Privacy policy

Last updated: September 25, 2026

This Privacy Policy describes how Checkout Flow, operated by So shop, collects, uses, processes and protects certain information when you visit our website, use our services or use our integrations, including our Shopify × SumUp integration.

We place particular importance on the protection of personal data, transparency and the security of information processed in connection with our services.

1. DATA CONTROLLER

Checkout Flow is operated by:

So shop

103 boulevard de Paris

13002 Marseille

France

Email: checkoutflowintegration@gmail.com

If you have any questions regarding this Privacy Policy or the use of your personal data, you may contact us at the email address above.

2. SERVICES COVERED

This Privacy Policy applies in particular to:

- the Checkout Flow website;

- contact and enquiry forms;

- services and integrations provided by Checkout Flow;

- the Shopify × SumUp integration;

- related interfaces and dashboards;

- communications with our team;

- future Checkout Flow services to which this Privacy Policy is expressly made applicable.

Checkout Flow provides integration services between different platforms and third-party solutions.

As part of the Shopify × SumUp integration, our solution enables a Shopify merchant to connect their own SumUp account and use the integration to provide a payment flow associated with their store.

3. INFORMATION WE MAY PROCESS

Depending on how you use our services, we may process certain categories of information, including:

- first and last name;

- email address;

- company name;

- information voluntarily provided through our forms;

- information necessary to install and operate an integration;

- Shopify store identifier or domain;

- technical information relating to the store and its configuration;

- integration settings;

- information relating to products, variants, quantities, orders or shopping carts where necessary for the operation of the service;

- transaction references and statuses;

- technical identifiers required to communicate with third-party services;

- technical logs and information necessary for diagnostics, security and the proper operation of the service.

We seek to limit the information processed to what is reasonably necessary to operate and secure our services.

4. CONNECTION TO SUMUP

When a merchant uses the Shopify × SumUp integration, they may be invited to connect their own SumUp account.

This connection may use authorization mechanisms provided by SumUp.

Permissions granted are used only to the extent necessary to provide the features enabled by the merchant.

Sensitive authentication information required to operate the integration is not intended to be publicly exposed on the merchant's storefront or to its visitors.

5. PAYMENTS AND PAYMENT CARD DATA

Checkout Flow does not directly collect full payment card numbers, card security codes (CVV/CVC) or other complete payment card credentials used to make a payment through SumUp.

When a customer proceeds with a payment through SumUp, sensitive payment information is processed by the relevant payment infrastructure in accordance with its own terms and privacy policies.

Checkout Flow may nevertheless process certain non-sensitive information necessary for the operation and technical monitoring of a payment, such as:

- payment or checkout reference;

- amount;

- currency;

- transaction status;

- relevant merchant store;

- information required to associate the payment with the corresponding order.

This information may be used, in particular, to verify that a payment has been properly confirmed and to enable the corresponding processing in Shopify.

6. SHOPIFY DATA

When a merchant installs or uses a Checkout Flow integration with Shopify, certain Shopify data may be processed only to the extent necessary to provide the service.

This may include:

- store identification;

- application configuration;

- relevant products and variants;

- quantities;

- prices required to verify a transaction;

- shopping cart information;

- information required to create or update an order;

- technical information necessary for the operation of the integration.

The exact scope of accessible information depends on the features used and the permissions granted.

7. PURPOSES OF PROCESSING

Information may be used to:

- provide Checkout Flow services;

- install and operate integrations;

- connect services authorized by the merchant;

- operate the Shopify × SumUp integration;

- verify and process operations necessary for the payment flow;

- associate payments with corresponding orders;

- provide technical support;

- respond to contact requests;

- identify and resolve errors;

- prevent abuse, fraud and unauthorized use;

- improve the security and reliability of our services;

- comply with legal and regulatory obligations;

- operate and administer Checkout Flow.

8. LEGAL BASES FOR PROCESSING

Where required by applicable law, the processing of personal data may be based on:

- performance of a contract or steps taken prior to entering into a contract;

- our legitimate interests in providing, securing and improving our services;

- compliance with a legal obligation;

- your consent, where consent is required.

9. SERVICE PROVIDERS AND THIRD-PARTY SERVICES

Checkout Flow may rely on third-party services necessary for its operation.

These may include:

- Shopify;

- SumUp;

- hosting providers;

- technical infrastructure providers;

- tools necessary for security, support or operation of the service.

These providers may process certain information in accordance with their own obligations, terms and privacy policies.

Checkout Flow does not control the independent privacy practices of third-party services. We recommend reviewing their respective privacy policies when using their services.

10. SHARING OF PERSONAL DATA

We do not sell your personal data.

Certain information may be disclosed where necessary:

- to service providers involved in the technical operation of our services;

- to platforms that the merchant chooses to connect to Checkout Flow;

- to competent authorities or public bodies where required by law;

- to professional advisers or providers where necessary for our operations, security or the protection of our rights.

We seek to limit such disclosures to the information necessary for the relevant purpose.

11. SECURITY

We implement reasonable technical and organizational measures designed to protect information against, in particular:

- unauthorized access;

- disclosure;

- alteration;

- loss;

- destruction;

- misuse.

Sensitive authentication information and other technical secrets are not intended to be publicly exposed through interfaces accessible to customers or storefront visitors.

However, no information system can guarantee absolute security.

12. MERCHANT DATA ISOLATION

Checkout Flow's architecture is designed to separate information associated with different stores using the service.

Each merchant must use their own connections and authorizations for the services they choose to connect.

The information and permissions belonging to one merchant must not enable another merchant to access that merchant's account, data or transactions.

13. DATA RETENTION

We retain information only for as long as reasonably necessary:

- to provide the service;

- to operate the integration;

- to process support requests;

- for security and diagnostics;

- to comply with legal obligations;

- to resolve potential disputes.

Certain information may be deleted or anonymized when it is no longer required, subject to applicable legal retention requirements.

14. UNINSTALLATION AND TERMINATION OF USE

When a merchant uninstalls an application or stops using a Checkout Flow service, certain information may be deleted, deactivated or temporarily retained where necessary to comply with a legal obligation, maintain security, manage a dispute or retain legitimate technical records.

Authorizations granted to third-party services may also need to be revoked through the relevant third-party service.

15. INTERNATIONAL DATA TRANSFERS

Some technical providers or platforms used in connection with Checkout Flow may process or host information in different countries.

Where required by applicable law, we seek to use appropriate mechanisms to safeguard international transfers of personal data.

16. YOUR RIGHTS

Depending on your place of residence and applicable law, you may have certain rights regarding your personal data, including:

- the right of access;

- the right to rectification;

- the right to erasure;

- the right to restriction of processing;

- the right to object to processing;

- the right to data portability, where applicable;

- the right to withdraw consent where processing is based on consent.

To exercise a right or ask a question regarding your personal data, contact:

checkoutflowintegration@gmail.com

We may request certain information necessary to verify your identity and the legitimacy of the request before responding.

17. COOKIES AND SIMILAR TECHNOLOGIES

Our website and the platforms used to provide our services may use cookies or similar technologies necessary for functionality, security, preferences or, where applicable and permitted, analytics.

Where applicable law requires consent, non-essential technologies subject to consent should only be used after the required consent has been obtained.

Settings available through your browser or our website may also allow you to control certain technologies.

18. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy to reflect:

- changes to our services;

- the addition or modification of an integration;

- technical developments;

- changes to our practices;

- legal or regulatory developments.

The "Last updated" date at the top of this Privacy Policy will be revised when appropriate.

We encourage you to review this page periodically.

CONTACT

For any questions regarding this Privacy Policy or personal data protection:

Checkout Flow