Privacy policy of the Todis Age Verification app
Version of 14 November 2026
1. Who processes the data
The "Todis Age Verification" app (the "app", also called shop-verify) is published by KOHEX, which also publishes Todis (todis.eu), the service that verifies age. Todis is a KOHEX service, not a separate company.
KOHEX, a société à responsabilité limitée (SARL, French limited liability company) with share capital of €1,000, registered with the Besançon Trade and Companies Register (RCS) under number 918 862 830, whose registered office is located at 20 allée des Sorentines, 25870 Châtillon-le-Duc, France. Intra-community VAT number: FR16918862830. Represented by Raphaël Citeau, gérant (manager).
Contact, including for any privacy question: contact@todis.eu. KOHEX has not appointed a data protection officer, as this is not mandatory for its activity.
Roles.
- For the data of the store's buyers, the merchant is the controller; KOHEX is the processor and processes the data on the merchant's behalf, under the data processing agreement.
- For the merchant's own data (article 3a), KOHEX is the controller.
2. What the app does not do
- No identity data of the buyer: no name, no email, no phone number, no address, no customer identifier, no date of birth, no image. From the verification, the app receives only the answer about age: 18 or over, or not, whether it comes from the wallet or from the identity document.
- No marketing or tracking: the app does no advertising, no profiling and no audience measurement. It sets no cookie and no local storage in the admin.
- No message to the buyer: the app never writes to the buyer. The verification link for an order on hold is sent by the merchant, from its own email.
- No sale or sharing of data, and nothing about the order is sent to Todis.
- No artificial intelligence training on the data.
3. Data read through Shopify's APIs
| Source | What the app reads | Why |
|---|---|---|
| App installation | the store's myshopify domain, the app's offline access token and the granted scopes; no online session, hence no staff data | call Shopify's APIs for the store |
orders/create webhook | order identifier and date, cart identifier, cart attributes, of which the app reads only the age verification (todis_age_token) | check the verification when the order is created |
orders/fulfilled, orders/cancelled webhooks | order identifier | erase the data of a hold |
fulfillment_orders/hold_released webhook | fulfillment order identifier | erase the data of a released hold |
| Admin API, orders and fulfillment orders | the order's fulfillment orders and holds placed; order name (#1002) and its language, for the "Orders on hold" page and the pre-written email, without keeping them | put on hold, release the hold, show the list to the merchant |
| Admin API, store | the store's name, time zone, primary domain and default language; "development store" flag | verification link and email; billing test mode and demonstration mode |
| Admin API, checkout rule | status of the app's checkout rule | show and turn on the protection |
| Billing (Billing API, billing webhooks) | the app's subscription and purchase: plan, cap, period, status; the shop's billing currency, to restrict plans to shops billed in euros | bill according to the chosen plan |
| App admin (App Bridge) | status of the app embed in the published theme | show the protection status |
customers/data_request, customers/redact, shop/redact webhooks | request identifier and identifiers of the orders cited; the customer block (identifier, email, phone) is never read | answer access and erasure requests |
shop/update, app/uninstalled, app/scopes_update webhooks | store identifier and update date; uninstallation; granted scopes | keep the store's information up to date; erase on uninstallation |
An order identifier is data that can be linked to a buyer in Shopify's sense (level 1 protected customer data); the app reads no level 2 field (name, address, email, phone).
What the app writes at Shopify: the app's checkout rule (creation and update); holding and releasing fulfillment orders; the "age verified" tag on an order whose check succeeded or whose hold was released by a new successful verification, or "age accepted by merchant" on an order authorised by the merchant after review; the subscription, the Early Bird purchase and usage charges; the demonstration mode metafields; the installation metafield that carries the state of the ID document check (on or off). None of these writes carries identity data of the buyer.
3a. Merchant data processed by KOHEX as controller
- Data: store domain, store name, subscription and billing status, Early Bird right, state of the ID document check (on or off), date and version of the terms accepted, exchanges with support.
- Purposes: providing the app and its support, billing, performing the Early Bird plan, complying with KOHEX's legal obligations.
- Legal bases: performance of the contract with the merchant, and KOHEX's legal obligations (in particular accounting).
- Recipients: Shopify, for billing; the hosting providers in article 9.
- Retention: as in the table in article 8; exchanges with support, 3 years after the last exchange; accounting records, for the period required by law.
4. Data received from the buyer
- Cart identifier, sent by the buyer's browser when the verification starts, without the cart access key, which is neither kept nor sent on.
- Answer about age, returned by Todis (wallet) or by the buyer's browser (identity document, article 4a): 18 or over, or not (or the failure of the verification: refusal, abandonment, error, age missing).
- The app's pages in the store do not read the identifier of the logged-in customer (
logged_in_customer_id). - On a development store, a demonstration mode can simulate the verification: nothing is asked of the buyer and no verification takes place.
4a. Identity document verification in the browser
Unless the merchant has turned this option off, a buyer without a wallet can have their age checked with their ID document and face. This verification takes place entirely in the buyer's browser, on their device: the app's program, downloaded from the app's server, uses the camera, with the permission the buyer gives their browser, to ask for a head movement and check it, read the document (national identity card, passport, driving licence or residence permit) and read the date of birth from it, compare the face with the document's photo and calculate whether the person is 18 or over.
The camera images, the data read from the document and the facial measurements stay in the buyer's browser, in memory, for the duration of the verification; they are not sent to the app, to Todis or to any third party, and are not kept. The document is neither copied nor recorded. The app receives only the answer about age, 18 or over, or not, with the technical identifier of the verification. It keeps this answer for 15 minutes at most, then erases it; the billing record retains only technical billing data (date, method, amount), with no buyer data.
On a computer, the page offers to continue on the phone: it shows a code that the buyer scans with their phone, and the verification takes place on the phone.
Biometric data. Comparing the filmed face with the document's photo is processing of biometric data within the meaning of article 9 of the GDPR. It is performed on the buyer's device only, on behalf of the store, which is the controller, and is based on the explicit consent the buyer gives by choosing this method, after reading the information shown on the page, and then by allowing the camera. This consent is freely given: the buyer may at any time prefer the wallet or contact the store for a human review (article 7). Neither KOHEX nor the store has access to the images or facial measurements.
Information on the page. Before opening the camera, the page tells the buyer, in their language: that the verification takes place on their device; that their images and identity document are not sent; that only the answer "18 or over, or not" is sent to the store; and where to read this policy.
5. Role of Todis
The buyer presents their digital identity wallet on the verification page served by Todis. Todis verifies the presentation and issues no credential. The app does not see the presentation: it only receives the outcome of the verification from Todis, in a signed message, which is authoritative for billing and for releasing a hold. Unless the merchant has turned off the ID document check, the Todis page also offers a link to it; Todis takes no part in that verification and receives nothing from it; it is not informed of the replacement: its own session simply remains without follow-up.
What Todis keeps of the buyer's presentation. Todis keeps the presentation, the verified attributes and the nonce in memory only, for 15 minutes. It sends the app a signed event that carries no attribute of the buyer; it keeps it for 30 days. No transaction identifier is kept.
What Todis keeps for the app:
- for each store, a licence: the myshopify domain and the return addresses to the store, as long as the app is installed; on the store's erasure request, they are erased, and only the licence identifier, a fingerprint and dates remain;
- for each verification, an opaque internal identifier and the return address, sent by the app;
- result events, for 30 days, under the licence identifier only.
6. Uses
- verify age before payment for a cart that contains an age-restricted product, with the wallet or, unless the merchant has turned it off, with the ID document;
- check, when the order is created, the verification it carries; put the shipping on hold if this check fails, and add the "age verified" tag if it succeeds;
- release the hold after a new successful verification, through the link the merchant sends;
- bill the merchant according to its plan, with no buyer data;
- answer the access and erasure requests forwarded by Shopify;
- monitor that the service works properly, without any buyer data.
7. Automated decisions and recourse
The app makes two automated decisions based on the answer of the verification, treated as having significant effects for the buyer:
- blocking the payment of a cart that contains an age-restricted product without a valid verification;
- putting on hold the shipping of an order whose verification fails the order check.
The app never cancels an order. The buyer has two remedies, independent of each other:
- verify again: for a blocked payment, go back to the cart and place the order from it; for shipping on hold, follow the verification link the merchant sends; a successful verification releases the hold placed by the app;
- request a human review from the merchant, by contacting the store through its usual contact means; the merchant decides. If the merchant accepts a blocked payment, it sends the buyer a single-use authorisation link; the order then carries the tag "age accepted by merchant". The app keeps of this review only the link's date and its use, with no buyer data. It is the only route for a buyer without a compatible wallet when the merchant has turned off the ID document check, and for a buyer whom that verification wrongly refused.
8. Retention periods
| Data | Retention |
|---|---|
| Answer of a wallet check (technical id, outcome), before the age token is issued | 15 minutes at most |
| Used age token, webhook deliveries | 3 hours for the token, 24 hours for the deliveries |
| Order on hold, Todis sessions and events (cart, order, method, outcome, fulfilments) | 30 days at most |
| Merchant authorisation links (creation, expiry and use dates, cart identifier) | 30 days at most |
| Answer of an identity document verification (technical identifier, method, outcome) | 15 minutes at most |
| Data access requests and the identifiers of the orders they cite | until the merchant marks them as handled, 60 days at most |
| Billing and counting of verifications (date, method, amount), without any buyer data | 90 days at most |
| Store data (Todis licence, settings, protection and billing status, demonstration mode, state of the ID document check) | until the store erasure request, which Shopify sends 48 hours after uninstallation |
| Early Bird right (fingerprint of the domain, purchase date) | as long as the app is marketed, even after the erasure request |
| App and system logs, without any buyer data | 31 days at most |
| Backup copies | 30 days at most, in normal operation |
After uninstallation. The store's data is erased on uninstallation for the app session and billing status, then entirely on the erasure request (shop/redact) that Shopify sends 48 hours after uninstallation, well before the 30-day deadline. The app then asks Todis to anonymise the store's licence, and repeats the request until it is confirmed; in the meantime, it keeps only the licence identifier and a fingerprint, without the domain.
Early Bird right. A store that bought the Early Bird plan keeps its right after uninstallation and after the erasure request: the app keeps a fingerprint of the myshopify domain, which makes it possible to recognise the store if it reinstalls the app without making it possible to recover its domain, the purchase date and the "development store" indication. This is the proof of the €49 purchase and what makes it possible to perform the plan if the store reinstalls the app. The legal basis is performance of the contract. The merchant may request the erasure of this fingerprint at contact@todis.eu, giving up the plan; it is also erased when the app stops being marketed.
Backups. What an erasure removes from the database remains in the copies taken before it, then leaves them when they expire, 30 days at most after the erasure in normal operation. Copies are never restored to read erased data; after a restoration, the store erasures that occurred since the copy are applied again by our restoration procedure, before the service reopens.
9. Hosting location and transfers
- App server and Todis: virtual machines at Scaleway, in Paris, connected by a private network.
- Backup copies: at OVH, Gravelines region (France), encrypted; and on a KOHEX server in France, encrypted.
- Monitoring: metrics and dashboards on the KOHEX server, with no buyer data. Metrics carry only the licence identifier; dashboards show the store's domain, read on demand from the app, without storing it.
- Alerts: sent to a KOHEX Slack channel; they carry only the store's licence identifier, with no buyer data. Slack Technologies, LLC may process these alerts in the United States; this transfer is covered by the EU-US Data Privacy Framework, in which Slack participates, and otherwise by the European Commission's standard contractual clauses.
10. Security
- encrypted exchanges with Shopify, the store, the buyer and Todis;
- app database and backup copies encrypted;
- secrets in a vault, never in the code;
- no buyer data in metrics or logs;
- the identity document verification page calls no third-party service and sends no image.
11. Rights of individuals
Buyers. The buyer exercises their rights with the store, which is the controller. Shopify forwards access and erasure requests to the app: in the app, on the "Data access requests" page, the merchant sees the data held on each order cited, with a text to pass on to the buyer; an erasure request immediately erases the data of the orders cited. A buyer who writes directly to KOHEX is referred to the store.
Merchants. The merchant exercises its rights of access, rectification, erasure, restriction, objection and portability over its own data by writing to contact@todis.eu; KOHEX answers within one month.
Complaint. Anyone may lodge a complaint with the Commission nationale de l'informatique et des libertés (CNIL).
12. Changes and contact
This policy is published at https://shop-verify.todis.eu/legal/en/confidentialite.html, and the French original at https://shop-verify.todis.eu/legal/fr/confidentialite.html.
KOHEX announces any significant change to this policy by email and in the app, before it applies.
Contact: contact@todis.eu
Language: the French text prevails; the English text is a faithful translation of it.