RegionlyTerms of Service
Last updated: October 30, 2026
These terms apply between DH Soft (디에이치소프트), Republic of Korea ("we"), and the Shopify merchant that installs Regionly (the "App"). By installing or using the App you agree to these terms and to our Privacy Policy.
The service
- The App lets you restrict storefront access by country, set checkout rules (Pro) and flag orders for review (Pro).
- Storefront blocking runs in the visitor's browser and can be bypassed, for example with a VPN. Checkout rules run inside Shopify checkout. We do not guarantee that every unwanted visit or order is stopped.
- You are responsible for the rules you set and for making sure they comply with the laws that apply to your store.
- Paid plans are billed by Shopify. You can change or cancel your plan in the App at any time.
- We may update these terms. We will change the date above and, for material changes, notify you by email or in the App.
Limitation of liability
- The App is a tool that applies the rules you choose. It does not decide on its own who to block. Country, IP and network data come from third parties (Vercel, Shopify, cloud providers and the Tor Project) and can be wrong or out of date, so a rule can block a real customer or let an unwanted visitor through.
- Before you turn rules on, you can test them with Log only mode and check the Block log. You decide when to start blocking and can change or turn off any rule at any time.
- The App is provided "as is" and "as available". To the extent permitted by the law that applies to you, we are not liable for indirect or consequential losses, including lost sales, lost profits or lost customers caused by a visitor or order being blocked or allowed, or by the App being unavailable.
- To the extent permitted by that law, our total liability for any claim about the App is limited to the fees you paid for the App in the 12 months before the claim.
- Nothing in these terms limits liability that cannot be limited by law, for example for intent or gross negligence, or your rights as a consumer where consumer law applies.
Automated decisions and human review
- Every rule is set by the merchant. The App applies those rules automatically and makes no decisions of its own.
- Blocked visitors and customers see a message that tells them to contact the store, so they can ask the merchant for a human review. The merchant can change or turn off any rule at any time.
- The App never cancels or refunds orders. Flagged orders only get the tag
regionly:reviewand, if the merchant turned it on, a fulfillment hold, so the merchant reviews them by hand.
Data Processing Terms
These Data Processing Terms form part of the terms above and apply to personal data of your store visitors and customers that the App processes.
Roles and instructions
You (the merchant) are the controller. We are your processor and process personal data only to provide the App, following your instructions as set in the App's settings. We do not use the data for our own purposes, sell it or share it for advertising.
Data, purpose and retention
| Data | Purpose | Retention |
|---|---|---|
| Visitor IP address, country, user agent | Decide whether a storefront visit is allowed | Processed in memory, not stored |
| IP address of a visitor that sends many requests | Rate limiting | Up to 60 seconds |
| IP address of a visitor that claims to be a search or ad crawler | Verify the crawler so it is never blocked | Up to 24 hours |
| Block log: salted hash of the IP, country, user agent (200 characters), path, time | Show the merchant what was blocked | 7 days |
| New orders (Pro, when Flag risky orders is on): email, phone, shipping and billing country, client IP | Compare with the merchant's rules | Processed in memory, not stored |
| Flagged orders: order ID, order number, reason codes | List orders for the merchant to review | 7 days |
| Access log: time, shop, staff user ID or "system", action and record count (no personal data values) | Record who accessed personal-data views and processing | 90 days |
Sub-processors
- Shopify: platform, installation and billing (Canada / global)
- Vercel: hosting and IP geolocation (United States, global edge network)
- Neon: database (United States, East)
- Upstash: short-lived cache, rate limiting and a queue for new block log entries (United States)
We will update this list before adding or replacing a sub-processor.
Transfers out of the EEA, the UK and Switzerland rely on our sub-processors' data processing agreements, which include the EU Standard Contractual Clauses. These Data Processing Terms apply as part of these terms; no separate signature is needed. We have not appointed an EU representative.
Security
All connections use HTTPS/TLS. Personal data is kept in our database, which is encrypted at rest along with its backups; the cache holds only short-lived data (see the Privacy Policy). Visitor IPs are stored only as hashes (salted in the block log, HMAC in the cache). Production secrets are kept only in the hosting provider's encrypted environment settings. Access to production systems is limited to one administrator using unique passwords and two-step verification. Details are in the Security section of our Privacy Policy.
Security incidents
If we become aware of a security incident affecting your store's personal data, we will notify you and Shopify without undue delay and no later than 72 hours after becoming aware of it, with what we know about the impact and the steps we are taking.
Deletion
- Uninstalling the App deletes all data for your shop (settings, block log, flagged orders, access tokens).
- We handle Shopify's
customers/data_request,customers/redactandshop/redactwebhooks as described in the Privacy Policy. - Access log entries contain no customer data and are deleted after 90 days.
Contact
DH Soft (디에이치소프트), 40, Sinbanpo-ro 45-gil, Seocho-gu, Seoul, Republic of Korea
regionly.support@gmail.com