Privacy Policy

Last updated: July 2, 2026

Promptly ("we", "our", "us") is a Shopify application that helps merchants capture email and SMS subscribers through popup experiences. This privacy policy explains how we collect, use, and protect information.

1. Information We Collect

When a merchant installs Promptly, we access limited Shopify store data as authorized through the Shopify OAuth process. This includes:

• Store information: Shop name, domain, and plan type
• Session data: Authentication tokens to keep you signed in
• Popup analytics: Aggregated impression and conversion counts
• Visitor identifiers: Anonymous visitor IDs (randomly generated, not personally identifiable), stored in the browser's localStorage together with a visit counter
• Visit context: Device type, browser language, country, page URL, and UTM campaign parameters, used to decide which popups to show
• Customer tags: If a merchant configures tag-based targeting, the Shopify customer tags of the logged-in customer are read in the storefront and used transiently to filter popups; they are not stored by Promptly
• Subscriber data: Email addresses and phone numbers submitted through popups, together with the consent choice made at submission

2. How We Use Information

• To provide and operate the Promptly popup service
• To run A/B tests and optimize popup performance
• To display analytics and conversion data to merchants
• To process subscriber data as directed by the merchant
• Shopify customer records: When a visitor signs up and grants marketing consent, and the merchant has enabled this in settings, we create or update a Shopify customer record on the merchant's store with the submitted email and/or phone and the corresponding email/SMS marketing consent state (tagged "Promptly"). This is done only with the shopper's consent and can be disabled by the merchant at any time.

3. Data Sharing

We do not sell, rent, or share personal data with third parties for their marketing purposes. Data may be shared with:

• Shopify: As required by the Shopify platform
• Hosting providers: Our infrastructure providers (Cloudflare, and our database host) process data on our behalf
• Integrations: If a merchant connects a third-party service (e.g., Klaviyo, Mailchimp, Omnisend), subscriber data is sent to that service as configured by the merchant, and only when the shopper has given the consent configured for that popup

4. Data Retention

We retain merchant and subscriber data for as long as the app is installed, or for a shorter retention window the merchant selects in the app's settings (90 days to 2 years) — older subscriber and analytics records are then permanently deleted by an automated daily process. When a merchant uninstalls the app, or on a shop data-erasure request, we delete all associated store data within 30 days (the app's data-erasure webhook deletes it promptly on receipt, and an automated backstop purges any store that remains uninstalled). On an individual customer erasure request we erase that customer's personal data and instruct the merchant's connected marketing platforms to do the same. Aggregated, anonymized analytics data may be retained. Merchants can also disable Shopify customer sync at any time in the app settings.

5. Data Security

We use industry-standard security measures including encrypted connections (TLS/SSL), encryption of data at rest and of backups, secure authentication via Shopify OAuth, AES-256 application-layer encryption of stored credentials and of subscriber contact details (email addresses and phone numbers), least-privilege access, separation of test and production environments, and an auditable log of access to personal data. Full detail is in our Security & Incident Response Policy. Our data-processing terms with merchants are set out in our Data Processing Agreement.

6. GDPR and Data Rights

We comply with GDPR and respond to data access, correction, and deletion requests. Merchants and their customers can contact us to exercise their data rights. We support Shopify's mandatory GDPR webhooks for customer data requests, customer data erasure, and shop data erasure. If we become aware of a personal data breach, we notify affected merchants without undue delay (see our Security & Incident Response Policy).

7. Cookies

Promptly uses session cookies for authentication within the Shopify admin. Our storefront widget uses a localStorage identifier to track anonymous visitor sessions for popup targeting. No third-party tracking cookies are used.

8. Changes to This Policy

We may update this privacy policy from time to time. Changes will be posted on this page with an updated date.

9. Contact

If you have questions about this privacy policy or your data, contact us at: support@promptlyapp.co