diff --git a/README.md b/README.md
index 8a732f0..e2b9488 100644
--- a/README.md
+++ b/README.md
@@ -38,6 +38,19 @@ runs the BullMQ worker (jobs/worker.ts) once Phase 4 makes it do anything.
 | `npm run test:functions` | Real WASM build + `function-runner` tests for both Shopify Functions, against fixtures |
 | `npm run typegen:functions` | Regenerate `extensions/*/generated/api.ts` from each Function's `schema.graphql` + `.graphql` query (also runs automatically before `npm run typecheck`) |
 
+## Before public launch
+
+The 3 mandatory GDPR compliance webhooks (`customers/data_request`,
+`customers/redact`, `shop/redact`) are commented out in `shopify.app.toml`
+— Shopify refuses to push them until the org requests and is granted
+**Protected customer data access** in the Partner Dashboard (Apps → this
+app → API access → Protected customer data), which is a manual
+questionnaire/approval step. The handlers already exist and are fully
+wired (`app/routes/webhooks.customers.*.tsx`, `webhooks.shop.redact.tsx`) —
+once that access is granted, uncomment the three `[[webhooks.subscriptions]]`
+blocks near the bottom of the webhooks section. **Required before any
+public launch or Built-for-Shopify submission** — don't ship without it.
+
 ## Status
 
 Phase 0 (scaffold & CI) through Phase 4 (enforcement Functions +
diff --git a/shopify.app.toml b/shopify.app.toml
index 6db0785..74ce3ce 100644
--- a/shopify.app.toml
+++ b/shopify.app.toml
@@ -40,21 +40,28 @@ api_version = "2026-10"
   uri = "/webhooks/orders/cancelled"
   topics = ["orders/cancelled"]
 
-  # Mandatory GDPR compliance topics — required for Built-for-Shopify / public app review.
-  # Handled by: app/routes/webhooks.customers.data_request.tsx
-  [[webhooks.subscriptions]]
-  uri = "/webhooks/customers/data_request"
-  compliance_topics = ["customers/data_request"]
+  # Mandatory GDPR compliance topics — required for Built-for-Shopify /
+  # public app review. TEMPORARILY DISABLED: `shopify app dev`/`deploy`
+  # refuses to push these until the org has requested and been granted
+  # "Protected customer data access" in the Partner Dashboard (Apps ->
+  # this app -> API access -> Protected customer data) — that's a manual
+  # questionnaire/approval step, not something the CLI or config can
+  # bypass. RE-ENABLE these three blocks (handlers already exist and are
+  # wired: app/routes/webhooks.customers.data_request.tsx,
+  # webhooks.customers.redact.tsx, webhooks.shop.redact.tsx) once that
+  # access is granted, and before any public launch/BfS submission.
 
-  # Handled by: app/routes/webhooks.customers.redact.tsx
-  [[webhooks.subscriptions]]
-  uri = "/webhooks/customers/redact"
-  compliance_topics = ["customers/redact"]
+  # [[webhooks.subscriptions]]
+  # uri = "/webhooks/customers/data_request"
+  # compliance_topics = ["customers/data_request"]
 
-  # Handled by: app/routes/webhooks.shop.redact.tsx
-  [[webhooks.subscriptions]]
-  uri = "/webhooks/shop/redact"
-  compliance_topics = ["shop/redact"]
+  # [[webhooks.subscriptions]]
+  # uri = "/webhooks/customers/redact"
+  # compliance_topics = ["customers/redact"]
+
+  # [[webhooks.subscriptions]]
+  # uri = "/webhooks/shop/redact"
+  # compliance_topics = ["shop/redact"]
 
 # App proxy so the storefront Theme App Extension can call our backend
 # without CORS issues (see IMPLEMENTATION_PLAN.md §5.3). `shopify app dev`