M9: Data ownership receipts — export, deletion, audit log endpoints (the launch frame as code)

[ninan-versioning]

Milestone 9 — Data Ownership Surface

Vertical: enterprise
Revenue-Signal: retention
Customer-Type: all

What

Realise the "Autopilot gives Shopify your customer data forever. Shoploop keeps it in your stack" launch frame (see launch ticket #6) as actual code. Three endpoints — export, deletion, audit log — and a merchant-facing receipts page that proves the claim.

Scope

• GET /data/export — returns a signed zip: brand_rules history, all rendered assets, all signal payloads, full Thompson Sampling state
• DELETE /data/all — irreversible purge, triggers GDPR/CCPA-style workflow, confirmation email + 7-day soft-delete window
• GET /data/audit — append-only log of every read/write/share of merchant data; queryable by date + actor
• Merchant-facing Receipts page in admin: "Last week, Shoploop accessed your data N times for these reasons" — humanised audit log
• Zero-retention claim: signals beyond 18 months auto-purge, surfaced in receipts page
• No data ever leaves merchant's AWS region (region-pinned bucket per tenant)

Why

The Reddit/OSS launch frame is data ownership. Without these endpoints the frame is marketing; with them, it's a feature competitors structurally cannot match (Shopify Autopilot can't promise data leaves their network). Also satisfies GDPR Article 20 + Shopify App Store mandatory webhook handlers.

Acceptance criteria

• Three endpoints live, authenticated, audited
• Receipts page renders in admin extension for Varitea test account
• GDPR mandatory webhooks (customers/data_request, customers/redact, shop/redact) implemented
• One-paragraph claim card on landing page links to live receipts demo

Affected repos

shoploop (primary), shoploop-shopify (admin receipts UI + GDPR webhooks)

Cost

$0 — uses existing LibSQL + S3 footprint.