# Shopivision Support and Privacy Runbook

Owner: `[NAME / TEAM]`  
Emergency developer contact: `[NAME / EMAIL / PHONE]`  
Support mailbox: `support@shopivision.zohodesk.com`  
On-call channel: `[CHANNEL]`

## Review-period coverage

- Monitor the submission contact and support mailbox during business hours in `[TIME ZONE]`.
- Acknowledge reviewer messages within `[TARGET]` hours.
- Keep reviewer credentials active until the app is approved or the submission is closed.
- Log every reviewer issue with timestamp, app version, shop, reproduction steps, severity, owner, and resolution.
- Do not deploy unrelated breaking changes during active review.

## Incident severity

| Severity | Example | Target response |
| --- | --- | --- |
| P0 | Security incident, cross-shop data exposure | Immediate escalation; contain and notify required parties |
| P1 | Reviewer cannot install, authenticate, or complete core flow | `[TARGET]` minutes |
| P2 | Partial feature failure or misleading state | `[TARGET]` hours |
| P3 | Cosmetic or documentation issue | Next planned release or same-day documentation fix |

## Mandatory compliance webhooks

All public App Store apps must handle these topics, whether or not the app believes it stores personal data:

| Topic | Purpose | Handler | Evidence |
| --- | --- | --- | --- |
| `customers/data_request` | Provide stored customer data | `[ENDPOINT / JOB]` | `[TEST LOG]` |
| `customers/redact` | Delete customer data | `[ENDPOINT / JOB]` | `[TEST LOG]` |
| `shop/redact` | Delete shop data after uninstall | `[ENDPOINT / JOB]` | `[TEST LOG]` |

For every compliance webhook:

1. Accept the expected Shopify `POST` with JSON.
2. Verify the Shopify HMAC using a timing-safe comparison.
3. Return `401 Unauthorized` for invalid HMAC.
4. Queue idempotent work and acknowledge within Shopify's expected response window.
5. Record a non-sensitive event ID, shop ID, topic, received time, completion time, and outcome.
6. Alert the on-call owner when processing exhausts retries.

## Customer data request

1. Validate HMAC.
2. Locate data using the supplied shop/customer identifiers.
3. Export only the data associated with the request.
4. Deliver it through the documented secure process.
5. Record completion without logging the exported personal data.

## Customer redaction

1. Validate HMAC.
2. Identify records and generated metadata tied to the customer.
3. Delete or irreversibly anonymize data according to the privacy policy and legal retention obligations.
4. Record completion and any lawful retention exception.

## Shop redaction and uninstall

1. On uninstall, revoke/stop future shop jobs and access.
2. When `shop/redact` arrives, validate HMAC.
3. Delete shop tokens, product snapshots, campaign metadata, generated assets, logs containing shop-linked personal data, and third-party copies according to policy.
4. Retain only data explicitly allowed and described in the privacy policy.
5. Record completion and verify the shop can reinstall through fresh OAuth.

## Reviewer support reply template

Subject: `Shopivision review — [ISSUE] — [STATUS]`

Hello Shopify App Review Team,

Thank you for the details. We reproduced `[ISSUE]` in version `[VERSION]` on `[TIME]`.

- Cause: `[CONCISE CAUSE]`
- Resolution: `[CHANGE]`
- Production verification: `[EVIDENCE]`
- Updated test step: `[STEP]`

The original reviewer credentials remain active. Please contact `[NAME / EMAIL]` if any additional information would help.

## Submission-day verification

- [ ] All three compliance webhook endpoints return success for valid test deliveries.
- [ ] Invalid-HMAC tests return `401`.
- [ ] Privacy, terms, deletion, and support pages return `200` over HTTPS.
- [ ] Emergency developer contact is current in Partner settings.
- [ ] Reviewer credentials pass in a clean/incognito session.
- [ ] On-call owner and backup have access to logs and deployment controls.

Official reference: https://shopify.dev/docs/apps/build/compliance/privacy-law-compliance