no identifiers.
- A date of birth entered in the age gate never leaves the visitor’s browser and is never stored.
- The gate sets one functional first-party cookie containing the literal
value
1— nothing that can identify anyone. - The optional consent log records only outcome, country code, time, store — anonymous by construction.
- Merchant data is limited to what Shopify requires to run an embedded app, hosted in the European Union (France), and deleted after uninstall.
- We use no analytics, no advertising services, no trackers, and we never sell or share data.
Who we are
Section titled “Who we are”Optan is the publisher of the Optan Age Verification app for Shopify.
- Contact: support@optanapps.com
- Website: optanapps.com/age-verification
For data held on behalf of a merchant’s store, the merchant is the data controller and we act as a processor; for the merchant account data described below, we are the controller.
Data we process about merchants
Section titled “Data we process about merchants”When a merchant installs the App, Shopify provides us with the data any embedded app needs to function:
| Data | Contents | Purpose | Legal basis |
|---|---|---|---|
| Store identity | The store’s .myshopify.com domain |
Operating the App for your store | Contract performance |
| API credentials | The access token Shopify issues to the App | Authenticated calls to Shopify’s API on your store’s behalf | Contract performance |
| Admin user profile | Name, email address and language of the admin user, as provided by Shopify’s session | Operating the embedded admin session | Contract performance |
| App preferences | Your chosen admin language and your gate configuration | Providing your settings | Contract performance |
Billing for the Pro plan is executed entirely by Shopify. We never receive or store payment card data or bank details; we only receive your subscription’s status (active, trial, cancelled) from Shopify.
We do not access your customers, orders, or checkout data. The App’s Shopify permissions are limited to reading products/collections (to configure targeting) and managing its app proxy (to receive consent-log events).
Data we process about storefront visitors
Section titled “Data we process about storefront visitors”None that identifies a person. In detail:
The age gate cookie
Section titled “The age gate cookie”After a visitor passes the age check, the gate sets one first-party cookie on the merchant’s store domain:
| Cookie | Value | Purpose | Duration |
|---|---|---|---|
optan_ag_pass |
1 |
Remember that this browser passed the age check | Set by the merchant: 0–365 days (default 30; 0 = browser session) |
The cookie contains no identifier, is not readable by us (it lives on the merchant’s domain and is never transmitted to our servers), and cannot be used to track anyone. It is a functional cookie serving an age-restriction obligation.
Date of birth
Section titled “Date of birth”If the merchant enables date-of-birth mode, the visitor’s entry is evaluated inside the browser and immediately discarded. It is not transmitted to our servers, to Shopify, or to any third party, and it is never stored anywhere.
Consent log events
Section titled “Consent log events”If the merchant enables the optional consent log (Pro), each gate interaction
sends an event through the store’s own domain (Shopify app proxy) to the App.
An event consists of exactly four fields: the outcome (pass or
decline), the country code of the store’s localization context (e.g.
FR, sometimes empty), the timestamp, and the store domain. We store
no IP address, no user agent, no cookie value, no session or visitor
identifier with these events. The data is anonymous: it cannot be related to
an identifiable person by us or by the merchant.
What the storefront never does
Section titled “What the storefront never does”The gate makes no requests to third-party domains, embeds no analytics or advertising code, uses no fingerprinting, localStorage profiling or pixel of any kind.
This website
Section titled “This website”This documentation site is static. It sets no cookies, runs no analytics, and collects no data. Fonts and all assets are self-hosted; no third-party CDN receives your visit.
Where data is stored
Section titled “Where data is stored”The App’s server and database are hosted by o2switch in France (European Union). Data is not transferred outside the EU/EEA. Shopify itself (independently of us) processes platform data under its own privacy policy.
Like virtually all web servers, our hosting infrastructure keeps short-lived technical server logs for security and reliability; these are routine operations logs, not used for profiling.
How long we keep data
Section titled “How long we keep data”| Data | Retention |
|---|---|
| Merchant session and preferences | Until the App is uninstalled |
| Gate configuration (metafield on your store) | Removed with the App’s data on uninstall |
| Consent events | Until uninstall — erased with shop data redaction |
The optan_ag_pass cookie |
Expires per the merchant’s setting; visitors can clear it at any time |
Deletion and Shopify’s privacy webhooks
Section titled “Deletion and Shopify’s privacy webhooks”The App implements Shopify’s three mandatory privacy webhooks:
customers/data_request— we respond that we hold no data on individual customers, which is true by design.customers/redact— no action needed: no customer-linked data exists in the App.shop/redact— sent by Shopify about 48 hours after a merchant uninstalls; on receipt we permanently erase all remaining data for that store, including all consent events.
Session data and API credentials are additionally invalidated immediately at uninstall time.
Your rights
Section titled “Your rights”If you are in the EU/EEA, UK, or a jurisdiction with similar laws, you have rights of access, rectification, erasure, restriction, portability, and objection over personal data concerning you. Given how little we hold, most requests concern merchant account data. Write to support@optanapps.com and we will respond promptly. You also have the right to lodge a complaint with your supervisory authority (in France, the CNIL).
Storefront visitors: the App holds no data that identifies you. Your age-gate cookie can be cleared in your browser at any time; the store you visited is the controller for its storefront.
Sub-processors and sharing
Section titled “Sub-processors and sharing”We share data only with what is strictly required to run the service:
| Recipient | Role | Location |
|---|---|---|
| Shopify | Commerce platform the App runs on (authentication, billing, app proxy) | Per Shopify’s privacy policy |
| o2switch | Server and database hosting | France (EU) |
We never sell data, never share it for advertising, and use no analytics providers.
Children
Section titled “Children”Neither the App nor this site is directed at children. The App’s purpose is precisely to help merchants restrict access to age-inappropriate products; it collects no data from the visitors it screens.
Changes to this policy
Section titled “Changes to this policy”We may update this policy as the App evolves. The effective date at the top reflects the latest revision; material changes will be announced to merchants through the App or by email.
Contact
Section titled “Contact”Optan — support@optanapps.com