Privacy Policy
This Privacy Policy explains how PostCore ("we", "us") collects, uses, and protects information in connection with our website and the applications we publish for the Shopify platform, including PostReward (each, an "App"). We are committed to collecting the minimum data necessary to operate our Apps.
Who this applies to
Our Apps are installed by Shopify merchants ("Merchants"). Some App features interact with a Merchant's customers ("Shoppers") at checkout and on the order-status/thank-you page. This policy covers data relating to both Merchants and Shoppers.
Information we collect
- Store information: when a Merchant installs an App, we receive store details provided by Shopify (store domain, plan, contact email) to operate and bill the App.
- Order and checkout data: to generate rewards and next-purchase discount codes, an App may process order confirmation identifiers and related order metadata provided by Shopify at checkout.
- Opt-in contact data: where a Shopper chooses to receive a reward by email or SMS, we process the contact detail they voluntarily provide, solely to deliver that reward and (where the Merchant enables it) to pass it to the Merchant's own marketing tool.
- Usage data: basic, aggregated analytics about App performance (for example, reward reveal and redemption rates) to provide reporting to the Merchant.
How we use information
- To provide, operate, and maintain the App's core functionality.
- To generate and validate discount codes and rewards.
- To deliver Shopper-requested rewards via email or SMS where opted in.
- To provide Merchants with performance reporting.
- To bill for paid plans through the Shopify Billing API.
- To provide support and prevent abuse or fraud.
We do not sell personal information, and we do not use Shopper data for our own advertising.
Sharing and third parties
We share data only as needed to operate the App:
- Shopify, as the platform hosting the Merchant's store and processing billing.
- Infrastructure providers that host our services.
- Merchant-authorized integrations (for example Klaviyo or Omnisend) only when a Merchant explicitly connects them, to sync opt-in contacts the Merchant is entitled to receive.
Data retention
We retain data only as long as necessary to provide the App and to meet legal obligations. When a Merchant uninstalls an App, we delete or anonymize associated store and Shopper data within 30 days, except where retention is required by law. In line with Shopify requirements, we honor the platform's data-erasure and data-access requests (the customers/redact, shop/redact, and customers/data_request webhooks).
Your rights
Depending on your location (including under the GDPR and CCPA), you may have the right to access, correct, or delete personal data, or to object to certain processing. Shoppers should direct requests to the Merchant they purchased from; Merchants and Shoppers may also contact us directly and we will assist.
Security
We use industry-standard measures to protect data in transit and at rest, and we limit access to personal data to what is necessary to operate the App.
Changes to this policy
We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date above.
Contact
For any privacy question or request, contact us at support@postcorehq.com.