Legal
Three legal pages, and what none of them is yet.
Refik has no published privacy policy and no service agreement. What it has is a measured account of what the code does with data, written out in three pages. This one says which is which, and what each one is still waiting on.
The pages
Three documents, each with one job.
They are split the way the questions arrive: what happens to data, what you agree to when you install, and what to do when somebody asks for their data back.
Privacy
What we do with data
Every category Refik reads or stores, what it is used for, who else touches it, and how long it stays — each period read off a constant in the code rather than typed into a template.
Terms
What you agree to at install
The permission screen Shopify shows you, the billing rules as the billing code has them, what uninstalling does, and the short list of things this app does not promise.
Data requests
How a request travels
The route from a shopper to us, the three Shopify webhooks that carry it, what comes back from each one, and the single request we cannot match to a person.
Each page links back here, and each says at the top that it is not an agreement. The security page is the longer, more technical version of the same facts; where the two overlap these pages point at it instead of repeating it. Two copies of one fact drift apart, and the one you happen to read is the one you believe. One more page sits beside this set rather than inside it: the accessibility statement is about this website rather than about your data, so it is named here instead of counted as a fourth document. The data processing addendum sits beside the set for the opposite reason: it is an agreement rather than a measured account, so it carries an effective date and none of the three does.
State
What is done, and what is only claimed to be done.
A legal page is the easiest place on a site to sound finished. These are the two halves, kept apart on purpose.
Written, and checked against the code
- Every retention period on the privacy page is a constant with a cleanup job behind it
- The billing rules on the terms page are the ones the billing code enforces, not a price list
- The three webhooks on the data-request page are the three the app is actually subscribed to
- No figure on any of the three was typed by hand; the build rejects one that has no source
- The provider is named: Pirahas Türkiye, Uludağ University ULUTEK Technopark, Bursa, Türkiye — [email protected]
Checked means a test compares the page against the source, or the sentence was read out of the file it describes. It does not mean a lawyer read it.
Not done, and not dressed up
- No legal review. None of the three has been read by counsel
- No EU or UK representative and no data protection officer named
- No service agreement. The data processing addendum exists, and it has not been read by counsel either
- No effective date, because none of the three takes effect
A date on an unreviewed document would be the most convincing false thing on this page. What the three carry instead is the day they were last measured.
Missing
Four things missing from all three.
Each one is a condition rather than an intention, and each waits on a lawyer or a signature rather than on more writing.
-
Which role each of us holds
The provider is named — Pirahas Türkiye, at the top of the privacy page. Whether it acts as controller or processor for each kind of data is how the code is built rather than a conclusion a lawyer reached, and no representative abroad or data protection officer has been named.
-
A legal review
These pages describe the code as accurately as we can measure it. Deciding whether that description satisfies a particular law in a particular country is a different job, and we have not had the second one done.
-
A mechanism for transfers
Processing can happen outside the country you or your shopper is in. Whether the clauses in our sub-processors’ agreements are the right mechanism for a particular store is a legal question that has not been put to anyone.
-
An agreement to sign
A merchant needs a service agreement and a data processing agreement, and Shopify’s own requirements ask for both. The data processing addendum is published and applies from installation; the service agreement does not exist. Until it does, what you accept is the permission screen Shopify puts in front of you and that addendum.
None of the four carries a date. The company now has a name, so an agreement has a party; it still has to be written and reviewed, and a date here would be the fifth thing on this page that nobody can check. To reach Pirahas Türkiye in the meantime, write to [email protected] or use the contact page.
Questions
The questions this page raises.
Is any of this the privacy policy Shopify asks for?
No. Shopify asks for a privacy policy linked from an App Store listing, and Refik has neither yet. When the listing exists the policy will be built out of the privacy page here rather than written from scratch: the measuring is the slow half and it is done. What is missing is a name, an address and a review.
Then why publish an unfinished set of legal pages?
Because the alternative on this site was a footer link marked “soon”, and there was enough measured material to write something true. A page that says what it does not know is more use to you than a blank one, and easier to hold against us later.
What happens to these pages when the real documents exist?
They stop being the only thing and become the plain half. A reviewed policy will sit next to them rather than replace them: the measured account is the part that is hard to write and easy to check, and deleting it to make room for legal prose would be a step backwards.
Where is the technical version of all this?
The security page. It has the access scopes one at a time with what each is for, how the access token is encrypted and rotated, the three deletion paths, the sub-processors with what leaves our system to reach each one, and the headers on both surfaces.
What binds you today, then?
Three things, and none of them is on this page. The data processing addendum, which sets out how we process your shoppers’ data on your behalf. Shopify’s permission screen, which decides what Refik can touch at all — it cannot be widened without every installed store approving again. And the billing code, which stops rather than continuing to charge when a plan’s ceiling is reached. The terms page is the description of the last two.