4 ms·

Heads up: it looks like the company behind this (Chec) collects and stores a significant amount of data from the usage of the Commerce.js SDK featured here; inc

Heads up: it looks like the company behind this (Chec) collects and stores a significant amount of data from the usage of the Commerce.js SDK featured here; including customer name, email address, phone number, IP address, device fingerprint and transactions. The privacy policy isn't particularly clear about how this is used, but it's very permissive and vague. It also states that this collection is "mandatory." In my experience this means it will be repackaged as "analytics" and sold for market research and advertising. Be wary when using eCommerce SDKs, especially in the absence of exact, legalese-free clarification about what "data processing" means. Here is the privacy policy: https://www.iubenda.com/privacy-policy/60591797/full-legal https://www.iubenda.com/privacy-policy/60591797/full-legal Keep in mind that if Chec is acquired, the durably stored data will also be transferred per this policy. Beyond the usual callouts like fraud and geolocation, the policy also allows the company to use customer data to "improve its services", with no specificity on what exactly that would entail.

piaste 6y ago
Yeah, this is extremely in violation of the GDPR.
- fractionalhare 6y ago
  Based on this article, I guess they've determined they're in GDPR compliance and it's the merchants who have to sort that out :) http://support.commercejs.com/en/articles/1942216-gdpr-with-chec-platform http://support.commercejs.com/en/articles/1942216-gdpr-with-... > We collect our merchants’ customers’ name, email, shipping and billing address, payment details, company name, phone number, IP address, information about orders you initiate, information about the Chec powered merchant stores/integrations that you visit and interact with, and information about the device and browser you use. The FAQ is "what" and "why", but only the "what" is answered.
  - croes 6y ago
    "they've determined they're in GDPR compliance" Their claim is BS. They are collecting third party data because the customers are the merchants customers not theirs. The data collected is not necessary for business because the customer doesn't have a business relationship with them.
    - therealx 6y ago
      Honestly asking - it they are just a proxy for that info, does it change things?
    - piaste 6y ago
      A few years ago I reviewed a platform offer from a corporation you've heard of. They had a similar clause regarding data protection issues - it basically said "all your data is going to be sent to US servers and we're going to do basically whatever we want with it and there's nothing you can do to opt out. It's your responsibility to let your customers know about it". I told my boss that, while I was not a lawyer, in my opinion we simply could not sign that contract and provide a service without blatantly violating the then-recent GDPR. (We didn't sign it, although I don't know if that played a part.) Chec seems to be using a similar approach? They're running a B2B service which doesn't provide analytics opt-out, and their B2C users are supposed to tell the customers "hey, we can't offer you an opt-out on data collection because it's required to make the software platform work" (except that you're not required to run your store on Chec specifically, otherwise it would be a trivial method to bypass the GDPR). Nonetheless, it's inexcusable that the words 'purpose' and 'analytics' do not appear in that blog post. Those are essential aspects of the GDPR, and if you're not explicitly stating that you won't re-sell the collect data to third parties without the owner's consent, I assume you do.
- raidicy 6y ago
  I was looking to build with this until I read this chain of comments. I feel worried about using it and I don't think I should use even simple well built tools if this is the case.
deepstack 6y ago
By default stripe.js (one version ago), the default button they included on their getting start page does the same thing, it took us a really long time to implement the custom api that will only submit the credit card number info + amount charged + zip to strip and rest of stuff (customer name, email address, phone number and transactions, etc) to our server. What bothers me about these lowering the bar for new front end developer/designer is that it is free feast for these kind of non compliance :(
- deepstack 6y ago
  I also am very upset how the bar got lower for web developer. It just some how developer becomes a cool thing to do, and people who are not even interested in development jumped on the band wagon it is very annoying for people who truly understand the development and coding process and being doing it before it was cool.
  - egeozcan 6y ago
    Development was always cool, no? Why the hate for newcomers, people got to start somewhere, right?
    - deepstack 6y ago
      yes. It is ok if someone doesn't know anything and want to learn as a coder/developer. What I find mostly is that new comers are usually just following the trend or the pay. It is quite a turn off. I'm sure the musicians and artists can relate to that. And often the experienced developer end up cleaning up their stuff, then they move on to another track to be manager or something. (that's to answer your question).
      - madeofpalk 6y ago
        Don't gatekeep.
        deleted 6y ago

piaste 6y ago

Yeah, this is extremely in violation of the GDPR.

fractionalhare 6y ago
Based on this article, I guess they've determined they're in GDPR compliance and it's the merchants who have to sort that out :) http://support.commercejs.com/en/articles/1942216-gdpr-with-chec-platform http://support.commercejs.com/en/articles/1942216-gdpr-with-... > We collect our merchants’ customers’ name, email, shipping and billing address, payment details, company name, phone number, IP address, information about orders you initiate, information about the Chec powered merchant stores/integrations that you visit and interact with, and information about the device and browser you use. The FAQ is "what" and "why", but only the "what" is answered.
- croes 6y ago
  "they've determined they're in GDPR compliance" Their claim is BS. They are collecting third party data because the customers are the merchants customers not theirs. The data collected is not necessary for business because the customer doesn't have a business relationship with them.
  - therealx 6y ago
    Honestly asking - it they are just a proxy for that info, does it change things?
  - piaste 6y ago
    A few years ago I reviewed a platform offer from a corporation you've heard of. They had a similar clause regarding data protection issues - it basically said "all your data is going to be sent to US servers and we're going to do basically whatever we want with it and there's nothing you can do to opt out. It's your responsibility to let your customers know about it". I told my boss that, while I was not a lawyer, in my opinion we simply could not sign that contract and provide a service without blatantly violating the then-recent GDPR. (We didn't sign it, although I don't know if that played a part.) Chec seems to be using a similar approach? They're running a B2B service which doesn't provide analytics opt-out, and their B2C users are supposed to tell the customers "hey, we can't offer you an opt-out on data collection because it's required to make the software platform work" (except that you're not required to run your store on Chec specifically, otherwise it would be a trivial method to bypass the GDPR). Nonetheless, it's inexcusable that the words 'purpose' and 'analytics' do not appear in that blog post. Those are essential aspects of the GDPR, and if you're not explicitly stating that you won't re-sell the collect data to third parties without the owner's consent, I assume you do.
raidicy 6y ago
I was looking to build with this until I read this chain of comments. I feel worried about using it and I don't think I should use even simple well built tools if this is the case.

deepstack 6y ago

By default stripe.js (one version ago), the default button they included on their getting start page does the same thing, it took us a really long time to implement the custom api that will only submit the credit card number info + amount charged + zip to strip and rest of stuff (customer name, email address, phone number and transactions, etc) to our server. What bothers me about these lowering the bar for new front end developer/designer is that it is free feast for these kind of non compliance :(

deepstack 6y ago
I also am very upset how the bar got lower for web developer. It just some how developer becomes a cool thing to do, and people who are not even interested in development jumped on the band wagon it is very annoying for people who truly understand the development and coding process and being doing it before it was cool.
- egeozcan 6y ago
  Development was always cool, no? Why the hate for newcomers, people got to start somewhere, right?
  - deepstack 6y ago
    yes. It is ok if someone doesn't know anything and want to learn as a coder/developer. What I find mostly is that new comers are usually just following the trend or the pay. It is quite a turn off. I'm sure the musicians and artists can relate to that. And often the experienced developer end up cleaning up their stuff, then they move on to another track to be manager or something. (that's to answer your question).
    - madeofpalk 6y ago
      Don't gatekeep.
      - deleted 6y ago