Privacy Policy — Okari Reviews
Effective Date: October 22, 2026 · Controller / Processor: Okari Reviews (privacy@okari.store)
Okari Reviews ("Okari", "we", "our") provides product review collection, verified-buyer validation, and storefront display widgets for merchants on Shopify. This Privacy Policy describes how we process data in compliance with GDPR, CCPA/CPRA, and Shopify's Built for Shopify requirements.
1. Data We Collect & Why
- Merchant Store Configuration: Your
*.myshopify.comdomain, active plan tier, brand palette tokens, and auto-moderation rules stored under an isolated tenant path (apps/okari-reviews/tenants/{shopDomain}). - Customer Reviews: Reviewer display name, star rating, review title, review body, product ID, and a one-way cryptographic SHA-256 hash of the reviewer's email address (
authorEmailHash). Raw customer emails are never exposed publicly. - Verified Purchase Index: When an order is paid (
orders/paid), we store only the SHA-256 email hash and purchased product IDs to automatically badge Verified Buyers without retaining raw billing or shipping addresses.
2. Strict Multi-Tenant Isolation
Every merchant's data is logically and cryptographically isolated inside Google Cloud Firestore (nam5) under apps/okari-reviews/tenants/{shopDomain}. Cross-tenant queries are impossible by design.
3. Mandatory Shopify GDPR / Privacy Webhooks
Okari subscribes to and processes all mandatory Shopify privacy webhooks in real time:
customers/data_request: Exports any review records matching the customer's SHA-256 email hash.customers/redact: Permanently deletes or anonymizes all review and order-verification records associated with the customer's email hash within the merchant's tenant.shop/redact&app/uninstalled: Immediately revokes stored OAuth access tokens and schedules full tenant purge within 48 hours of uninstallation.
4. Contact & Data Protection Officer
For privacy inquiries, GDPR data requests, or security disclosures, contact us at privacy@okari.store or support@okari.store.