GDPR Requirements about laravel-shopify HOT 36 CLOSED

thanks @ohmybrew sorry to re-open the issue but I just noticed the additional requirement since I'm trying to get my app compliant before the 25th and I was double checking everything.

@tobiasdalhof It looks like you don't need to do anything for customer related data if your app doesn't access customer data. My app doesn't store any customer data either but I just created the hooks, just in case. Shopify has a tendency to change these types of requirements so I figured I would just do all of them now just in case.

from laravel-shopify.

I dont think its off-topic. It seems it requires a response of 200 for the redact store & customer, but the new data_request it does not say anything.

In cases for customer, I would assume a 200 is fine, maybe with a message on the body (Shopify may store it?). I mean if you don't store data -- what do you respond with? Good Q..

from laravel-shopify.

Shopify has a tendency to change these types of requirements

Indeed.

I will replicate a lot of info in Shopify's GDPR into a revised wiki entry and link it for the install wiki entry so people are aware of the requirements.

from laravel-shopify.

+1

btw: https://help.shopify.com/api/app-store/listing-in-the-app-store/data-and-user-privacy/privacy-policy-template

from laravel-shopify.

shop/redact would be applicable to the package as a default in my mind. However, how would this function with soft deletes? If someone deletes the app, as per discussions in issue #25 for charges and soft deleting shops.

"48 hours after a shop uninstalls your app, we will attempt to send you a shop/redact webhook [...] so that you can redact their data from your database"

Edit: @ncpope It seems with GDPR the data needs to be deleted permanently, thus killing the idea of soft deletes? However, Shopify docs as mentioned in issue #25 state that you should track the trail start and end days for app reinstalls... its a bit conflicting...

from laravel-shopify.

Yeah the webhook is REQUIRED by Shopify. This is a huge issue in my mind?

This means we can not soft delete any shop data, because after 48 hours, it'll be required to be deleted anyways. Its only useful for people who uninstall/install within that 48 hours...

from laravel-shopify.

On second thought, I suppose we should just leave it as it is. The laravel-shopify package doesn't seem to store any personally identifiable pieces of store data. I think the developer should handle this on their own. I don't see what this package should do to cater to this except maybe mentioning it in the installation process. Or, possibly at the very most, creating a simple placeholder job for the dev to fill out on their own.

from laravel-shopify.

from laravel-shopify.

Closing for now as it doesn't seem that any changes are required.

from laravel-shopify.

Thanks @ncpope, made a wiki entry for this instead here.

from laravel-shopify.

As per your wiki entry, we need to set the entry in the config/shopify-app.php file.
However, if we try to install the webhooks, we get this error from shopify :

Client error: `POST https://my-shop.myshopify.com/admin/webhooks.json`
resulted in a `422 Unprocessable Entity` response:
{"errors":{"topic":["Invalid topic specified. Topics allowed: app\/uninstalled,
collections\/create, collections\/delete (truncated...)

And as per the API reference https://help.shopify.com/api/reference/events/webhook you can only set shop/update hook.

shop/redact and costumer/redact should be set in the App info tab in your app on the Shopify Partners portal. (Source).

from laravel-shopify.

from laravel-shopify.

Yes, we still need to be able to respond to the redact webhooks but we don't need to subscribe to them. The way you have the webhook controller designed, we can follow the same naming convention as the other webhooks including creating the corresponding jobs but don't need to enter them in the webhooks config.

from laravel-shopify.

from laravel-shopify.

@brianakidd Thank you; adjusted.

from laravel-shopify.

I have added costumer/redact webhook in our App info tab.Please check the shared screenshot link:https://www.screencast.com/t/c4wtuUUGW6nc
But i am unable to get the webhook response after that i have tried to create this webhook through postman and get this error
https://www.screencast.com/t/iDz7yRpDB
https://www.screencast.com/t/iDz7yRpDB
please help me

from laravel-shopify.

@SignatureForum I don't believe this is an issue with the package. Where does the URL go to that you have specified? The error you're getting is from Shopify iteself.

from laravel-shopify.

I have added costumer/redact webhook in our App info tab.Please check the shared screenshot link:https://www.screencast.com/t/c4wtuUUGW6nc
Here is the rout url
https://user-images.githubusercontent.com/3440763/43856894-351449fc-9b63-11e8-831e-f0372df7105c.png

https://user-images.githubusercontent.com/3440763/43856741-d594202e-9b62-11e8-93ae-96955207a9ca.png

But i am unable to get the webhook response after that i have tried to create this webhook through postman and get this error
https://www.screencast.com/t/iDz7yRpDB
https://www.screencast.com/t/iDz7yRpDB
please help me

from laravel-shopify.

@SignatureForum I am unsure. This is not an error from the package but Shopify itself. What URL are you running in postman

from laravel-shopify.

@SignatureForum You don't have to register this webhook, it is registered by default. In your App -> App Setup, set the Mandatory Webhooks endpoints.

These are triggered by Shopify. See the documentation:

https://help.shopify.com/en/api/guides/gdpr-resources

from laravel-shopify.

I'm still getting the 422 error mentioned by @mabrodeur . How do I fix it?

I followed the wiki, adding both GDPR hooks and added them in the app settings console and my shopify-app config file.

from laravel-shopify.

from laravel-shopify.

from laravel-shopify.

Sorry to expand on the above, you enter the url into your app settings admin, not the Shopify admin.

The thing is, the hooks are required by Shopify, it states it right there in the app settings page

Required webhooks to manage requests to erase customer personal information.

from laravel-shopify.

from laravel-shopify.

I removed them in the App settings (oddly, whilst required, you can save the form without them) and I'm still getting the following error when trying to install the app:

Client error: POST https://my-shop.myshopify.com/admin/webhooks.json resulted in a 422 Unprocessable Entity response: {"errors":{"topic":["Invalid topic specified. Topics allowed: app/uninstalled, collections/create, collections/delete (truncated...)

Oddly, if i go back into the shop, the app has been installed, but has not gone through the billing process.

from laravel-shopify.

from laravel-shopify.

Yes, I followed the instructions spat out by the console:

php artisan shopify-app:make:webhook CustomersRedactJob customers/redact
Job created successfully.
Don't forget to register the webhook in config/shopify-app.php. Example:

    'webhooks' => [
        [
            'topic' => 'customers/redact',
            'address' => 'https://your-domain.com/webhook/customers-redact'
        ]
    ]

I think this is the issue. You will need to remove these instructions.

from laravel-shopify.

from laravel-shopify.

Just thought I should mention that we might want to add to the wiki that there is an additional GDPR requirement.

When a shops customer requests their data from a shop, there will be a request sent to the app. It's required that the app to send any related data it has directly to the customer.

More info here: https://help.shopify.com/en/api/guides/gdpr-resources
See: customers/data_request

from laravel-shopify.

Ah thats a new one! @ncpope Thanks, I'll reformat the entire wiki entry to help better guide this.

from laravel-shopify.

Hey guys this might be a little off topic but what should I do when my app does not read or store any customer data? The related text fields in the app settings are required.

Should I provide "dummy" webhooks that just return status code 200?

from laravel-shopify.

Wiki entry reformatted to show all types of GDPR webhooks, explanations, payloads, expected responses, activation, and more.

from laravel-shopify.

Hi Sir/Madam,
I try to install my first shopify app but i seem error with webhooks configuration.
Error: https://snag.gy/a5fQcq.jpg
shopify-app.php: https://snag.gy/rZlx06.jpg

Please help and thanks

from laravel-shopify.

@sovoeun have you add write_orders scope in SHOPIFY_API_SCOPES ?

from laravel-shopify.

Hi @hakimihamdan88 Now i got it.
but i have another question possible or not if we want to make automatic to add some field to customer form or orders form?
Thanks.

from laravel-shopify.