Privacy Policy

Last updated: September 12, 2026

ARCTERIS, the operator of PAREL Subscriptions, processes information about Shopify merchants and their customers only as needed to provide subscription services.

Information we process

We process store and session identifiers; subscription contract, customer, order, selling plan, product and variant identifiers; contract status, schedule, quantity, price and currency; billing attempt results; refunds; audit records; incident diagnostic counts, severity, timestamps, and billing-job execution status; selected cancellation reasons, optional comments, and cancellation, pause, skip, frequency-extension, product-change, or next-cycle coupon decision history; timestamps and states for impressions, actions, primary outcomes, and successful orders for cancellation-retention, next-cycle add-on, and subscription-gift experiences, linked with a hashed journey identifier; merchant-provided referral codes and related commission and payout records; and merchant-configured outbound webhook destinations, subscribed events, and delivery or retry results; merchant-created developer API key hashes, scopes, allowed IP addresses, last-used timestamps, rate-limit counters, and usage totals; next-cycle add-on products, quantities, prices, coupon codes, cancellation-retention coupons applied only to the next billing cycle, and their processing results; box products, quantities, categories, prices, selection deadlines, and expansion status confirmed for each billing cycle; qualifying subscription sales, refunds, manual adjustments, tier balances, tiers, and discount and customer-tag synchronization status for membership programs; subscription-gift billing cycles, acceptance deadlines, acceptance, delivery and payment status, delivery option and price, and resulting order identifiers; and minimized inbound webhook identifiers. We temporarily process an email address when sending a post-purchase message, gift-recipient notice, or merchant privacy-request notice. For a requested gift notice, the gift token is stored only as ciphertext under a dedicated key until delivery, cancellation, or expiration. The recipient, message body, and ciphertext are then erased from our outbox. Customer references and event bodies are also erased after Shopify Flow accepts a trigger. For an IP-restricted developer API key, we process the caller IP only while checking the allowlist and do not store it in our database or audit logs.

We do not collect or store card numbers, expiration dates, or security codes. When a delivery address is changed or a subscription gift is accepted, we process the recipient name, company, shipping address, postal code, and phone number only while asking Shopify to recalculate delivery options and update the contract or selected billing cycle. We do not store those fields in the application database, audit log, email, or outbound webhooks. We do not retain raw gift-link tokens at rest; the gift record retains only a lookup hash, with the temporary encrypted exception described above for a buyer-requested recipient notice. The experience-measurement ledger does not retain raw browser decision IDs, gift URLs, or raw gift tokens.

How we use information

We use information to operate selling plans and subscription contracts, process and recover recurring payments, prevent duplicate charges, offer pause or skip alternatives, analyze selected cancellation reasons, measure de-duplicated experience impressions, actions, primary outcomes, and successful orders for the same billing cycle, provide notifications and support, calculate app usage fees and refund adjustments, administer agency referral commissions and manual payout records, send minimized subscription and billing events to merchant-configured systems, verify box selections before billing and prevent unapproved out-of-stock substitutions, calculate membership tiers from net subscription spend, apply the earned tier discount to the following order, synchronize the current tier to a Shopify customer tag, apply a recipient-selected delivery address and shipping price to one gifted billing cycle, investigate incidents, and comply with applicable law and Shopify requirements.

Service providers

We may share the minimum information required with Shopify, hosting and database providers, and email delivery providers such as Resend. When a merchant configures an outbound webhook, we send minimum contract and billing identifiers and status to that merchant-selected destination. We do not include customer names, email addresses, shipping addresses, or phone numbers in outbound webhook bodies. We do not sell personal information or use it for behavioral advertising. Customer information is not sent to our foreign-exchange-rate provider.

Retention, deletion, and security

We retain information only as long as needed for service delivery, billing, audit, and legal obligations. When Shopify sends a valid customer or shop redaction request, we delete the relevant data or irreversibly pseudonymize references that must remain for billing integrity. We use encrypted transport, access controls, tenant isolation, secret separation, idempotent processing, and audit records to protect data.

Requests and contact

Customers should submit access, correction, or deletion requests to the Shopify store where they made their purchase. Merchants can contact us at k.yamane@arcteris.jp. We respond to requests received through Shopify's required privacy webhooks in accordance with Shopify's procedures.