Privacy and data

This page explains what personal data Course Bridge for Acorn PLMS handles for your store, why it handles it, and the terms under which it does so. When you accept these terms in the app, you and the app's operator agree to them as your data processing agreement for this app.

What the app processes

Course Bridge for Acorn PLMS handles a small, specific set of data:

• The learner details a shopper enters on your product page: first name, surname, and email, one set per seat. The app's own storefront form collects these and saves them with the order.
• The reference of a paid order, used to look the order up.
• The product-to-course mapping you set, used to decide which Acorn course each product enrols learners into.

The app does not read your customers' account details. It does not read the buyer's name, email, phone number, or billing or shipping address. It reads only the learner details above and the product's course mapping.

Why it processes this

The purpose is to enrol the named learners into your Acorn PLMS when an order is paid. The app uses the paid-order event as the trigger and the learner details to create and enrol each learner. That is the whole job.

Who is responsible

You are the controller of your customers' and learners' personal data. The app acts as your processor: it handles that data only to provide the enrolment function you have set up, and only on your instructions (your settings and your course mappings).

Where the data goes

Learner data leaves the app in two places, both of which you choose and control:

• Your own Acorn PLMS, to create and enrol the learner. This is the system the enrolment is for.
• An optional alert channel you configure (an email provider such as Resend, Postmark, or SendGrid, or a webhook such as Slack), used only to tell you when an enrolment fails. If you leave alerts off, nothing is sent.

The app does not sell data, and it does not share data with any other third party for that party's own purposes.

What is stored, and for how long

The app does not keep customer or learner personal data at rest. Its order and activity logs hold only counts, outcomes, reasons, and field names - never names or emails. Those logs are capped per store (the oldest entries are removed automatically) and are deleted when you uninstall the app or when Shopify sends a shop-redact request. The learner details themselves pass through in memory on their way to Acorn and are not saved by the app.

How the data is protected

All connections the app makes are encrypted in transit (HTTPS). The Acorn credentials the app stores for you (such as a refresh token or API key) are encrypted at rest with AES-256-GCM. Because no customer or learner personal data is stored at rest, there is no stored personal data to expose.

Data requests and deletion

The app handles Shopify's privacy and deletion requests. A request to delete a store's data removes everything the app holds for your store. A request about a single customer has nothing to act on, because the app stores no customer personal data; the app records that the request arrived and acknowledges it.

Accepting these terms

You accept these terms in the app before you connect Acorn. The app records that you accepted, and which version. If the terms change, the app asks you to review and accept the new version.

This data processing agreement is separate from the authorisation confirmation you give next to the connection fields, where you confirm your organisation has authorised you to use your Acorn PLMS API credentials with the app. See Connect to Acorn for that step.

If you have questions about how your data is handled, contact the developer of this app.

Affiliation and trademarks

Course Bridge for Acorn PLMS is an independent app. It is not affiliated with, endorsed by, sponsored by, or run by Acorn or Shopify. It connects to the Acorn and Shopify APIs to enrol the learners on your orders, and that is the whole of the relationship.

Acorn, Acorn PLMS, and Shopify, and their logos, are trademarks of their respective owners. Those names appear here only to say what the app connects to. Using them does not imply any partnership with or approval by those companies.