> ## Knowledge Base Index
> Fetch the complete knowledge base index at: https://help.pandectes.io/sitemap.xml
> Use this file to discover available pages before exploring further.
> Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash).

# Permissions and Authentication Explained

##### About this document

Pandectes GDPR Compliance helps your store meet privacy, consent, and accessibility obligations across different regions of the world. To do this, the app requests a defined set of Shopify permissions, known as **access scopes**.

This document explains, in plain language, every permission the app requests: what Shopify uses each permission for, and how Pandectes uses it. It then describes how the app is installed and authenticated, why permissions are configured the way they are, and how you can verify for yourself how those permissions are used.

The goal is full transparency. Nothing here requires any technical knowledge of how the app is built; it simply explains *what* we ask for and *why*.


##### How Pandectes handles your data

Before the individual permissions, it helps to understand a principle that applies across the entire app:

* **No internal storage of your customer or order data.** Pandectes does not keep your customers' or orders' data in its own database.
* **Lookups, not copies.** Where a feature needs to verify something (for example, confirming that an email address belongs to a customer, or that an email and order ID match a real order), Pandectes performs a lookup through its app servers and uses only the result of that check.
* **Persistence stays inside Shopify.** When a record genuinely needs to be saved (such as a logged EU withdrawal request), it is written back into Shopify's own storage and linked to the relevant order, rather than being stored by Pandectes.

This data-minimisation approach is the reason several permissions below are described as "lookups only."


##### How Pandectes is installed and authenticated

Pandectes uses **Shopify managed installation**, the modern method that Shopify recommends for installing apps and keeping their permissions up to date.

With managed installation, Shopify itself handles installing the app and applying any permission changes, without sending you through extra authorization screens. For you, this means **faster, smoother installs and updates**, with no page redirects, no flickering screens, and no repeated consent prompts. Behind the scenes, the app obtains short-lived access tokens through Shopify's secure token exchange rather than older redirect-based flows.

A defining characteristic of managed installation is that an app declares the **complete set of permissions it may use in a single, central configuration** that it submits to Shopify. Shopify then applies that configuration consistently to every store that installs the app. Pandectes does not, and under this model cannot, request a different, hand-picked set of permissions for each individual store.

##### Why permissions are declared centrally

This is a deliberate architectural decision, and it works in your favour in several ways:

* **One consistent, auditable configuration.** Every store runs Pandectes with the same reviewed set of permissions. There are no per-store variations to track, which keeps the app's behaviour predictable and easy for you, for Pandectes, and for Shopify to reason about.
* **Instant feature activation, with no friction.** Pandectes is modular: the cookie banner, accessibility widget, Data Subject Requests, Do Not Sell My Data, and the EU Withdrawal Button can each be switched on or off at any time. Because the necessary permissions are already in place, turning on a module works immediately: no reinstallation, no new authorization screen, and no interruption to your storefront.
* **A permission granted is not a permission used.** Being granted a permission only means the app *may* use it, if and when you enable the related feature. A permission that belongs to a module you have not turned on simply remains dormant. Combined with the data-minimisation principle above, this means Pandectes reads or writes only what an active feature actually needs.

So if, for example, you have not enabled the EU Withdrawal Button, the order-related permissions associated with it stay unused until you choose to enable that feature.

##### Reviewed and validated by Shopify

The set of permissions Pandectes requests is **not chosen arbitrarily, and it cannot be quietly changed.** Every permission is reviewed and confirmed by Shopify in the context of two programs that Pandectes takes part in:

* **Shopify Plus Partner.** Pandectes is a recognised **Shopify Plus Partner**, a status Shopify grants to vetted, established partners that meet its standards for quality, expertise, and trust.
* **Built for Shopify.** Pandectes GDPR Compliance holds the **Built for Shopify** designation, Shopify's highest level of app recognition, awarded only to apps that meet its strict requirements for quality, performance, security, and responsible handling of data.

Because Pandectes participates in both programs, the permissions described in this document have been **examined and validated by Shopify against its own published standards**, and any change to what the app requests is subject to the same review. In short, the access Pandectes asks for is held to Shopify's standards rather than set at Pandectes' sole discretion, ensuring all applicable standards are met.

##### You can verify how permissions are used

Shopify provides a **management screen for every installed app** in your store's admin. From there you can review the exact permissions Pandectes has been granted and see whether each one has actually been used, **including whether a given permission has ever been used** on your store. Because this is the clearest way to confirm that the app's real-world access matches what is described here, the section *"Understanding Shopify's 'Manage app' screen"* below walks through exactly what it shows and how it maps to the permissions in this document.


##### Permissions Pandectes requests

Below is every permission Pandectes requests, grouped by purpose. For each one you'll find Shopify's own definition of the permission alongside an explanation of how Pandectes uses it.

> **A note on "write" permissions:** On Shopify, a `write_` permission generally also grants the matching **read** access for the same resource. This is why you may not see separate "read" permissions for content, files, themes, or metaobjects: the corresponding write permission already covers reading them. In places where Pandectes only needs to *read* a resource (for example, checking your `theme.liquid`), it does so without modifying anything.

##### Group 1: Consent and regional privacy enforcement

These permissions let the cookie banner apply the correct consent behaviour and pass consent signals to your other tools.

`write_privacy_settings`
**Shopify's definition.** Access to the store's privacy settings and cookie banner configuration (`PrivacySettings`, `CookieBanner`).

**How Pandectes uses it.** Configures your store's **regional privacy settings**, defining which regions of the world require consent and which do not. This is essential for the cookie banner to behave correctly in each region, so that the appropriate rules (such as the GDPR in the EU/EEA and the CPRA/CCPA in California) are applied to every visitor.

`write_pixels`
**Shopify's definition.** Access to the Web Pixels API for creating and managing a web pixel.

**How Pandectes uses it.** Registers **Web Pixels** that allow Pandectes integrations, such as **Google Consent Mode**, to operate consistently across the entire customer journey: the storefront (pre-checkout), the checkout, and the post-checkout "thank you" page.

##### Group 2: Placing Pandectes on your storefront

These permissions let the app add its features to your store and deliver supporting assets, while staying within Shopify's recommended methods.

`write_content`
**Shopify's definition.** Access to online-store content such as Pages, Blogs, Articles, and Comments.

**How Pandectes uses it.** Creates the storefront **pages that host the app's blocks**, such as the **Cookie Declaration**, **Data Subject Request**, **Do Not Sell My Data**, and **EU Withdrawal** pages, so you don't have to create and wire them up by hand.

`write_files`
**Shopify's definition.** Access to generic Files in the store's file storage.

**How Pandectes uses it.** Uploads supporting assets to your store's **Files** area so they are delivered through **Shopify's CDN**, which is fast and highly resilient. These assets include the logos used in the cookie banner and accessibility widget, and the `pandectes-rules.js` file that holds the rules for the Pandectes auto-blocker.

`write_themes`
**Shopify's definition.** Access to online-store theme files and assets (`OnlineStoreTheme`).

**How Pandectes uses it.** Used in a deliberately limited way. On modern stores it primarily **reads** your `theme.liquid` to detect whether the cookie banner and accessibility widget app embeds are enabled, and it is used to **clean up** assets that older versions of the app previously added to the theme. In keeping with Shopify's **Built for Shopify** program, which Pandectes participates in, the app no longer creates, modifies, or deletes theme assets.

`write_script_tags`
**Shopify's definition.** Access to ScriptTag objects, which load scripts on the storefront.

**How Pandectes uses it.** Maintained primarily for **compatibility**. On older "vintage" themes that do not support Online Store 2.0, script tags are the only available way to add the storefront code the app needs. On modern stores, Pandectes delivers its **cookie banner** and **accessibility widget** through app embeds (Shopify's recommended method), so in practice this permission is now used mainly to **remove legacy script tags** and replace them with app embeds when a store is migrated. As with theme assets, the **Built for Shopify** program does not allow apps to add script tags, so on modern stores Pandectes does not create them; this permission serves legacy compatibility and cleanup only.

##### Group 3: Privacy-rights modules (Data Subject Requests and EU Withdrawal)

These permissions support the features that let your shoppers exercise their rights. The data here is **looked up, not stored** by Pandectes; where a result must be saved, it is written back into Shopify.

 `read_customers`
**Shopify's definition.** Access to customer records and related Segment, Company, and Company Location data.

**How Pandectes uses it.** Powers the **Data Subject Requests (DSR)** module. When a visitor exercises a privacy right, whether the right of **access and data portability**, the right to **rectification**, or the right to **erasure** ("right to be forgotten"), Pandectes looks up the email address they provide to confirm whether it belongs to a customer of your store, before starting the verification process. The module is available both as an **app block** you can add to any page and as a **customer-account extension** shown in the customer accounts area when you enable it. These are **lookups only**; Pandectes does not store this customer data.

 `read_orders`
**Shopify's definition.** Access to Orders, Fulfillments, Order Transactions, and Abandoned Checkouts (by default, those from the last 60 days).

**How Pandectes uses it.** Powers the **EU Withdrawal Button**. A shopper who wishes to withdraw from a purchase enters their **email address and order ID**, and Pandectes verifies that this combination matches a real order before allowing the withdrawal request to proceed.

`read_all_orders`
**Shopify's definition.** Extends order access beyond Shopify's default 60-day window. This permission is granted only after a dedicated Shopify review and is used together with `read_orders`.

**How Pandectes uses it.** Extends the **EU Withdrawal Button** so it can also verify **orders placed more than 60 days ago**, since withdrawal rights can apply to older purchases. It only widens the time range of the same order verification described above and does not introduce any new use of order data.

`write_metaobject_definitions`
**Shopify's definition.** Access to create and modify metaobject definitions, which describe the structure of a metaobject.

**How Pandectes uses it.** Defines the **data structure used by the EU Withdrawal Button**, specifically the schema for recording that a withdrawal or return has been requested for an order. Establishing this structure is what allows the request to be stored natively within Shopify and associated with the relevant order.

`write_metaobjects`
**Shopify's definition.** Access to create and modify metaobject records that follow the defined structure.

**How Pandectes uses it.** Creates the individual records based on the definition above. When a shopper completes a withdrawal request, Pandectes records it as a **metaobject linked to the order**, signalling within Shopify that a withdrawal or return was requested. As with all Pandectes data, this is stored **in Shopify**, not in a Pandectes database.


##### Understanding Shopify's "Manage app" screen

Shopify shows a **"Manage app"** screen for every installed app in your admin, and it is the most direct way to verify what Pandectes can access and what it has actually used. The screen groups the app's access under Shopify's own high-level labels, which map directly to the permissions described earlier in this document.

##### Activity and permissions vs. unused access

Shopify separates the app's access into two lists:

* **Activity and permissions:** areas the app has recently used, along with when they were last used.
* **Unused access:** areas the app *can* access but has **not** used in the last 30 days.

Which areas appear in each list depends on the Pandectes features you have enabled. This is the **"a permission granted is not a permission used"** principle made visible: a permission tied to a feature you haven't turned on simply sits under **Unused access**. For example, a store that has not activated the Data Subject Requests or EU Withdrawal modules will typically see the **Customers** and **Orders** areas (and, if no pixel-based integration is active, **Store analytics**) listed as unused.

The table below maps each area label Shopify shows to the underlying Pandectes permissions:

| Area shown in Shopify | Access | Underlying Pandectes permission(s) |
| ---- |
| **Online Store** | View & Edit | `write_content`, `write_script_tags`, `write_themes` |
| **Shopify admin** | View & Edit | `write_files`, `write_privacy_settings` |
| **Custom data** | View & Edit | `write_metaobject_definitions`, `write_metaobjects` |
| **Customers** | View only | `read_customers` |
| **Orders** (All order history) | View only | `read_orders`, `read_all_orders` |
| **Store analytics** | View & Edit | `write_pixels` |

The "All order history" label shown next to **Orders** reflects the `read_all_orders` permission, which allows the EU Withdrawal Button to verify orders older than Shopify's default 60-day window.

##### Privacy: the personal data this app can access

The same screen lists the categories of personal data the app can access, and Shopify displays a confirmation here that **Pandectes meets its data-handling and privacy requirements**.

Under **Customers**, you will see two categories:

* **Sensitive data (Name and Email address).** These are used by the **Data Subject Requests** and **EU Withdrawal Button** modules and come from the `read_customers` permission. This is data Pandectes **explicitly requests**, because verifying a shopper's identity is essential to those rights-based features. As noted earlier, the data is looked up, not stored by Pandectes.
* **Device and activity data (Geolocation, IP address, Browser and operating system, Browsing behavior, and Client ID cookie).** These accompany the **Web Pixel** (`write_pixels`). They are **declared automatically by Shopify** for any app that uses a web pixel and are **not data that Pandectes explicitly requests or collects for its own purposes**.

Under **Staff and contributors**, Shopify lists data relating to the store owner and blog contributors (such as name, email address, and IP address). These entries are **added automatically by Shopify for every app** and are not specific to Pandectes.

### Quick reference

| Permission | Type | Primarily used by |
| ---- |
| `write_privacy_settings` | Write (read + write) | Cookie banner: regional consent rules |
| `write_pixels` | Write | Consent signals across the customer journey (e.g. Google Consent Mode) |
| `write_content` | Write | Creating the pages that host the app's blocks |
| `write_files` | Write | Hosting banner/widget logos and the auto-blocker rules file on Shopify's CDN |
| `write_themes` | Write (mostly read) | Detecting app-embed status; cleaning up legacy theme assets |
| `write_script_tags` | Write | Legacy-theme support and migration cleanup to app embeds |
| `read_customers` | Read | Data Subject Requests: email lookup |
| `read_orders` | Read | EU Withdrawal Button: order verification |
| `read_all_orders` | Read | EU Withdrawal Button: verifying orders older than 60 days |
| `write_metaobject_definitions` | Write | Defining the EU Withdrawal record structure |
| `write_metaobjects` | Write | Recording withdrawal requests against the order |


##### References and further reading

This section gathers the authoritative sources behind the regulations this app helps you address, together with the official Shopify documentation that governs how the app is installed and what it may access.

##### Regulatory references

* **EU right of withdrawal, Directive (EU) 2023/2673**, which amends the Consumer Rights Directive (2011/83/EU). Although primarily concerned with distance financial-services contracts, it adds a new **Article 11a** to the Consumer Rights Directive requiring a clearly visible, easy-to-use online **withdrawal function** ("withdrawal button"). It applies to distance contracts concluded through an online interface (website, app, or customer portal) wherever a statutory 14-day right of withdrawal exists, without extending withdrawal rights or changing the existing exceptions. The principle is that withdrawing from a contract online must be at least as easy as entering into it, and the obligation also reaches non-EU businesses that direct their activities at EU consumers. Member States had to transpose it into national law by 19 December 2025, with the rules applying from **19 June 2026**.
* Plain-language summary: [https://eur-lex.europa.eu/EN/legal-content/summary/consumer-information-right-of-withdrawal-and-other-consumer-rights.html](https://eur-lex.europa.eu/EN/legal-content/summary/consumer-information-right-of-withdrawal-and-other-consumer-rights.html)
* Official text: https://eur-lex.europa.eu/eli/dir/2023/2673/oj/eng
* **GDPR, Regulation (EU) 2016/679.** The EU's General Data Protection Regulation, which establishes data-subject rights such as access, data portability, rectification, and erasure ("right to be forgotten").
* Official text: https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng
* Plain-language summary: https://eur-lex.europa.eu/EN/legal-content/summary/general-data-protection-regulation-gdpr.html
* **ePrivacy Directive, Directive 2002/58/EC**, as amended by **Directive 2009/136/EC** (the "cookie" amendment). Governs privacy in the electronic-communications sector, including the requirement to obtain consent before storing or accessing non-essential cookies on a user's device.
* Directive 2002/58/EC: https://eur-lex.europa.eu/eli/dir/2002/58/oj/eng
* Consolidated version (including the 2009 amendment): https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02002L0058-20091219
* Amending Directive 2009/136/EC: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:32009L0136

### Shopify documentation

* Shopify API access scopes: https://shopify.dev/docs/api/usage/access-scopes
* Enable Shopify-managed installations for your app: https://shopify.dev/docs/apps/build/authentication-authorization/app-installation
* Managing access scopes: https://shopify.dev/docs/apps/build/authentication-authorization/app-installation/manage-access-scopes
* Token exchange (how embedded apps obtain access tokens): https://shopify.dev/docs/apps/build/authentication-authorization/access-tokens/token-exchange
* Web Pixels API: https://shopify.dev/docs/api/web-pixels-api
* Protected customer data requirements: https://shopify.dev/docs/apps/launch/protected-customer-data

### Shopify quality programs

* Built for Shopify overview: https://shopify.dev/docs/apps/launch/built-for-shopify
* Built for Shopify requirements: https://shopify.dev/docs/apps/launch/built-for-shopify/requirements

*This document describes the permissions requested by Pandectes GDPR Compliance and how they are used. If you have questions about any permission, or wish to confirm its usage, you can review the app's management screen in your Shopify admin at any time.*