Privacy Policy

1. Who we are

Point-based Discount ("the App") is a Shopify application that helps merchants run member loyalty programs, points earning and redemption, and native discount rules. This policy explains how the App processes personal data on behalf of merchants who install it.

2. Scope

The merchant is the data controller for their customers' personal data. We act as a data processor and process customer and shop data only to provide the App's features at the merchant's direction.

3. Data we collect and store

• Shop data: shop domain, plan settings, discount and points rules, membership terms configured by the merchant.
• Customer / member data: Shopify Customer ID, name, email, phone, address, birthday, gender (when provided), points balance, tier, referral relationships, and membership status.
• Transaction data: points ledger entries linked to orders, refunds, campaigns, referrals, lottery entries, and wishlist items.
• Staff session data: OAuth session tokens required to operate the embedded admin app (deleted when the app is uninstalled).

4. How we use data

• Operate loyalty, points, and discount features requested by the merchant.
• Sync balances and entitlements to Shopify metafields and checkout functions.
• Provide merchant admin reporting, member lists, and rule management.
• Respond to mandatory Shopify compliance webhooks.

We do not sell personal data. We do not use customer data for unrelated advertising.

5. Data sharing

Data is shared only as needed to run the App: with Shopify (Admin API, webhooks, checkout functions, theme extensions) and with infrastructure providers that host the application database and servers. Sub-processors are bound by confidentiality and security obligations appropriate to the data processed.

6. Retention

• Member and shop configuration data is kept while the App remains installed.
• When a merchant uninstalls the App, OAuth sessions are removed promptly. Other shop data is deleted after Shopify sends a shop/redact compliance webhook (typically within 48 hours of uninstall).
• When a customer erasure request is received via Shopify customers/redact, we delete matching member records, ledgers, wishlist items, and related lottery history for that customer.

7. Customer rights (GDPR / CPRA)

Through Shopify's compliance webhooks, we support:

• Access / portability: customers/data_request — we assemble stored member and ledger data and make it available to the merchant to fulfill the customer request.
• Erasure: customers/redact and shop/redact — we delete or anonymize data as described above.

End customers should contact the store where they shopped. Merchants may contact us at myloyalties@outlook.com for assistance.

8. Security

We verify Shopify webhook signatures, use HTTPS for data in transit, restrict database access to production services, and apply least-privilege API scopes required for app functionality.

9. International transfers

Data may be processed in countries where our hosting providers operate. We take reasonable steps to protect data regardless of location.

10. Changes

We may update this policy from time to time. Material changes will be reflected on this page with an updated "Last updated" date.

11. Contact

Questions about this policy or data processing: myloyalties@outlook.com