Moodle Bridge privacy policy

Last updated 2 November 2026. Moodle Bridge is a Shopify app made by Biruh Alemnew (Biruh Tech). It connects a merchant's Shopify store to the merchant's own Moodle site.

What the app stores

• About the store: the store's address, Shopify's access token for the app, the store's plan, the address of the merchant's Moodle site, and the Moodle web service token and shared secret (the token and secret are stored encrypted).
• About the store's customers: Shopify customer and order IDs, which courses an order gave and whether they were taken back, cohort rules and the customer tags they are checked against, and course completions reported by the Moodle site (course, date). A customer's email and name are stored encrypted, and only until their enrolment or cohort change has been sent to the Moodle site, then erased. One-time sign-in links last ten minutes and are deleted within an hour.
• The app stores no payment details. Charges for the app are made by Shopify.

What it is used for, and who receives it

Only to provide the app's features to the merchant who installed it: the customer's Shopify ID, email and name are sent to the merchant's own Moodle site to make or find the customer's account, enrol them, add them to cohorts and sign them in. Completions are written back to the customer in the merchant's Shopify store (a customer metafield and a "completed:" tag). Nothing is sold, shared with other parties, or used for advertising.

How long it is kept

While the app is installed. When the merchant uninstalls the app, the Moodle connection is deleted at once and everything else when Shopify sends its shop deletion request (48 hours after uninstalling). When Shopify sends a customer deletion request, that customer's data is deleted. The merchant's Moodle site keeps its own records under the merchant's own policy.

Where it is kept

On the app's server, hosted with the operator's web host, over encrypted connections (HTTPS), with encrypted nightly backups. Every read of customer data is logged. See also the data processing agreement.

Your rights

Customers: ask the store you bought from; it can request your data or its deletion through Shopify, and the app answers those requests. Merchants: write to biruh@biruh.org.