Comuna Correcta Privacy Policy

Last updated: October 16, 2026

This is an English translation provided for convenience. If it differs from the Spanish version, the Spanish version prevails.

1. Who we are

Comuna Correcta is an app for Shopify stores that validates shipping addresses in Chile. It is developed and operated by Joel Suazo Integrasoft Consulting EIRL, Chilean tax ID (RUT) 77.212.314-0, with registered address at Hernán Vallejos 1694, Cerro Navia, Santiago, Chile ("ISC", "we"). For any privacy question, write to contacto@is-c.cl.

2. Who this applies to

Merchants: the stores that install the app and the people who manage them.
Buyers: the people who buy from those stores. Their data belongs to the store: the store is the controller and we process the data on its behalf, under the data processing agreement (DPA) the store accepts when installing.

3. What data we process and why

Data	Whose	Purpose	Where it is processed	Retention
Store domain and Shopify access token	Merchant	Run inside the admin and call the Shopify API	Our server and database	Until the app is uninstalled
App settings (comuna field, active rules), the store's Shopify ID, whether it has an active plan and its billing cycle, and whether validation is paused for lack of a plan	Merchant	Apply the rules the store chooses, report usage to Shopify and apply the no-plan limit	Our database and the checkout rule in Shopify	Up to 48 hours after uninstalling
Shipping address: street and number, address line 2, city or comuna, region, postal code and country	Buyer	Detect comunas that do not exist, belong to another region, or addresses without a street number	At checkout, inside Shopify. After purchase, on our server, in memory only	Not stored
Order ID and number, reason for review and status	Buyer (order)	Show the merchant which orders were reviewed and which ones deserve a look	Our database	30 days from purchase
ID of each order shipped to Chile (the ID only) and whether it was already reported to Shopify for billing	Buyer (order)	Avoid counting or billing the same order twice	Our database	30 days from purchase
Address access log (store, order ID, operation, date)	Buyer (order)	Security and auditing	Our database	90 days
Number of orders validated per month	Merchant	Billing according to the plan and app figures	Our database	While the app is installed

We do not read or store the buyer's name, email, phone number or billing address. The app's technical logs record the order ID, never the address.

4. What we do not do

We do not sell or share personal data for commercial purposes.
We do not use the data for advertising, profiling, behavioral analytics or model training.
We do not make final decisions about the buyer: the app only asks them to fix an address with an evident error, and they can always complete the purchase by fixing it or writing "S/N" if their street has no number. The store can turn off each rule or the whole validation.
We do not use tracking or analytics cookies. The admin session uses Shopify session tokens.

5. Who we share data with

Only with the providers we need to run the app, which process the data on our behalf under confidentiality and security obligations:

Provider	Service	Data	Location
Shopify	Platform running the store, the checkout and the validation	All of the above; Shopify already holds them as the store's platform	As stated in Shopify's privacy policy
Fly.io	App server	Data processed by the server, in transit and in memory	United States (Virginia)
Neon	Database	Database contents (no addresses)	United States (Virginia)
Cloudflare	Encrypted backups (R2)	Encrypted copy of the database (no addresses)	United States

We may disclose data to an authority when the law requires it. If that involves buyer data, we notify the store unless the law forbids it.

6. International transfers

Data is hosted outside Chile, in the countries listed above. For these transfers we use the safeguards required by Chilean personal data protection law, such as contractual clauses with each provider. Buyer addresses are not stored in any country: they only pass through our server's memory.

7. How long we keep data

Retention periods are in the table in section 3. In addition:

When the app is uninstalled, we delete sessions and the access token immediately. All other store data is deleted when Shopify notifies us that the store uninstalled the app (48 hours later).
Backups are deleted automatically after 7 days.

8. How we protect data

All traffic is encrypted (TLS). The database is encrypted at rest and backups are encrypted before upload. Access to production is limited to ISC's responsible engineer, with named accounts (one for daily use and one for emergencies), unique passwords and two-factor authentication. Shopify requests are verified with a signature (HMAC). We have an incident response plan that includes notifying affected stores, Shopify and the authority when required.

9. People's rights

Buyers: since the store is the controller of your data, to access, rectify, delete, object to or port your data, write to the store where you made the purchase. We handle the requests Shopify forwards to us on behalf of the store within the legal deadlines: we provide or delete the records of your orders. You can also write to contacto@is-c.cl and we will forward your request to the store.
Merchants: you can ask us for access to, correction or deletion of your store's data at contacto@is-c.cl. Uninstalling the app deletes all of your store's data as described in section 7.

If you believe we did not handle your request properly, you can file a complaint with the Chilean data protection authority.

10. Changes to this policy

If we change what data we process or why (for example, if the app adds post-purchase actions, such as asking the buyer to correct their address), we will update this page and notify stores from the app before the change applies.

11. Contact

Joel Suazo Integrasoft Consulting EIRL · contacto@is-c.cl · Hernán Vallejos 1694, Cerro Navia, Santiago, Chile