@tollwyn/baukasten 0.0.2 → 1.2.3

package/dist/shopify/legal/de.js

@@ -0,0 +1,123 @@
+import { heading, lettered, link, list, longDate, mail, note, paragraph, strong } from '../../server/legal/document.js';
+import { FLEET } from '../../server/legal/fleet.js';
+import { APP_PROCESSORS, SHOPIFY } from './shopify.js';
+const { cloudflare, hoster, neon, webServer } = FLEET;
+const CONTRACT = 'Erfüllung des Vertrags, Art. 6 Abs. 1 lit. b DSGVO';
+const TRANSFER = {
+    adequate: 'Land mit angemessenem Schutz',
+    dpf: 'unter dem Data Privacy Framework zertifiziert',
+    scc: 'mit den Standardvertragsklauseln der EU, vom EDÖB anerkannt'
+};
+const BROWSER = {
+    networkErrorLogging: `${cloudflare.name} lässt Ihren Browser ausserdem eine Anweisung speichern, gescheiterte Verbindungen zu melden (Network Error Logging). Löschen Sie Cookies und Websitedaten im Browser, fällt auch diese Anweisung weg.`
+};
+const EDGE = {
+    worldwideUnderScc: 'im Rechenzentrum, das Ihnen am nächsten liegt und ausserhalb der Schweiz und der EU stehen kann; dort gelten die Standardvertragsklauseln seines Auftragsbearbeitungsvertrags'
+};
+const ACCESS_LOG = {
+    none: 'Unser Webserver führt kein Zugriffsprotokoll'
+};
+const ERROR_LOG = {
+    requestWithoutAddress: 'nur eine Anfrage, die er nicht an die Anwendung weitergeben kann, schreibt er in sein Fehlerprotokoll, ohne Ihre IP-Adresse und ohne Parameter und Kopfzeilen'
+};
+const NEW_VERSION = {
+    removed: 'es fällt ausserdem bei jedem Start einer neuen Version weg',
+    stays: 'beim Start einer neuen Version bleibt es'
+};
+/** The sections the text points to. */
+const ON_BEHALF = 'Bearbeitung in Ihrem Auftrag';
+const HOW_LONG = 'Wie lange';
+const who = (f) => `${f.operator.name}, ${f.operator.address}`;
+export function de(f) {
+    const { data, recipients } = f.privacy;
+    const processors = [
+        ...APP_PROCESSORS,
+        ...recipients
+            .filter((recipient) => recipient.role === 'processor')
+            .map((recipient) => recipient.name)
+    ];
+    return {
+        title: 'Datenschutzerklärung',
+        blocks: [
+            note(`Stand: ${longDate(f.version, 'de')}.`),
+            paragraph(`Diese Erklärung beschreibt, welche Personendaten ${f.name} bearbeitet, wozu, wo und wie lange. Sie folgt dem Bundesgesetz über den Datenschutz (DSG) und, wo sie anwendbar ist, der Datenschutz-Grundverordnung der EU (DSGVO).`),
+            paragraph(`${f.name}, unter ${f.origin}, ist eine App für Shopify-Shops. ${f.privacy.service} ${f.name} richtet sich nur an Unternehmen, öffentliche Stellen und Selbständige für ihre berufliche Tätigkeit, nicht an Konsumenten.`),
+            paragraph(`${f.name} wird betrieben von ${who(f)} («wir»), erreichbar unter `, mail(FLEET.mailbox), `. Für die Daten über Ihren Shop als unseren Kunden sind wir verantwortlich. Für die Personendaten, die ${f.name} für Sie bearbeitet, etwa die Ihrer Kunden, sind Sie verantwortlich, und wir bearbeiten sie in Ihrem Auftrag (siehe «${ON_BEHALF}»).`),
+            heading('Was wir bearbeiten, wozu und gestützt worauf'),
+            list([
+                strong('Ihr Shop'),
+                `: seine dauerhafte myshopify.com-Domain, die IDs Ihres Shops und von ${f.name} bei Shopify, die E-Mail-Adresse Ihres Shops bei Shopify (die seines Inhabers, an die wir die Anfragen nach Daten Ihrer Kunden schicken, die Shopify an uns weitergibt), die Berechtigungen (Scopes), die Sie ${f.name} erteilt haben, ob es sich um einen Entwicklungsshop handelt, wann ${f.name} darin installiert und wann es entfernt wurde, das Offline-Zugriffstoken und das Refresh-Token, die Shopify ${f.name} gibt (verschlüsselt gespeichert), und der Plan von ${f.name} für Ihren Shop, wie ihn die Partner-API von Shopify meldet, mit dem Ende seiner Testphase – um ${f.name} für Ihren Shop zu betreiben und seinen Plan zu kennen (${CONTRACT}).`
+            ], [
+                strong('Abrechnung'),
+                `: Shopify rechnet ${f.name} mit Ihnen ab und bearbeitet Ihre Zahlungsangaben; von Shopify erhalten wir nur den Plan Ihres Shops und den Stand seines Abos (${CONTRACT}).`
+            ], [
+                strong('Sicherheit und Betrieb'),
+                `: Unsere Anwendung protokolliert jede Anfrage (Methode, Pfad ohne Parameter, Status, Dauer) und Ereignisse des Dienstes mit der Domain Ihres Shops, ohne IP-Adressen, E-Mail-Adressen, Tokens oder Schlüssel. ${ACCESS_LOG[webServer.accessLog]}; ${ERROR_LOG[webServer.errorLog.content]}. Unser Mail-Relay protokolliert für jede E-Mail, die wir senden, die Empfängeradresse und den Zustellstatus und bewahrt beides höchstens ${FLEET.relayLogDays} Tage auf. Wo wir Anfragen begrenzen, zählen wir sie je Shop im Arbeitsspeicher der Anwendung, nie auf der Festplatte; ein Zähler gilt höchstens eine Stunde und ist spätestens beim Neustart der Anwendung vergessen (berechtigtes Interesse an einem sicheren und funktionierenden Dienst, Art. 6 Abs. 1 lit. f DSGVO).`
+            ], [
+                strong('E-Mails an uns'),
+                ': Schreiben Sie uns, bewahren wir Ihre Nachricht und Adresse auf, um Ihnen zu antworten und den Austausch zu belegen (berechtigtes Interesse; bei Kunden Erfüllung des Vertrags).'
+            ], ...data.map((item) => [
+                strong(item.name),
+                `: ${item.what}, aus ${item.source} – ${item.purpose} (in Ihrem Auftrag).`
+            ])),
+            paragraph(strong('Cookies'), `: ${f.name} selbst setzt kein Cookie und speichert nichts in Ihrem Browser. Es läuft in der Verwaltung Ihres Shopify-Shops, die es lädt, und seine Seiten laden App Bridge und Polaris von den Servern von Shopify (cdn.shopify.com), wie Shopify es von Apps in seiner Verwaltung verlangt. ${BROWSER[cloudflare.browser]} Wir verwenden keine Werbe- oder Analyse-Tracker, verkaufen keine Daten und entscheiden nicht automatisiert über Sie.`),
+            heading('Wer Daten erhält und wo'),
+            list([
+                `Shopify, wo Ihr Shop liegt und das seine Daten nach Ihrem eigenen Vertrag mit Shopify bearbeitet: ${f.name} liest die Daten Ihres Shops dort und schreibt dorthin zurück, was Sie es tun lassen; die Partner-API von Shopify nennt uns den Plan Ihres Shops, und Shopify rechnet ${f.name} mit Ihnen ab. Was Shopify selbst bearbeitet, und wo, beschreibt es unter `,
+                link(SHOPIFY.privacy, `https://${SHOPIFY.privacy}`),
+                '.'
+            ], [
+                `${cloudflare.name} (${cloudflare.country.de}; ${TRANSFER[cloudflare.transfer]}) steht vor ${f.name}: Es entschlüsselt die Verbindung (TLS), leitet Anfragen weiter und filtert Angriffe. Es sieht darum jede Anfrage samt Ihrer IP-Adresse, ${EDGE[cloudflare.edge]}. Ausserdem speichert es die verschlüsselten Sicherungen unserer Datenbank (Cloudflare R2, ${cloudflare.backups.where.de}), die es nicht lesen kann.`
+            ], [
+                `Anwendungsserver: ${hoster.name} (${hoster.country.de}), in deren Rechenzentren in ${hoster.dataCentres.de}; der Server ist gemietet und wird vom Betreiber verwaltet.`
+            ], [
+                `Datenbank: ${neon.name} (ein Unternehmen von ${neon.owner}, ${neon.country.de}; ${TRANSFER[neon.transfer]}), gespeichert in der Region ${neon.region} von ${neon.cloud} in ${neon.place.de}; ein Zugriff aus dem Land des Anbieters ist möglich.`
+            ], [
+                `E-Mail: ${FLEET.mail.name} (${FLEET.mail.country.de}) versendet unsere E-Mails und führt unser Postfach.`
+            ], ...recipients.map((recipient) => [
+                `${recipient.name} (${recipient.place}; ${TRANSFER[recipient.transfer]}): ${recipient.purpose}.`
+            ])),
+            paragraph(`Daten können also in den oben genannten Ländern bearbeitet werden und, bei ${cloudflare.name}, im Land des Rechenzentrums, das Ihnen antwortet. Jeder Empfänger ausserhalb der Schweiz und der EU steht oben mit der Garantie, die ihn deckt.`),
+            heading(HOW_LONG),
+            list([
+                `Ihr Shop und alles, was ${f.name} für ihn hält, bleiben, solange ${f.name} installiert ist. Entfernen Sie ${f.name}, werden die Tokens Ihres Shops sofort gelöscht; ${SHOPIFY.redactHours} Stunden später verlangt Shopify von uns, die Daten Ihres Shops zu löschen (shop/redact), und dann werden sie sofort gelöscht.`
+            ], [
+                `Was Shopify ${f.name} über Ihren Shop als Webhook schickt, bleibt, bis ${f.name} es angewendet hat, was bis zu einem Tag dauern kann, wenn es erneut versucht werden muss; danach bleiben nur seine ID, sein Thema und sein Zeitpunkt, eine Woche lang. Eines, das sich nicht anwenden lässt, bleibt, bis wir den Fehler behoben haben oder die Daten Ihres Shops gelöscht werden.`
+            ], [
+                `Daten eines Kunden, die ${f.name} hält, werden gelöscht, wenn Shopify seine Anfrage weitergibt, sie zu löschen (customers/redact).`
+            ], ...data.map((item) => [strong(item.name), `: ${item.kept}.`]), [
+                `Unser Datenbankanbieter führt höchstens ${neon.historyDays} Tage lang eine Historie, um die Datenbank auf einen früheren Zeitpunkt zurückzusetzen, und unsere verschlüsselten Sicherungen davon werden nach rund ${cloudflare.backups.days} Tagen gelöscht; gelöschte Daten verschwinden innert dieser Zeit aus beiden.`
+            ], [
+                `Das Anwendungsprotokoll rotiert nach Grösse, in ${FLEET.appLog.files} Dateien zu ${FLEET.appLog.megabytes} MB, und wird überschrieben, sobald neue Einträge kommen; ${NEW_VERSION[FLEET.appLog.newVersion]}. Das Fehlerprotokoll des Webservers rotiert ebenfalls nach Grösse, in ${webServer.errorLog.files} Dateien zu ${webServer.errorLog.megabytes} MB, und wird überschrieben, sobald neue Einträge kommen; ${NEW_VERSION[webServer.errorLog.newVersion]}. Das Protokoll des Mail-Relays bleibt höchstens ${FLEET.relayLogDays} Tage.`
+            ], [
+                'Die Zähler je Shop gelten höchstens eine Stunde, liegen nur im Arbeitsspeicher und sind spätestens beim Neustart der Anwendung vergessen.'
+            ], [
+                'E-Mails an uns: so lange, wie der Austausch es braucht, und bei Kunden so lange, wie Vertrag und Buchführungsrecht es verlangen.'
+            ]),
+            heading('Anfragen Ihrer Kunden'),
+            paragraph(`Kunden Ihres Shops wenden sich mit Anfragen zu ihren Daten an Sie als Verantwortlichen. Fragt ein Kunde nach seinen Daten, gibt Shopify die Anfrage an ${f.name} weiter (customers/data_request), und wir schicken Ihnen per E-Mail an die Adresse Ihres Shops, was ${f.name} über diesen Kunden hält, für Ihre Antwort. Gibt Shopify die Anfrage eines Kunden weiter, seine Daten zu löschen (customers/redact), führen wir sie aus, wie es «${HOW_LONG}» beschreibt.`),
+            heading('Ihre Rechte'),
+            paragraph('Sie können Auskunft verlangen, was wir über Sie bearbeiten, und diese Daten in einem gängigen elektronischen Format erhalten, sie berichtigen oder löschen lassen und ihre Bearbeitung einschränken lassen. Einer Bearbeitung, die auf unserem berechtigten Interesse beruht, können Sie jederzeit widersprechen. Schreiben Sie dafür an ', mail(FLEET.mailbox), '. Wir antworten innert 30 Tagen. Sie können sich beim Eidgenössischen Datenschutz- und Öffentlichkeitsbeauftragten (EDÖB) beschweren oder, in der EU, bei der Datenschutzbehörde Ihres Landes.'),
+            heading(ON_BEHALF),
+            paragraph(`Für die Personendaten, die ${f.name} für Sie bearbeitet, etwa die Ihrer Kunden, sind Sie verantwortlich und wir Ihr Auftragsbearbeiter (Art. 9 DSG, Art. 28 DSGVO). Wir bearbeiten diese Daten nur, um Ihnen ${f.name} zu erbringen. Wir:`),
+            lettered([
+                `bearbeiten sie nur nach Ihren dokumentierten Weisungen, das sind die Installation von ${f.name} in Ihrem Shop, Ihre Einstellungen darin und diese Erklärung, und sagen es Ihnen, wenn wir eine Weisung für datenschutzwidrig halten;`
+            ], ['verpflichten alle, die Zugang zu ihnen haben, zur Vertraulichkeit;'], [
+                'schützen sie mit angemessenen technischen und organisatorischen Massnahmen, darunter verschlüsselte Verbindungen, verschlüsselte Tokens und Sicherungen, einen Zugang, der auf den Betreiber beschränkt ist, und Testdaten, die von den Produktionsdaten getrennt bleiben;'
+            ], [
+                `setzen als Unterauftragsbearbeiter nur die oben genannten ein (${processors.join('; ')}), denen Sie mit der Installation von ${f.name} zustimmen, und verpflichten sie auf gleichwertige Datenschutzpflichten; einen neuen kündigen wir 30 Tage im Voraus per E-Mail an die Adresse Ihres Shops an, und Sie können widersprechen, indem Sie ${f.name} vor seinem Einsatz entfernen;`
+            ], [
+                'helfen Ihnen, soweit wir können, Anfragen betroffener Personen zu beantworten und Ihre Pflichten zu Datensicherheit, Meldung von Verletzungen und Folgenabschätzungen zu erfüllen;'
+            ], [
+                'melden Ihnen ohne unangemessene Verzögerung eine Verletzung der Datensicherheit, die diese Daten betrifft;'
+            ], [
+                `löschen sie, nachdem Sie ${f.name} entfernt haben, wie es «${HOW_LONG}» beschreibt, ausser das Gesetz verlangt, sie aufzubewahren; Kopien in der Historie der Datenbank und in unseren Sicherungen enden, wie es dort beschrieben ist;`
+            ], [
+                'geben Ihnen die Informationen, die Sie brauchen, um die Einhaltung dieser Pflichten nachzuweisen, und lassen Prüfungen durch Sie oder eine zur Vertraulichkeit verpflichtete prüfende Person zu, mit angemessener Vorankündigung und auf Ihre Kosten.'
+            ]),
+            paragraph('Übermittlungen in die oben genannten Länder erfolgen mit den dort genannten Garantien.'),
+            heading('Änderungen'),
+            paragraph('Es gilt die hier veröffentlichte Fassung. Über wichtige Änderungen informieren wir die Shops per E-Mail.')
+        ]
+    };
+}

package/dist/shopify/legal/en.d.ts

@@ -0,0 +1,3 @@
+import type { LegalData } from '../../ui/data.js';
+import type { ShopifyLegalFacts } from './index.js';
+export declare function en(f: ShopifyLegalFacts): LegalData;

package/dist/shopify/legal/en.js

@@ -0,0 +1,121 @@
+import { heading, lettered, link, list, longDate, mail, note, paragraph, strong } from '../../server/legal/document.js';
+import { FLEET } from '../../server/legal/fleet.js';
+import { APP_PROCESSORS, SHOPIFY } from './shopify.js';
+const { cloudflare, hoster, neon, webServer } = FLEET;
+const CONTRACT = 'performance of the contract, Art. 6(1)(b) GDPR';
+const TRANSFER = {
+    adequate: 'a country with adequate protection',
+    dpf: 'certified under the Data Privacy Framework',
+    scc: 'under the EU standard contractual clauses, as recognised by the FDPIC'
+};
+const BROWSER = {
+    networkErrorLogging: `${cloudflare.name} also has your browser store an instruction to report failed connections (Network Error Logging). Clearing cookies and site data in your browser removes this instruction too.`
+};
+const EDGE = {
+    worldwideUnderScc: 'in the data centre nearest to you, which can be outside Switzerland and the EU; there the standard contractual clauses of its data processing addendum apply'
+};
+const ACCESS_LOG = {
+    none: 'Our web server keeps no access log'
+};
+const ERROR_LOG = {
+    requestWithoutAddress: 'only a request it cannot pass on to the application it writes to its error log, without your IP address and without parameters or headers'
+};
+const NEW_VERSION = {
+    removed: 'it is also removed whenever a new version starts',
+    stays: 'it stays when a new version starts'
+};
+/** The sections the text points to. */
+const ON_BEHALF = 'Processing on your behalf';
+const HOW_LONG = 'How long';
+const who = (f) => `${f.operator.name}, ${f.operator.address}`;
+export function en(f) {
+    const { data, recipients } = f.privacy;
+    const processors = [
+        ...APP_PROCESSORS,
+        ...recipients
+            .filter((recipient) => recipient.role === 'processor')
+            .map((recipient) => recipient.name)
+    ];
+    return {
+        title: 'Privacy policy',
+        blocks: [
+            note(`Version of ${longDate(f.version, 'en')}.`),
+            paragraph(`This policy explains which personal data ${f.name} processes, why, where and for how long. It follows the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU General Data Protection Regulation (GDPR).`),
+            paragraph(`${f.name}, at ${f.origin}, is an app for Shopify stores. ${f.privacy.service} ${f.name} is offered only to businesses, public bodies and the self-employed for their professional activity, not to consumers.`),
+            paragraph(`${f.name} is operated by ${who(f)} (“we”), reachable at `, mail(FLEET.mailbox), `. For the data about your store as our customer, we are the controller. For the personal data ${f.name} processes for you, such as those of your customers, you are the controller and we process them on your behalf (see “${ON_BEHALF}”).`),
+            heading('What we process, why, and on what basis'),
+            list([
+                strong('Your store'),
+                `: its permanent myshopify.com domain, the ids of your store and of ${f.name} at Shopify, the email address of your store at Shopify (that of its owner, to which we send the requests for data of your customers that Shopify passes on to us), the access scopes you granted ${f.name}, whether it is a development store, when ${f.name} was installed in it and when it was removed, the offline access token and refresh token Shopify gives ${f.name} (stored encrypted), and the plan of ${f.name} for your store as Shopify’s Partner API reports it, with the end of its trial — to run ${f.name} for your store and to know its plan (${CONTRACT}).`
+            ], [
+                strong('Billing'),
+                `: Shopify bills you for ${f.name} and processes your payment details; from Shopify we receive only the plan of your store and the state of its subscription (${CONTRACT}).`
+            ], [
+                strong('Security and operations'),
+                `: our application logs each request (method, path without parameters, status, duration) and events of the service with the domain of your store, without IP addresses, email addresses, tokens or keys. ${ACCESS_LOG[webServer.accessLog]}; ${ERROR_LOG[webServer.errorLog.content]}. Our mail relay logs the recipient address and the delivery status of each email we send and keeps them for at most ${FLEET.relayLogDays} days. Where we limit requests, we count them per store in the memory of the application, never on disk; a count applies for at most one hour and is forgotten at the latest when the application restarts (legitimate interest in a secure and working service, Art. 6(1)(f) GDPR).`
+            ], [
+                strong('Emails to us'),
+                ': when you write to us, we keep your message and address to answer you and to keep a record of the exchange (legitimate interest; for customers, performance of the contract).'
+            ], ...data.map((item) => [
+                strong(item.name),
+                `: ${item.what}, from ${item.source} — ${item.purpose} (on your behalf).`
+            ])),
+            paragraph(strong('Cookies'), `: ${f.name} itself sets no cookie and stores nothing in your browser. It runs inside the Shopify admin, which loads it, and its pages load Shopify’s App Bridge and Polaris from Shopify’s servers (cdn.shopify.com), as Shopify requires of apps in its admin. ${BROWSER[cloudflare.browser]} We use no advertising or analytics trackers, sell no data, and make no decisions about you by automated means.`),
+            heading('Who receives data, and where'),
+            list([
+                `Shopify, where your store is and which processes its data under your own agreement with Shopify: ${f.name} reads the data of your store there and writes back there what you have it do; Shopify’s Partner API tells us the plan of your store, and Shopify bills you for ${f.name}. For what Shopify processes itself, and where, see `,
+                link(SHOPIFY.privacy, `https://${SHOPIFY.privacy}`),
+                '.'
+            ], [
+                `${cloudflare.name} (${cloudflare.country.en}; ${TRANSFER[cloudflare.transfer]}) runs in front of ${f.name}: it terminates the encrypted connection, passes requests on and filters attacks. It therefore sees every request, including your IP address, ${EDGE[cloudflare.edge]}. It also stores the encrypted backups of our database (Cloudflare R2, ${cloudflare.backups.where.en}), which it cannot read.`
+            ], [
+                `Application server: ${hoster.name} (${hoster.country.en}), in its data centres in ${hoster.dataCentres.en}; the server is rented and administered by the operator.`
+            ], [
+                `Database: ${neon.name} (a ${neon.owner} company, ${neon.country.en}; ${TRANSFER[neon.transfer]}), stored in ${neon.cloud} region ${neon.region}, ${neon.place.en}; access from the provider’s country is possible.`
+            ], [
+                `Email: ${FLEET.mail.name} (${FLEET.mail.country.en}) sends our emails and keeps our mailbox.`
+            ], ...recipients.map((recipient) => [
+                `${recipient.name} (${recipient.place}; ${TRANSFER[recipient.transfer]}): ${recipient.purpose}.`
+            ])),
+            paragraph(`Data may therefore be processed in the countries named above and, for ${cloudflare.name}, in the country of the data centre that answers you. Each recipient outside Switzerland and the EU is named above with the safeguard that covers it.`),
+            heading(HOW_LONG),
+            list([
+                `Your store and everything ${f.name} keeps for it stay while ${f.name} is installed. When you remove ${f.name}, the tokens of your store are deleted at once; ${SHOPIFY.redactHours} hours later Shopify asks us to delete the data of your store (shop/redact), and then they are deleted at once.`
+            ], [
+                `What Shopify sends ${f.name} about your store as a webhook is kept until ${f.name} has applied it, which can take up to a day when it must be tried again; then only its id, its topic and its time stay, for a week. One that cannot be applied stays until we have solved the failure, or until the data of your store are deleted.`
+            ], [
+                `Data of a customer that ${f.name} keeps are deleted when Shopify passes on the customer’s request to delete them (customers/redact).`
+            ], ...data.map((item) => [strong(item.name), `: ${item.kept}.`]), [
+                `Our database provider keeps a history for restoring the database to an earlier point in time for at most ${neon.historyDays} days, and our encrypted backups of it are deleted after about ${cloudflare.backups.days} days; deleted data leave both within that time.`
+            ], [
+                `The application log rotates by size, in ${FLEET.appLog.files} files of ${FLEET.appLog.megabytes} MB, and is overwritten as new entries come in; ${NEW_VERSION[FLEET.appLog.newVersion]}. The error log of the web server rotates by size as well, in ${webServer.errorLog.files} files of ${webServer.errorLog.megabytes} MB, and is overwritten as new entries come in; ${NEW_VERSION[webServer.errorLog.newVersion]}. The mail relay log is kept for at most ${FLEET.relayLogDays} days.`
+            ], [
+                'The counts per store apply for at most one hour, are kept in memory only and are forgotten at the latest when the application restarts.'
+            ], [
+                'Emails to us: as long as the exchange needs it and, for customers, as long as the contract and accounting law require.'
+            ]),
+            heading('Requests of your customers'),
+            paragraph(`Customers of your store turn to you, as the controller, with requests about their data. When a customer asks for their data, Shopify passes the request on to ${f.name} (customers/data_request), and we send you by email, to the address of your store, what ${f.name} keeps about that customer, for your answer. When Shopify passes on a customer’s request to delete their data (customers/redact), we carry it out as “${HOW_LONG}” describes.`),
+            heading('Your rights'),
+            paragraph('You may ask what we hold about you and receive it in a common electronic format, have it corrected or deleted, and have its processing restricted. You may object at any time to processing based on our legitimate interest. For this, write to ', mail(FLEET.mailbox), '. We answer within 30 days. You may complain to the Federal Data Protection and Information Commissioner (FDPIC) or, in the EU, to the data protection authority of your country.'),
+            heading(ON_BEHALF),
+            paragraph(`For the personal data ${f.name} processes for you, such as those of your customers, you are the controller and we are your processor (Art. 9 FADP, Art. 28 GDPR). We process these data only to provide ${f.name} to you. We:`),
+            lettered([
+                `process them only on your documented instructions, which are installing ${f.name} in your store, your settings in it and this policy, and tell you if we think an instruction breaks data protection law;`
+            ], ['bind everyone who has access to them to confidentiality;'], [
+                'protect them with appropriate technical and organisational measures, among them encrypted connections, encrypted tokens and backups, access limited to the operator, and test data kept apart from production data;'
+            ], [
+                `use as sub-processors only those named above (${processors.join('; ')}), which you approve by installing ${f.name}, and bind them to data protection duties equivalent to these; we announce a new one 30 days in advance by email to the address of your store, and you may object by removing ${f.name} before it starts;`
+            ], [
+                'help you, as far as we can, to answer requests of data subjects and to meet your duties on security, breach notification and impact assessments;'
+            ], ['tell you without undue delay of a breach of security that concerns these data;'], [
+                `delete them after you remove ${f.name}, as “${HOW_LONG}” describes, unless the law requires us to keep them; copies in the history of the database and in our backups end as described there;`
+            ], [
+                'give you the information you need to show that these duties are met, and allow audits by you or an auditor bound to confidentiality, with reasonable notice and at your cost.'
+            ]),
+            paragraph('Transfers to the countries named above are made under the safeguards named there.'),
+            heading('Changes'),
+            paragraph('The version published here applies. We tell stores about important changes by email.')
+        ]
+    };
+}

package/dist/shopify/legal/index.d.ts

@@ -0,0 +1,19 @@
+import type { Language } from '../../product.js';
+import type { LegalData } from '../../ui/data.js';
+import type { ShopifyPrivacy } from '../app.js';
+export interface ShopifyLegalFacts {
+    language: Language;
+    name: string;
+    /** Where the app is reached, its PUBLIC_ORIGIN. */
+    origin: string;
+    operator: {
+        name: string;
+        address: string;
+    };
+    privacy: ShopifyPrivacy;
+    /** The day of the text, YYYY-MM-DD: the later of SHOPIFY_PRIVACY_DATE and the app's privacyDate. */
+    version: string;
+}
+/** The day the baukasten's part of the text last changed; a change of the texts raises it. */
+export declare const SHOPIFY_PRIVACY_DATE = "2026-10-09";
+export declare function shopifyPrivacy(facts: ShopifyLegalFacts): LegalData;

package/dist/shopify/legal/index.js

@@ -0,0 +1,8 @@
+import { de } from './de.js';
+import { en } from './en.js';
+/** The day the baukasten's part of the text last changed; a change of the texts raises it. */
+export const SHOPIFY_PRIVACY_DATE = '2026-10-09';
+const TEXTS = { en, de };
+export function shopifyPrivacy(facts) {
+    return TEXTS[facts.language](facts);
+}

package/dist/shopify/legal/shopify.d.ts

@@ -0,0 +1,16 @@
+export declare const SHOPIFY: {
+    /**
+     * Where Shopify says what it processes, under the agreement of each merchant with Shopify and by
+     * which of its companies, depending on where the store is: Shopify is the platform of the merchant,
+     * not a recipient of the operator.
+     */
+    readonly privacy: "shopify.com/legal/privacy";
+    /** Shopify sends shop/redact this long after a store removed the app. */
+    readonly redactHours: 48;
+};
+/**
+ * The providers of the fleet that process data for an app, which the merchant approves as
+ * sub-processors: not Stripe, since Shopify bills the app. Should one stop being a processor of the
+ * operator, this does not compile until the text follows.
+ */
+export declare const APP_PROCESSORS: ("Cloudflare, Inc." | "Hetzner Online GmbH" | "Neon, LLC" | "Infomaniak Network SA")[];

package/dist/shopify/legal/shopify.js

@@ -0,0 +1,21 @@
+// The facts about Shopify that the privacy text of every Shopify app states, besides those of the
+// fleet (server/legal/fleet.ts), and the only place of them. They come from Shopify: its privacy
+// policy (SHOPIFY.privacy) and its documentation of the privacy webhooks; a change there is a change
+// here.
+import { FLEET } from '../../server/legal/fleet.js';
+export const SHOPIFY = {
+    /**
+     * Where Shopify says what it processes, under the agreement of each merchant with Shopify and by
+     * which of its companies, depending on where the store is: Shopify is the platform of the merchant,
+     * not a recipient of the operator.
+     */
+    privacy: 'shopify.com/legal/privacy',
+    /** Shopify sends shop/redact this long after a store removed the app. */
+    redactHours: 48
+};
+/**
+ * The providers of the fleet that process data for an app, which the merchant approves as
+ * sub-processors: not Stripe, since Shopify bills the app. Should one stop being a processor of the
+ * operator, this does not compile until the text follows.
+ */
+export const APP_PROCESSORS = [FLEET.cloudflare, FLEET.hoster, FLEET.neon, FLEET.mail].map((provider) => provider.name);

package/dist/shopify/migrations.d.ts

@@ -0,0 +1,4 @@
+export declare const SHOPIFY_MIGRATIONS: readonly {
+    name: string;
+    sql: string;
+}[];

package/dist/shopify/migrations.js

@@ -0,0 +1,67 @@
+// The list of a Shopify app replaces the accounts and Stripe of a web app: a database belongs to an
+// app of one art, so the two lists never meet. Each is forward-only and never changes once released
+// (migrations.test.ts).
+import { BAUKASTEN_MIGRATIONS } from '../server/baukasten-migrations.js';
+const [productMigrations] = BAUKASTEN_MIGRATIONS;
+if (productMigrations === undefined)
+    throw new Error('the baukasten lists no migration');
+export const SHOPIFY_MIGRATIONS = [
+    productMigrations,
+    {
+        // The shops that installed the app: shop/redact deletes a shop with all of the app that refers
+        // to it. Tokens are sealed (shopify/seal.ts); the plan is what the Partner API said when it was
+        // last asked. The webhooks wait here until the run of the baukasten applies them, each once.
+        name: '002_shops.sql',
+        sql: `CREATE TABLE baukasten.shops (
+	domain text PRIMARY KEY CHECK (domain ~ '^[a-z0-9][a-z0-9-]*\\.myshopify\\.com$'),
+	shop_id text NOT NULL CHECK (shop_id LIKE 'gid://shopify/Shop/%'),
+	app_id text NOT NULL CHECK (app_id LIKE 'gid://shopify/App/%'),
+	-- The address of the shop, where requests about the data of its customers go.
+	email text NOT NULL,
+	-- A development store of a partner never pays and never counts.
+	development boolean NOT NULL,
+	-- The scopes the tokens were granted, as Shopify listed them.
+	scope text NOT NULL,
+	access_token text,
+	access_expires_at timestamptz,
+	refresh_token text,
+	refresh_expires_at timestamptz,
+	installed_at timestamptz NOT NULL DEFAULT now(),
+	uninstalled_at timestamptz,
+	-- When the token exchange last gave it tokens: an app/uninstalled triggered before belongs to an
+	-- installation before this one.
+	exchanged_at timestamptz NOT NULL,
+	-- The handles of the active subscription (empty without one), its trial, and when it was asked.
+	plan_handles text[] NOT NULL DEFAULT '{}',
+	plan_trial_ends_at timestamptz,
+	plan_checked_at timestamptz,
+	CHECK ((access_token IS NULL) = (access_expires_at IS NULL)),
+	CHECK ((refresh_token IS NULL) = (refresh_expires_at IS NULL)),
+	CHECK (uninstalled_at IS NULL OR (access_token IS NULL AND refresh_token IS NULL))
+);
+
+-- Every webhook Shopify sent, by the id it gives each one: its shop and payload until it is applied,
+-- which may hold personal data, then only that it was, for a while; a webhook that keeps failing
+-- gives up, loudly. shop/redact deletes all of its shop.
+CREATE TABLE baukasten.shopify_webhooks (
+	id text PRIMARY KEY,
+	topic text NOT NULL,
+	shop text,
+	payload jsonb,
+	-- When Shopify says the event happened (X-Shopify-Triggered-At), else when it came.
+	triggered_at timestamptz NOT NULL,
+	received_at timestamptz NOT NULL DEFAULT now(),
+	attempts integer NOT NULL DEFAULT 0 CHECK (attempts >= 0),
+	next_at timestamptz NOT NULL DEFAULT now(),
+	applied_at timestamptz,
+	failed_at timestamptz,
+	CHECK ((applied_at IS NULL) = (payload IS NOT NULL)),
+	CHECK ((applied_at IS NULL) = (shop IS NOT NULL)),
+	CHECK (applied_at IS NULL OR failed_at IS NULL)
+);
+CREATE INDEX shopify_webhooks_shop ON baukasten.shopify_webhooks (shop);
+CREATE INDEX shopify_webhooks_due ON baukasten.shopify_webhooks (next_at)
+	WHERE applied_at IS NULL AND failed_at IS NULL;
+`
+    }
+];

package/dist/shopify/pages.d.ts

@@ -0,0 +1,45 @@
+import type { Language } from '../product.js';
+import type { LegalData } from '../ui/data.js';
+import type { ShopifyTexts } from './texts.js';
+/** Text into HTML, in an element or a quoted attribute. */
+export declare function escapeHtml(text: string): string;
+/** frame-ancestors for the admin of `shop`, or for none outside it. */
+export declare function frameAncestors(shop: string | null): string;
+/**
+ * App Bridge alone: it fetches an ID token and opens `shopify-reload` of the address with it, as the
+ * bounce page of Shopify's own library does.
+ */
+export declare function bouncePage(options: {
+    clientId: string;
+    shop: string;
+    language: Language;
+}): Response;
+/**
+ * Leaves the frame of the admin for `url`, an address of Shopify such as the plan page: from inside
+ * the frame only App Bridge may open the top window.
+ */
+export declare function topPage(options: {
+    clientId: string;
+    shop: string;
+    url: string;
+    language: Language;
+    nonce: string;
+}): Response;
+/** An address of the app opened outside the admin: where it is, and its privacy text. */
+export declare function outsidePage(options: {
+    name: string;
+    language: Language;
+    texts: ShopifyTexts;
+}): Response;
+/** Shopify did not answer as it should, or the app is not linked yet: a 503 to try again. */
+export declare function unavailablePage(options: {
+    language: Language;
+    texts: ShopifyTexts;
+    shop: string | null;
+}): Response;
+/** The privacy text as a page of its own, public, for the listing in the App Store. */
+export declare function legalPage(options: {
+    name: string;
+    language: Language;
+    legal: LegalData;
+}): Response;

package/dist/shopify/pages.js

@@ -0,0 +1,146 @@
+import { APP_BRIDGE_URL, SHOPIFY_ADMIN, SHOPIFY_CDN, SHOPIFY_SCRIPTS } from './constants.js';
+/** Text into HTML, in an element or a quoted attribute. */
+export function escapeHtml(text) {
+    return text
+        .replaceAll('&', '&')
+        .replaceAll('<', '&lt;')
+        .replaceAll('>', '&gt;')
+        .replaceAll('"', '&quot;')
+        .replaceAll("'", '&#39;');
+}
+/** frame-ancestors for the admin of `shop`, or for none outside it. */
+export function frameAncestors(shop) {
+    return shop === null
+        ? "frame-ancestors 'none'"
+        : `frame-ancestors https://${shop} ${SHOPIFY_ADMIN}`;
+}
+const STYLE = `body{font:16px/1.5 system-ui,sans-serif;margin:0 auto;max-width:42rem;padding:2rem 1rem;color:#1a1a1a}h1{font-size:1.5rem}h2{font-size:1.15rem;margin-top:2rem}.muted{color:#5c5c5c}`;
+function document(options) {
+    // App Bridge may load more of the scripts of Shopify, as on the pages of the app.
+    const scripts = [
+        SHOPIFY_SCRIPTS,
+        ...(options.nonce === undefined ? [] : [`'nonce-${options.nonce}'`])
+    ].join(' ');
+    const policy = [
+        "default-src 'none'",
+        `script-src ${scripts}`,
+        `style-src 'unsafe-inline' ${SHOPIFY_CDN}`,
+        `img-src 'self' data: ${SHOPIFY_CDN}`,
+        `connect-src 'self' ${SHOPIFY_CDN}`,
+        "base-uri 'none'",
+        "form-action 'none'",
+        frameAncestors(options.shop)
+    ].join('; ');
+    const html = `<!doctype html>
+<html lang="${options.language}">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${escapeHtml(options.title)}</title>
+${options.head ?? ''}<style>${STYLE}</style>
+</head>
+<body>
+${options.body}
+</body>
+</html>
+`;
+    return new Response(html, {
+        status: options.status ?? 200,
+        headers: {
+            'content-type': 'text/html; charset=utf-8',
+            'cache-control': 'no-store',
+            'content-security-policy': policy
+        }
+    });
+}
+const appBridge = (clientId) => `<meta name="shopify-api-key" content="${escapeHtml(clientId)}">\n<script src="${APP_BRIDGE_URL}"></script>\n`;
+/**
+ * App Bridge alone: it fetches an ID token and opens `shopify-reload` of the address with it, as the
+ * bounce page of Shopify's own library does.
+ */
+export function bouncePage(options) {
+    return document({
+        language: options.language,
+        title: '',
+        head: appBridge(options.clientId),
+        body: '',
+        shop: options.shop
+    });
+}
+/**
+ * Leaves the frame of the admin for `url`, an address of Shopify such as the plan page: from inside
+ * the frame only App Bridge may open the top window.
+ */
+export function topPage(options) {
+    return document({
+        language: options.language,
+        title: '',
+        head: appBridge(options.clientId),
+        body: `<script nonce="${options.nonce}">window.open(${JSON.stringify(options.url).replaceAll('<', '\\u003c')}, '_top')</script>`,
+        nonce: options.nonce,
+        shop: options.shop
+    });
+}
+/** An address of the app opened outside the admin: where it is, and its privacy text. */
+export function outsidePage(options) {
+    const { name, texts } = options;
+    return document({
+        language: options.language,
+        title: texts.outside.title(name),
+        body: `<h1>${escapeHtml(texts.outside.title(name))}</h1>
+<p>${escapeHtml(texts.outside.text(name))}</p>
+<p><a href="/privacy">${escapeHtml(texts.outside.privacy)}</a></p>`,
+        shop: null
+    });
+}
+/** Shopify did not answer as it should, or the app is not linked yet: a 503 to try again. */
+export function unavailablePage(options) {
+    const { texts } = options;
+    return document({
+        language: options.language,
+        title: texts.unavailable.title,
+        body: `<h1>${escapeHtml(texts.unavailable.title)}</h1>\n<p>${escapeHtml(texts.unavailable.text)}</p>`,
+        shop: options.shop,
+        status: 503
+    });
+}
+function inline(parts) {
+    return parts
+        .map((part) => {
+        if (typeof part === 'string')
+            return escapeHtml(part);
+        switch (part.kind) {
+            case 'strong':
+                return `<strong>${escapeHtml(part.text)}</strong>`;
+            case 'code':
+                return `<code>${escapeHtml(part.text)}</code>`;
+            case 'link':
+                return `<a href="${escapeHtml(part.href)}">${escapeHtml(part.text)}</a>`;
+        }
+    })
+        .join('');
+}
+/** The privacy text as a page of its own, public, for the listing in the App Store. */
+export function legalPage(options) {
+    const { legal } = options;
+    const blocks = legal.blocks.map((block) => {
+        switch (block.kind) {
+            case 'heading':
+                return `<h2>${escapeHtml(block.text)}</h2>`;
+            case 'paragraph':
+                return `<p>${inline(block.parts)}</p>`;
+            case 'note':
+                return `<p class="muted">${inline(block.parts)}</p>`;
+            case 'list':
+                return `<ul>${block.items.map((item) => `<li>${inline(item)}</li>`).join('')}</ul>`;
+            case 'lettered':
+                return `<ol type="a">${block.items.map((item) => `<li>${inline(item)}</li>`).join('')}</ol>`;
+        }
+    });
+    return document({
+        language: options.language,
+        title: `${legal.title} – ${options.name}`,
+        body: `<h1>${escapeHtml(legal.title)}</h1>\n${blocks.join('\n')}`,
+        shop: null
+    });
+}