Privacy Policy

Who we are

This policy describes {{COMPANY_NAME}} (“DotSection”, “we”). We run a marketplace that sells Shopify Online Store 2.0 section files. A section file is Liquid code you copy or import into a theme. We do not sell physical goods.

Postal address: {{COMPANY_ADDRESS}}.

Privacy questions go to support@dotsection.com.

Data we collect

We collect only what the marketplace needs to sell a file and, if you ask, to write it into a Shopify theme.

• Account: the name and email you enter, and a hash of your password when you create one here. We do not store the password itself.
• Haimc customer id: stored when you sign in with Haimc. Your Haimc password stays on that platform and is not sent to DotSection.
• Orders: the sections you bought or claimed, the amount, the status, the payment provider, and that provider’s checkout or payment id.
• Shopify shop domain: the .myshopify.com host you connect, so we know which store to write to.
• OAuth access token: the token Shopify issues for that shop. It is stored encrypted. A refresh token, if Shopify sends one, is encrypted the same way.
• Basic logs: sign-in sessions, theme-import records, webhook deliveries, and an audit log of admin actions such as refunds.
• Cookies: a sign-in cookie, a language cookie, and short-lived cookies used only while a Shopify connection or a Haimc sign-in is in progress.

We do not store card numbers. Stripe and Creem collect payment details on their own pages. Demo checkout shows card-shaped fields so the form looks like a real checkout; those fields are not named and are not saved.

We do not keep a copy of your Shopify customers, their orders, or their addresses. Connecting a store grants theme read and write access, not customer access.

Why we collect it

• To create your account and keep you signed in.
• To record a purchase, show it in your library, and let you copy or download the Liquid file.
• To import a section into a theme on a shop you connected.
• To refund an order and revoke the license that came with it.
• To answer an after-sales request you open on a receipt.
• To detect abuse, keep the service reliable, and respond to Shopify’s privacy webhooks.

Processors

Creem is the merchant of record for live sales. Creem processes the payment, tax, and payout. Stripe is used for testing. A Stripe checkout is processed by Stripe and is not the live merchant-of-record path.

Shopify provides the shop domain and the OAuth token when you connect a store, and Shopify delivers the privacy webhooks described below.

The company that hosts this site, and the database that stores accounts, orders, and encrypted tokens, process that data so the site can run. We do not sell personal information.

Retention

Account details stay while the account is open. If you ask us to delete the account, we delete the profile, sessions, and library tied to it. Orders and refund records can remain where a payment provider or a tax rule requires a record. Encrypted Shopify tokens stay until you disconnect the store, the app is uninstalled, or Shopify sends shop/redact. Webhook logs are kept so we can show that a privacy request arrived, and shop/redact removes earlier logs for that shop.

Your rights

You can ask for access, deletion, or an export of the personal data we hold about your account. Email support@dotsection.com from the address on the account, or open a help request on an order receipt. We may need to confirm it is you.

• Access: a description of the account, orders, and connected shop domains we store.
• Deletion: we close the account and remove the library. Payment records may stay as described under Retention.
• Export: a copy of that account and order data. Section files you already own can also be downloaded from your library.

Depending on where you live, you may also have a right to correct inaccurate data, to object to certain processing, or to complain to a data protection authority. This policy does not limit those rights.

Cookies

• ds_session keeps you signed in. It is an httpOnly cookie. Clearing it signs you out.
• ds_locale remembers English or Chinese.
• ds_shopify_state, ds_shopify_shop, and ds_shopify_next last only for the Shopify connection redirect. ds_haimc_state and ds_haimc_next last only for the Haimc sign-in redirect. They are not used for advertising.

The site does not use third-party advertising cookies.

International transfers

We and the processors above may store or access account, order, and token data in countries other than yours, including where Stripe, Creem, Shopify, or the host operates. Those providers publish their own transfer terms. We send them only what the checkout, the shop connection, or the hosting of this site requires.

Children

DotSection is a tool for merchants. It is not directed at children, and we do not knowingly create accounts for anyone under 16. If you believe a child has given us personal data, email support@dotsection.com and we will delete it.

Shopify privacy webhooks

The Shopify app receives three mandatory privacy topics at /api/shopify/webhooks on this site. Each delivery is checked with the HMAC in X-Shopify-Hmac-SHA256. A bad signature is rejected.

• customers/data_request: we log the request and respond successfully. We do not hold Shopify customer profiles to return.
• customers/redact: we log the request and respond successfully. There is no Shopify customer record on our side to erase.
• shop/redact: we log the request, then delete that shop’s connection, its encrypted access and refresh tokens, its theme-import rows, and earlier webhook logs for that shop.

Changes

If this policy changes, we will update the date at the top of this page. The date of this version is 2026-10-22.

Contact

{{COMPANY_NAME}}, {{COMPANY_ADDRESS}}. Email support@dotsection.com.