Privacy policy

Aftercheck is run by Shapesoft, part of MB Group (Mansoor Brothers Enterprises Inc.), Suite 104, 100 Dynamic Drive, Toronto, ON M1V 5C4, Canada. We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Canada's anti-spam law (CASL). For anything about your information, email aftercheck@shapesoft.ca.

• The store address you enter and what the scan finds on that store's public pages: whether pages open, how long they take, errors, the checkout's payment options, and the software versions the store shows. This is about the store, not about you.
• A one-way code made from your network address, which changes every day, to keep each connection to 5 scans a day. We never store the address itself.
• A person check by Cloudflare Turnstile on the scan and report forms, which stops automated abuse. Cloudflare handles that check under its own privacy policy.

When you ask for the full report, we use your email address to send it, then remove the address from the report record. We keep a one-way code of it for 30 days to apply the sending limits.

If you also tick the box to hear from us, the report email asks you to confirm. Only after you confirm do we keep your address, the wording you agreed to and the date, and email you about monitoring for your store. Every email has an unsubscribe link that works with one click. After you unsubscribe we keep a one-way code of your address so we never email it again.

A connected plugin sends us information about the store, never about its customers:

• the store's address and the addresses of its shop, cart, checkout and account pages;
• versions of WordPress, WooCommerce, PHP, plugins and themes, and a history of changes to them;
• the names of checkout, tax, shipping and payment settings that were saved, never their values;
• counts of orders by status and of failed payments, and money only as totals;
• WooCommerce error messages and file paths, shortened, with anything that looks like a key, token or email address removed;
• the state of scheduled jobs and email sending, and which payment methods are on and whether they are in test mode.

It never sends customer names, email addresses, postal addresses, IP addresses, order contents or card details. Test orders use a made-up customer whose email address cannot receive mail.

For Store Care and Agency clients we keep contact and billing details, the stores we look after, and the results of our tests and fixes. Administrator passwords for client stores are kept in a password manager, never in Aftercheck's database.

The public pages use no analytics, advertising or tracking cookies. Cookies are set only when our own staff sign in to the console.

We share information only with the services that run Aftercheck for us, and only what each one needs:

• Supabase, our database;
• Vercel, which hosts this website;
• Resend, which sends our emails;
• Cloudflare, for the person check on our forms;
• DigitalOcean and computers we operate, which run the tests.

Some of them store or process information outside Canada, mainly in the United States, where the authorities of that country may be able to access it under its laws. We never sell personal information.

Information travels encrypted. Store secrets and keys are encrypted when stored and never written to logs. Only our staff can open the console, with a password and a code from an authenticator app, and the database keeps each client's information apart from every other client's.

You can ask to see the personal information we hold about you, have it corrected, or have it deleted, and you can withdraw your consent to our emails at any time. Email aftercheck@shapesoft.ca and we will answer within 30 days. If you are not satisfied, you can complain to the Office of the Privacy Commissioner of Canada.

Store owners who do not want our scanner to visit can say so in robots.txt (how to opt out).

When we change this policy we update the date at the top. If a change affects how we use information you have already given us, we will ask for your consent where the law requires it.