Champ › GDPR
GDPR
Effective 20 September 2026
Champ is built to sit correctly inside Shopify's data-protection model. This page states, plainly, what that means for merchants selling into the EU, the UK, and anywhere else with comparable law.
Roles#
For forum content, you the merchant are the data controller and Champ is a processor. Your customers' posts, profiles and messages are processed on your instructions, for the purpose of running your community, and for nothing else.
For the merchant account itself — your store domain, contact email and billing status — Champ is the controller.
Mandatory Shopify webhooks#
Shopify requires every app to implement three privacy webhooks. Champ implements all three and verifies the HMAC signature on each one before acting.
| Webhook | What Champ does |
|---|---|
customers/data_request | Collects the forum data held for that customer so it can be provided to them. |
customers/redact | Removes the personal data held for that customer. |
shop/redact | Removes the store's data after the app has been uninstalled. |
Exercising rights#
- Access and portability. A merchant can request a complete JSON export of forums, topics, posts and users at any time from the Data section of the dashboard. For a single member, use Shopify's customer data request flow.
- Erasure. Use Shopify's customer redaction flow, or email us and we will delete the data and confirm when it is gone, including from backups as they expire on their 14-day cycle.
- Rectification. Members can edit their own posts and profiles; moderators can edit any post.
Sub-processors#
The providers listed in the privacy policy are our sub-processors. Akismet is engaged only when a merchant supplies their own key, and Cloudinary uploads go to the merchant's own account, under the merchant's own contract with Cloudinary.
Transfers and security#
Data is processed in our hosting provider's facilities and backed up, encrypted, to Cloudflare R2. Secrets and credentials are encrypted at rest with authenticated encryption. Access to production is limited to the people who operate the service.
Data processing agreement#
If your legal team needs a signed DPA, email us and we will provide one.