Privacy policy

iDEAL Subscriptions Abakira lets a merchant sell subscriptions to buyers who pay with iDEAL or Bancontact. The first order is paid in the merchant’s Shopify checkout through the merchant’s Mollie payment app. The app then creates a SEPA Direct Debit mandate in the merchant’s own Mollie account, collects each next delivery from that mandate, and records each paid delivery as a Shopify order.

We never hold funds. Every payment goes from the buyer to the merchant’s Mollie account. The app only sends instructions to Mollie with the merchant’s own API key.

What we access, and why

• Orders (read and write): to read a paid subscription order (its lines, the subscription choice, the payment transaction and the shipping address) and to create one paid order for each delivery collected.
• Customers (read): to link a subscription to the buyer’s customer account, so that the buyer can pause or cancel it while logged in.
• Products (read): to know which product variant each delivery contains.
• The merchant’s Mollie account, through an API key the merchant gives us: to read the first payment (including the buyer’s account holder name and IBAN, which Mollie returns for iDEAL and Bancontact), create a Mollie customer and a SEPA mandate, create one direct debit per delivery and read its status, and revoke the mandate when a subscription is cancelled.

What we store

About the merchant: the shop owner contact email and the language of the Shopify admin (for essential service messages, never for marketing without separate consent), and the Mollie API key, encrypted (AES-256-GCM).

About each subscription: the buyer’s email and Shopify customer ID, the origin order ID, the products, quantities, prices, taxes and shipping of the subscription, the delivery frequency, the Mollie customer and mandate IDs, the mandate reference, a masked IBAN (country code and last four digits only), the version of the direct debit authorisation the buyer accepted and its date, the reason chosen when a subscription is cancelled (from a fixed list, optional), and the status of each debit with its Mollie payment ID and the Shopify order created for it.

We do not store the full IBAN or the account holder name: they stay in the merchant’s Mollie account. We do not store shipping addresses: they are read from the origin order each time a delivery order is created.

Who else sees this data

• Mollie B.V. (Amsterdam, Netherlands), the merchant’s own payment provider, under the merchant’s contract with Mollie.
• Vercel runs the app and Neon stores its database (EU region).
• Crisp (Crisp IM SAS, Nantes, France) for the support chat inside the merchant admin only. It never runs on the storefront and never receives buyer data.

What we never do

• We do not sell or share merchant or buyer data.
• We do not use buyer data for advertising or profiling.
• We do not debit any amount other than the one the buyer accepted.

Deletion

• When a buyer’s data must be erased (Shopify customers/redact), we cancel their subscriptions, revoke their mandates in Mollie and delete their subscriptions and debits from our database.
• When the merchant uninstalls the app, we immediately delete the Mollie API key, the contact email and the admin language, and no further debit is sent. 48 hours later (Shopify shop/redact), we delete every remaining record for that shop. The mandates remain in the merchant’s Mollie account.

Our agreement with merchants

We act as a data processor on behalf of the merchant, who remains the controller of their buyers’ data and the creditor of the direct debits. We process only the data listed above, only for the purposes listed above.

Contact

support@abakira.com. iDEAL Subscriptions Abakira is built by Abakira (abakira.com). See also the terms of service.