Terms of Use — MatchAudit for Shopify

Effective date: August 27, 2026

These Terms of Use govern access to and use of the MatchAudit app distributed via the Shopify App Store ("the App"). The App is intended exclusively for business users. Consumers are not permitted to use the App.

1. Provider and Acceptance

These Terms of Use ("Terms") apply to all access to and use of the MatchAudit sanctions-screening and compliance-evidence application distributed through the Shopify App Store, including its embedded admin interface, webhook processing, Shopify Flow trigger and actions, case review tools, evidence records, exports, documentation, and related services (together, "the App").

The App is provided by MatchAudit UG (haftungsbeschränkt), a company incorporated under the laws of the Federal Republic of Germany ("MatchAudit", "we", "us", or "our").

MatchAudit UG (haftungsbeschränkt) is located at Turmstrasse 7, 65611 Brechen, Germany, and is represented by Managing Director Emmi Jose. The company is registered in the commercial register under Amtsgericht Limburg a.d. Lahn, HRB 7665.

By installing the App from the Shopify App Store, accepting these Terms during installation, or otherwise accessing or using the App, the Shopify merchant identified in the relevant Shopify account ("Merchant") agrees to be bound by these Terms.

If the individual accepting these Terms does so on behalf of a legal entity or other organization, that individual represents and warrants that they are authorized to bind that entity or organization.

Any conflicting or deviating merchant terms shall not apply unless MatchAudit has expressly agreed to them in writing. These Terms govern the relationship between the Merchant and MatchAudit specifically; they do not modify or supersede the Merchant's separate agreement with Shopify, Inc. or Shopify International Limited governing use of the Shopify platform itself.

These Terms are specific to MatchAudit for Shopify. MatchAudit's core-platform terms do not govern the App unless the Merchant separately subscribes to that product or a written order form expressly incorporates them. If the Merchant separately uses another MatchAudit product, the agreement for that product applies only to that separate service.

2. B2B Scope Only

The App is offered exclusively to entrepreneurs within the meaning of Section 14 German Civil Code (BGB), legal persons under public law, or special funds under public law, operating a Shopify store for business or professional purposes.

• The App is not offered to consumers within the meaning of Section 13 BGB.
• The Merchant may use the App only for business or professional purposes in connection with its Shopify store.
• MatchAudit may refuse installation, suspend access, or terminate use if it reasonably believes the App is being used by or for a consumer or outside the permitted B2B scope.

3. Definitions

• "Shop" means the Shopify store the Merchant has connected to the App.
• "Merchant" means the Shopify merchant that has installed the App for a given Shop.
• "Authorized User" means a staff member of the Merchant authorized within Shopify to access the App's embedded admin interface on the Merchant's behalf.
• "Shop Data" means order, customer, and fulfillment data that the App receives from the Shop via the Shopify Admin API and webhooks or that the Merchant uploads to the App for historical screening, including billing and shipping names, addresses, dates, source references, and related identifiers used for screening.
• "Output" means screening results, possible matches, score breakdowns, evidence records, exports, case records, and similar informational output generated by the App.
• "Sanctions Data" means sanctions lists, restricted-party lists, and other compliance datasets made available by public authorities, supranational bodies, or other third-party sources, as described in the App's published jurisdiction coverage.
• "Fulfillment Hold" means the App's mechanism of placing a Shopify fulfillment order on hold pending human review, as described in Section 4.
• "Personal Data" has the meaning given in the GDPR.
• "DPA" means the Data Processing Addendum applicable to the App, entered into by reference to these Terms.

4. Scope of the App

MatchAudit provides an embedded Shopify application that screens order and customer parties received through Shopify or a merchant-uploaded historical-record CSV against Sanctions Data and configurable high-risk-geography rules, and surfaces potential matches for human review within the Merchant's Shopify admin ("Sanctions Screening module").

Where enabled by the Merchant and available on the Merchant's plan, the App also provides compliance evidence recording — decision rationale, policy acknowledgements, and periodic review records — with optional AI-assisted explanations and gap detection ("Evidence records module"). AI assistance provides decision support for human review; it does not itself release fulfillment, confirm a legal violation, or replace the Merchant's final decision. A human decision attributable to a verified Shopify staff member is required for cases presented for merchant review. Screenings that do not meet the Merchant's review rules may complete without a manual decision.

On a match above the Merchant's configured review threshold, or a high-risk-geography rule match, the App places the affected fulfillment order on Fulfillment Hold — it does not cancel the order, refund the customer, or take any other action without the Merchant's own subsequent decision. The Merchant is solely responsible for reviewing held orders and deciding how to proceed.

The App releases only MatchAudit-owned fulfillment holds when an Authorized User records an Allow decision. Holds placed by Shopify, the Merchant, or another app are outside MatchAudit's control and are not intentionally released by the App.

The App is designed as a technical and informational support tool. It does not replace the Merchant's own compliance framework, legal review, or internal risk management.

5. Installation, Account Security, and Shopify Access

The App is installed via Shopify's standard OAuth authorization flow. The Merchant authorizes the App to access specific categories of Shop Data as described in the App's requested access scopes at installation.

• The Merchant is responsible for all activity conducted through the App by its Authorized Users.
• The Merchant shall ensure that all Authorized Users comply with these Terms and remains responsible for their acts and omissions in connection with the App.
• The Merchant shall maintain appropriate Shopify staff account administration and promptly revoke Shopify staff access for users who no longer require it.
• The Merchant shall notify MatchAudit without undue delay of any suspected unauthorized access to the App, misuse, or compromise it becomes aware of.

6. Subscription, Billing, and Fees

The App is offered on subscription tiers (currently: Free, Starter, Growth, Scale) with differing screening allowances, evidence-record availability, and AI-action caps, as described on the App's pricing page within the Shopify App Store listing.

All billing is conducted exclusively through the Shopify Billing API. MatchAudit does not separately invoice Merchants for the App's use. Subscription charges and usage-based overage charges (screening overage, bulk backfill, manual rescan, and evidence exports beyond the included allowance) are processed and collected by Shopify on MatchAudit's behalf, subject to the capped amounts the Merchant approves at subscription creation.

• Usage-based charges will not exceed the capped amount approved by the Merchant for the relevant billing period without a fresh approval.
• Included screening, export, and AI allowances reset on the first day of each UTC calendar month; Shopify's approved usage cap follows Shopify's own billing cycle, which may have different start and end dates.
• AI-assisted features in the Evidence records module are subject to a monthly action cap per plan tier. Exceeding the cap blocks further AI assistance for the remainder of the billing period; it never results in a metered overage charge. The Merchant may continue to record decisions manually without AI assistance once the cap is reached.
• Statutory value added tax and other applicable taxes are handled through the Shopify Billing API in accordance with Shopify's own tax administration for App Store subscriptions.
• Uninstalling the App ends future access but does not reverse charges validly incurred before uninstallation. Cancellation, proration, refunds, and billing disputes are administered through Shopify's billing process and mandatory law.

7. Acceptable Use

The Merchant shall use the App only in compliance with applicable law, these Terms, Shopify's own Merchant and Acceptable Use policies, and any applicable App documentation.

The Merchant shall not, and shall ensure its Authorized Users do not:

• use the App for unlawful, fraudulent, deceptive, or abusive purposes;
• use the App to facilitate sanctions evasion, export-control evasion, money laundering, terrorist financing, or other illegal conduct;
• process Shop Data the Merchant is not lawfully permitted to process, transfer, or disclose;
• reverse engineer, decompile, disassemble, scrape, or attempt to derive source code or underlying components of the App except to the limited extent mandatory law requires such right;
• use the App to build or train a competing service;
• interfere with the integrity, availability, or security of the App or related systems;
• circumvent purchased limits, access controls, or security measures.

8. Data Protection and GDPR Allocation

As between the parties, the Merchant determines whether, to what extent, and for which purposes Shop Data, including Personal Data, is processed through the App for screening and evidence-recording purposes, by virtue of installing and configuring the App and authorizing its access to the Shop.

To the extent MatchAudit processes Shop Data containing Personal Data on behalf of the Merchant in order to provide the App, MatchAudit acts as processor and the Merchant acts as controller within the meaning of the GDPR.

• The Merchant is solely responsible for ensuring that it has a valid legal basis for the collection and processing of its customers' data, including the data received and processed by the App.
• The Merchant is responsible for its own end-customer privacy notices and for handling data subject rights requests, except where the App's Shopify privacy-compliance webhook handling (Section 9) applies.
• Where required by law, the parties enter into the DPA before the relevant processing begins; installing the App and accepting these Terms constitutes agreement to the DPA.

MatchAudit may act as an independent controller for its own account administration, billing records held for its own legal obligations, fraud prevention, abuse prevention, App security, and compliance with MatchAudit's own legal obligations.

MatchAudit does not sell Shop Data, use it for cross-context behavioral advertising, or use Customer Data obtained through Shopify to train generalized artificial-intelligence or machine-learning models. MatchAudit uses Shop Data only to provide, secure, support, and legally operate the App, except where Shopify and the Merchant provide any additional authorization required by applicable law and Shopify's terms.

9. Shopify Privacy-Compliance Webhooks and Data Subject Requests

The App implements Shopify's three mandatory privacy-compliance webhook topics (customers/data_request, customers/redact, shop/redact). Shopify sends shop/redact after the post-uninstallation waiting period defined by Shopify. MatchAudit completes an authenticated request within the period required by applicable law and Shopify, subject to documented legal-retention obligations, as described in the DPA.

10. Merchant Responsibility for Compliance Decisions

The Merchant is solely responsible for all compliance, fulfillment, shipping, and other legal or operational decisions made in reliance on or in connection with the App and any Output.

• The Merchant must independently review and verify all possible matches and other Output before deciding how to proceed with a held order.
• The Merchant remains solely responsible for determining whether a customer, order, or shipment is prohibited, restricted, or otherwise requires escalation.
• The Merchant must apply its own risk-based procedures and human review for every screening outcome the App surfaces.

11. Screening Results Disclaimer

The App and all Output are provided solely as informational and technical support tools.

MatchAudit does not provide legal advice, regulatory advice, export-control advice, tax advice, or other professional advice through the App.

Output may identify possible matches or risk indicators. Output does not constitute a legal or regulatory determination, a clearance, or a conclusion that a customer or order is or is not sanctioned or otherwise restricted. A Fulfillment Hold is not, and must not be represented to the Shop's end customer as, a legal or regulatory finding.

The Merchant must make its own independent assessment and, where appropriate, obtain advice from qualified legal counsel.

12. Third-Party Data Sources and No Accuracy Guarantee

The App relies in whole or in part on Sanctions Data obtained from public authorities and supranational bodies, and on order and customer data made available by the Shopify platform via the Shopify Admin API and webhooks or supplied by the Merchant through the historical-record CSV upload.

MatchAudit does not control third-party data sources, including the Shopify platform itself, and does not guarantee that such data is accurate, complete, current, or available without interruption.

The Merchant acknowledges that compliance screening inherently involves false positives, false negatives, transliteration issues, missing identifiers, and source-data inconsistencies.

13. Availability and Warranty Disclaimer

To the maximum extent permitted by law, the App is provided on an "as is" and "as available" basis.

MatchAudit disclaims all warranties, whether express, implied, statutory, or otherwise, including any implied warranties of merchantability, fitness for a particular purpose, or non-infringement.

MatchAudit does not warrant that the App will be uninterrupted or error-free, that every relevant sanctions match will be detected, that every potential match will be correct, or that the App will satisfy all of the Merchant's legal or regulatory requirements.

No uptime, response time, or support-level commitment applies unless expressly agreed in a separate written agreement.

14. Export Control and Sanctions Compliance

The Merchant shall not use the App in any manner that violates applicable sanctions, export-control laws, embargoes, or trade restrictions, and shall not use the App to conceal or facilitate sanctions or export-control evasion.

MatchAudit may refuse, suspend, or terminate access where MatchAudit reasonably believes that continued provision of the App may violate applicable law or create material legal or compliance risk for MatchAudit.

15. Confidentiality

Each party shall keep confidential all non-public information disclosed by the other party that is designated as confidential or that a reasonable business recipient would regard as confidential given its nature and the circumstances of disclosure ("Confidential Information"), and shall use it only for the purposes of performing these Terms.

16. Intellectual Property

MatchAudit and its licensors retain all right, title, and interest in and to the App, software, interfaces, workflows, logic, documentation, and related intellectual property rights.

Subject to these Terms and payment of applicable fees, MatchAudit grants the Merchant a limited, non-exclusive, non-transferable right during the subscription term to access and use the App for the Merchant's internal business purposes in connection with its Shop.

The Merchant retains rights in Shop Data. The Merchant grants MatchAudit only the rights necessary to receive, host, process, and use Shop Data to provide, secure, maintain, support, and legally operate the App. Product improvement may use service telemetry and aggregated or de-identified information that cannot reasonably identify a Merchant or Customer; it does not authorize generalized model training on Shop Data.

17. Suspension and Termination

MatchAudit may suspend or restrict access to the App immediately, in whole or in part, if the Merchant materially breaches these Terms or applicable law, if continued access creates a security, legal, sanctions, export-control, or data protection risk, if MatchAudit is required to do so by law or by Shopify, or if the Merchant's use may materially impair the App or the rights of others.

The Merchant may terminate use of the App at any time by uninstalling it from the Shopify admin. Uninstallation triggers MatchAudit's app/uninstalled handling and the retention/erasure timeline described in the DPA.

18. Effect of Termination

Upon termination, the Merchant's right to access and use the App ends immediately except to the extent expressly agreed otherwise.

Subject to legal obligations and the retention timeline described in the DPA, MatchAudit will delete or render inaccessible Shop Data after the applicable grace period following uninstallation. The Merchant is responsible for exporting any evidence records or Output it requires before uninstalling the App.

Provisions which by their nature are intended to survive termination, including confidentiality, intellectual property, indemnification, limitation of liability, governing law, and jurisdiction, survive termination of these Terms.

19. Indemnification

The Merchant shall indemnify and hold harmless MatchAudit, its affiliates, directors, officers, employees, and contractors from and against third-party claims, fines, penalties, losses, damages, and reasonable legal fees arising out of or related to the Merchant's or an Authorized User's breach of these Terms, the Merchant's Shop Data (including allegations that its processing violates data protection law), the Merchant's fulfillment, shipping, or compliance decisions, or misuse of the App.

20. Limitation of Liability

Nothing in these Terms excludes or limits liability to the extent such exclusion or limitation is prohibited by mandatory law, in particular for intent, gross negligence, injury to life, body, or health, fraud, liability under the German Product Liability Act, or any liability that cannot lawfully be excluded or limited.

Subject to the paragraph above, MatchAudit shall be liable for slight negligence only in the event of a breach of obligations whose performance is essential for providing the App in its basic agreed form and on whose performance the Merchant may regularly rely. In such case, liability is limited to foreseeable damage typical for this type of contract.

Subject to the mandatory-law carve-outs above, MatchAudit shall not be liable for indirect, incidental, special, punitive, or consequential damages, or for loss of profits, revenue, business opportunities, or data, or for shipping delays, missed delivery windows, end-customer disputes, business interruption, regulatory investigations, fines, or penalties resulting from a Fulfillment Hold or the Merchant's review of it.

Subject to the mandatory-law carve-outs above, MatchAudit shall in particular not be liable for missed sanctions matches, false positives, delayed sanctions-list updates, source-data errors, or the Merchant's failure to independently review and verify Output.

Subject to the mandatory-law carve-outs above, MatchAudit's aggregate liability arising out of or in connection with these Terms shall not exceed the total fees actually paid by the Merchant for the App during the twelve months preceding the event giving rise to the claim, and shall not exceed EUR 100 for use on the Free plan.

21. Force Majeure

MatchAudit shall not be liable for delay, non-performance, or unavailability caused by events beyond its reasonable control, including governmental action, sanctions, cyberattacks, failures of hosting or infrastructure providers, or unavailability or changes to the Shopify platform itself.

22. Changes to the App and Terms

MatchAudit may update, improve, or modify the App from time to time. MatchAudit may amend these Terms where required due to changes in law, Shopify's own requirements, security needs, or product development. Material changes will be notified by email, in-app notice, or another reasonable method, and become effective no earlier than thirty days after notice unless a shorter period is required for legal or security reasons.

23. Governing Law and Jurisdiction

These Terms shall be governed by the laws of the Federal Republic of Germany, excluding its conflict-of-laws rules and the CISG. To the extent permitted by law, the exclusive place of jurisdiction for disputes arising out of or in connection with these Terms shall be the registered seat of MatchAudit in Germany.

This clause governs the relationship between the Merchant and MatchAudit only; it does not affect the separate agreement between the Merchant and Shopify governing the Shopify platform itself.

24. Contact

MatchAudit UG (haftungsbeschränkt) Turmstrasse 7, 65611 Brechen, Germany Managing Director: Emmi Jose Commercial register: Amtsgericht Limburg a.d. Lahn, HRB 7665

Legal and contractual inquiries: info@matchaudit.io