Privacy Policy
Last updated: July 15, 2026
1. Information We Collect
To provide our loyalty, rewards, and review services, we collect and process customer and merchant data when the app is installed on a Shopify store:
- Customer Profile Data: We request access to customer details such as Name and Email addresses. We specifically do not collect or request phone numbers or physical addresses to ensure maximum data privacy compliance.
- Purchase Data: We access order information (such as product ID, quantity, and purchase amounts) to calculate loyalty points and trigger review invitations.
- Review Content: We store customer reviews, star ratings, and uploaded media files (such as photo/video reviews) to showcase on your storefront.
2. How We Use Your Data
We process this information strictly to perform the contract with merchants and deliver services:
- Managing loyalty accounts, tracking lifetime customer points, and generating discount reward codes.
- Sending automated review request reminders and loyalty notification emails.
- Displaying user-generated reviews, media, and badges on your Shopify storefront.
- Syncing event data to connected third-party integrations (e.g. Klaviyo and Mailchimp) as authorized by the merchant.
3. Data Sharing and Third Parties
We do not sell, rent, or trade your personal data. We share customer data only with trusted service providers essential to app operations:
- Cloudflare R2: Used as our content delivery network to securely host review images and videos.
- PostgreSQL: Used for secure, encrypted transactional database storage.
- Nodemailer / SMTP Gateways: Used solely to dispatch transactional notifications if direct mail sending is enabled.
4. GDPR & CCPA Compliance
We fully support data protection rights. Customers or merchants can contact us to request access, correction, transfer, or deletion of their personal information. When a merchant explicitly requests deletion, we purge all store customer profile data, in strict accordance with Shopify's mandatory privacy webhooks (Customer Data Erasure, Shop Data Erasure, and Customer Data Request). To preserve merchant SEO and product ratings, deleted customer reviews are not removed but are fully anonymized by stripping all personally identifiable information (PII) such as names and email addresses.
Security Assurance: All data in transit is encrypted using standard TLS 1.3, and database records at rest are secured using AES-256 encryption. We enforce strict access control to prevent unauthorized data access.