Privacy Policy for PromoKIT

Last Updated: June 2026

Introduction

This Privacy Policy describes how PromoKIT ("we", "our", or "us") collects, uses, and protects information when you use our Shopify application (the "App"). PromoKIT is a headless-first discounts and loyalty layer for Shopify: it lets merchants create discount campaigns and loyalty programs in the Shopify admin and expose them to their own storefront through a public API. We are committed to protecting your privacy and ensuring transparency about our data practices.

Information We Collect

1. Shop Information

When you install and use PromoKIT, we collect:

  • Store domain and name
  • Store owner name, email address, and locale
  • Shopify plan and subscription details
  • OAuth access and refresh tokens used to authenticate API calls

2. Discount and Campaign Data

To create and manage your promotions, we store the campaigns you configure:

  • Campaign names, status, and type (code, automatic, or loyalty card)
  • Discount values, rules, and minimum order thresholds
  • Discount codes and usage limits
  • Targeted product and collection identifiers (GIDs)
  • Start/end dates and combination settings
  • References to the Shopify discounts created on your behalf

3. Loyalty and Customer Data

To power loyalty cards and eligibility rules, we access and store:

  • Loyalty card definitions and descriptions
  • Customer segment identifiers used for eligibility
  • Identifiers of specific customers you assign to a loyalty card
  • Audience criteria such as customer tags, minimum amount spent, and minimum number of orders

Customer eligibility is evaluated natively by Shopify. We store customer and segment identifiers only as needed to map your loyalty audiences; we do not collect customer payment details, addresses, or contact information.

4. Order Data (Anonymous)

To analyze sales performance and generate product, bundle, and discount suggestions, we synchronize your order history in anonymous form:

  • Order totals, subtotals, discounts, and currency
  • Financial and fulfillment status
  • Order line items (product, variant, SKU, quantity, price)
  • Applied discount codes and order tags
  • Order processing and cancellation dates

This order history contains no customer-identifying information. We do not store any link between an order and a customer, nor any customer personal data within it.

5. Subscription Data

For billing and feature access management:

  • Active subscription status and plan tier
  • Plan name and entitlements
  • Trial period information

6. API Access Data

Because PromoKIT exposes a public API for your headless storefront, we store:

  • API keys you generate to authenticate storefront requests
  • Key creation and revocation timestamps
  • Request metadata used for rate limiting and abuse prevention

How We Use Your Information

We use the collected information to:

1. Provide Core Services

  • Create and maintain discount campaigns and loyalty programs in your Shopify store
  • Serve your active promotions and loyalty cards to your storefront through our public API
  • Validate discount codes and loyalty eligibility at the point of use
  • Keep your campaigns synchronized with Shopify discounts

2. Generate Insights

  • Analyze anonymous order history to surface product, bundle, and discount suggestions
  • Measure the performance of your promotions

3. Maintain and Improve the App

  • Monitor app performance and reliability
  • Debug technical issues
  • Enforce API rate limits and prevent abuse
  • Develop new features and functionality

4. Billing and Subscription Management

  • Process subscription payments through Shopify
  • Manage trial periods and plan upgrades
  • Enforce plan limits and entitlements

5. Communication

  • Send service-related notifications
  • Provide customer support
  • Respond to your inquiries

Data Storage and Security

Storage

  • All data is stored securely in encrypted PostgreSQL databases
  • Data is stored on secure servers with restricted access
  • Order history is imported via Shopify Bulk Operations and kept anonymous

Security Measures

  • All data transmission is encrypted using SSL/TLS
  • Authentication is handled through Shopify's OAuth system
  • Public API requests are authenticated with merchant-issued API keys and rate limited
  • Access to your data is restricted to authorized personnel only
  • We implement regular security updates and database backups

Data Retention

  • Campaign, loyalty, and configuration data is retained as long as the App is installed
  • Anonymous order history is retained to power insights while the App is installed
  • Upon app uninstallation, your data is retained for 30 days to facilitate reinstallation, after which it is deleted
  • We honor Shopify's mandatory data redaction webhooks (see below)
  • You may request complete data deletion at any time

Data Sharing and Disclosure

We do not sell, trade, or rent your data to third parties. We may share your information only in the following circumstances:

  1. With Shopify: As required by the Shopify App Store agreement and for authentication and billing purposes
  2. Service Providers: With trusted third-party service providers who assist in operating our App (hosting, infrastructure, support) under strict confidentiality agreements
  3. Legal Requirements: When required by law, court order, or government regulation
  4. Business Transfers: In connection with a merger, acquisition, or sale of assets (with advance notice to users)

Your Rights and Choices

You have the right to:

  1. Access Your Data: Request a copy of the data we hold about you
  2. Correct Your Data: Request correction of inaccurate or incomplete data
  3. Delete Your Data: Request deletion of your data at any time
  4. Data Portability: Request your data in a machine-readable format
  5. Withdraw Consent: Uninstall the App to stop data collection
  6. Object to Processing: Object to specific data processing activities

To exercise these rights, please contact us at the email address provided below.

Shopify Integration

PromoKIT is a Shopify App and operates within Shopify's ecosystem:

  • We access your store data through Shopify's Admin API
  • We create discounts using Shopify's discount and Shopify Functions APIs
  • We comply with Shopify's App Store requirements and policies
  • Authentication and authorization are managed by Shopify
  • Subscription billing is processed through Shopify's billing system

For more information about Shopify's data practices, please review Shopify's Privacy Policy.

Protected Customer Data

PromoKIT handles customer-related data (such as customer and segment identifiers used for loyalty eligibility) in accordance with Shopify's Protected Customer Data requirements. We process this data only to the extent necessary to provide loyalty functionality, we minimize what we store, and we do not use it for advertising or sell it to third parties.

API Scopes and Permissions

PromoKIT requests the following Shopify API scopes:

  • read_discounts / write_discounts: To create and manage discount campaigns
  • read_customers / write_customers: To manage loyalty audiences and customer segments
  • read_orders / read_all_orders: To synchronize anonymous order history for insights

We only request permissions necessary for core App functionality.

Webhooks

We subscribe to the following Shopify webhooks to keep data synchronized and to comply with mandatory privacy obligations:

  • app/uninstalled: To handle app uninstallation and data cleanup
  • app_subscriptions/update: To manage billing and subscriptions
  • orders/create, orders/updated, orders/paid, orders/cancelled, orders/delete: To keep anonymous order history in sync
  • discounts/delete: To detect discounts removed in Shopify
  • customers/data_request, customers/redact, shop/redact: Shopify's mandatory GDPR/compliance webhooks for data access and deletion requests

International Data Transfers

Your data may be transferred to and processed in countries other than your country of residence. We ensure appropriate safeguards are in place to protect your data in accordance with this Privacy Policy.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by:

  • Updating the "Last Updated" date at the top of this policy
  • Sending a notification through the App or email
  • Posting a notice in the Shopify App Store listing

Your continued use of PromoKIT after changes become effective constitutes acceptance of the updated Privacy Policy.

Cookies and Tracking

PromoKIT uses minimal cookies for:

  • Session management and authentication within the Shopify admin
  • Maintaining your logged-in state

We do not use third-party tracking cookies or advertising cookies.

Data Protection Officer

For GDPR-related inquiries, you may contact our Data Protection Officer at the email address provided below.

Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Email: [email protected]

For urgent privacy concerns, please mark your email subject line with "PRIVACY REQUEST" for priority handling.

Compliance

We are committed to complying with applicable data protection laws, including:

  • General Data Protection Regulation (GDPR) - European Union
  • California Consumer Privacy Act (CCPA) - United States
  • Personal Information Protection and Electronic Documents Act (PIPEDA) - Canada
  • Other applicable regional data protection regulations

By using PromoKIT, you acknowledge that you have read and understood this Privacy Policy and agree to its terms.