Privacy Policy

1. Scope and Our Role

1.1 Controller. We act as a "controller" (or equivalent) of personal data when we determine the purposes and means of processing, including: (a) information about merchants and their personnel who install or use the Services; (b) visitors to our website; and (c) data used for our own marketing, billing, support, security, and product-improvement purposes.

1.2 Processor. When we process personal data of a merchant's end users and store visitors on behalf of, and under the instructions of, the merchant, we act as a "processor" (or "service provider"). For that processing, the merchant is the controller/business, the merchant's own privacy policy governs, and our obligations are set out in our Data Processing Addendum ("DPA"). This Privacy Policy does not replace the merchant's privacy notice to its end users.

1.3 This Policy primarily describes our processing as a controller. Where we act as a processor, please refer to the DPA.

2. Personal Data We Collect

2.4 Special categories. We do not intentionally collect special categories of personal data (e.g., health, biometric, or political data) unless explicitly instructed by a merchant in its capacity as controller.

3. How We Use Personal Data and Legal Bases

As a controller, we use personal data to:

• Provide, operate, maintain, secure, and improve the Services and our website (legal basis: performance of a contract; legitimate interests).
• Process billing and manage accounts (performance of a contract; legal obligation).
• Provide customer support and communicate Service-related notices (performance of a contract; legitimate interests).
• Send marketing communications where permitted, with the ability to opt out (consent or legitimate interests).
• Detect, prevent, and address fraud, abuse, and security incidents (legitimate interests; legal obligation).
• Comply with legal obligations and enforce our agreements (legal obligation; legitimate interests).
• Create and use anonymized and aggregated data that does not identify any individual, to operate and improve our products (legitimate interests).

Where we rely on consent, you may withdraw it at any time. Where we rely on legitimate interests, you may object as described in Section 7.

4. How We Share Personal Data

4.1 Service providers / sub-processors. We share personal data with third-party vendors that help us provide the Services (for example, cloud hosting, email delivery, support tooling, and product analytics). These parties are bound by contractual obligations to protect personal data and to process it only as instructed. Our current sub-processors are maintained and made available to merchants in accordance with the DPA.

4.2 Hosting. Our Services are hosted on infrastructure provided by our cloud and server provider, Leaseweb (Leaseweb Global B.V. and its affiliates).

4.3 Platform and integrations. Where you configure integrations (such as Shopify, Google, Meta, or TikTok), data is transmitted to those platforms according to your configuration and their own terms.

4.4 Legal and corporate. We may disclose personal data where required by law, to protect rights and safety, or in connection with a merger, acquisition, or sale of assets.

4.5 No sale of personal information. We do not sell or "share" (as those terms are defined under U.S. privacy laws, including the CCPA) personal data for monetary or other valuable consideration.

5. International Data Transfers

We and our sub-processors may process personal data in countries other than your own. Where personal data is transferred internationally, we implement appropriate safeguards consistent with applicable data protection law, including contractual data protection obligations with our sub-processors and the technical and organizational measures described in the DPA. Where required, we comply with cross-border transfer obligations under applicable law, including Vietnam's Personal Data Protection Decree (Decree No. 13/2023/ND-CP).

6. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including providing the Services, complying with legal obligations, resolving disputes, and enforcing our agreements. Merchant account data is retained for the duration of the service relationship; end-user data is retained as configured by the merchant and in accordance with the DPA. We may retain limited data in backups, audit logs, or for fraud-prevention and security purposes, after which it is securely deleted or anonymized.

7. Your Rights

7.1 Depending on your location, you may have rights to: access; rectify; erase; restrict or object to processing; data portability; and withdraw consent. Under U.S. state privacy laws, you may have rights to know/access, delete, correct, opt out of sale/sharing, and limit the use of sensitive personal information, and not to be discriminated against for exercising these rights.

7.2 If you are a merchant's end user, please direct your request to the relevant merchant (the controller). If we receive such a request directly, we will refer it to the merchant in accordance with the DPA.

7.3 To exercise rights relating to data for which we are the controller, contact us at [email protected]. We may need to verify your identity before responding. You also have the right to lodge a complaint with a competent supervisory authority.

8. Security

We implement appropriate technical and organizational measures to protect personal data, including encryption in transit (TLS 1.2+) and at rest (AES-256), access controls, pseudonymization of identifiers, monitoring, and personnel confidentiality obligations. Further detail is set out in the DPA. No method of transmission or storage is completely secure, and you are responsible for safeguarding your account credentials.

9. Cookies and Similar Technologies

Our Services and website use cookies and similar technologies (such as local and session storage) to operate, secure, and improve the Services and, where applicable, to support analytics and marketing integrations configured by merchants. Where the Services place such technologies on a merchant's storefront, the merchant is responsible for configuring consent appropriately. You can manage cookies through your browser settings.

10. Children's Privacy

The Services are intended for businesses and are not directed to children. We do not knowingly collect personal data directly from children. Merchants are responsible for ensuring their own compliance with applicable children's privacy laws.

11. Shopify Data

As a Shopify application, we access and process certain data through the Shopify platform in accordance with Shopify's policies and the permissions you grant. We honor Shopify's mandatory privacy/compliance webhooks (including data access and deletion requests) as described in the DPA.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will provide notice of material changes by email or through a prominent notice within the Services or on our website. Your continued use of the Services after an update takes effect constitutes acceptance of the updated Policy.

13. Contact Us