Privacy Policy

1. Information We Collect

1.1 Information from Shopify

When you install our app, we receive the following information from Shopify:

• Shop domain and store information
• Store owner email address
• Product, collection, and pricing data (as necessary for discount functionality)
• Customer IDs, only when you choose specific customers or a customer segment for a promotion. Promotions created before September 2026 may also hold those customers' names and email addresses.
• For orders that used a promotion: the order ID, totals, discount amount and number of discounted items (for analytics). We don't store customer names, contact details or addresses from orders.

1.2 Information You Provide

• Discount configurations and rules you create
• App settings and preferences
• Support communications and feedback
• Promotion descriptions you type into "Describe your offer". They are matched to a recipe inside the app and are not sent to any AI provider or other third party. Do not include customer personal information or credentials. Descriptions we could not match may be retained for product improvement, with obvious contact details removed. A daily count is kept to enforce the usage limit. These records are deleted when the shop's data is redacted.

1.3 Automatically Collected Information

• Usage analytics (discount performance, feature usage)
• Technical information (browser type, IP address, device information)
• Log data (access times, errors, system events)

2. How We Use Your Information

We process your personal data for the following purposes:

• Service Provision: To operate and provide the discount functionality you've requested
• Analytics: To provide discount performance insights and optimize app functionality
• Customer Support: To respond to your inquiries and provide technical assistance
• Billing: To process subscription payments through Shopify's billing system
• Security: To detect, prevent, and address technical issues and fraudulent activity
• Legal Compliance: To comply with applicable laws, regulations, and legal processes

3. Legal Basis for Processing (GDPR)

Under GDPR, we process your personal data based on the following legal grounds:

• Contract Performance: Processing necessary to provide our services as per our Terms of Service
• Legitimate Interests: To improve our services, prevent fraud, and ensure security
• Consent: Where you have given explicit consent for specific processing activities
• Legal Obligation: To comply with legal requirements and respond to lawful requests

4. Data Sharing and Disclosure

We do not sell your personal data. We may share information with:

• Shopify: As required for app functionality and billing
• Cloudflare: Hosts the app and its database (stored in Western Europe)
• Google Analytics: Used on our public website only, after the visitor consents; never inside the Shopify admin
• Legal Requirements: When required by law, court order, or to protect our rights

All third-party service providers are contractually obligated to maintain data security and confidentiality.

5. Your Rights Under GDPR

You have the following rights regarding your personal data:

• Right to Access: Request a copy of your personal data we hold
• Right to Rectification: Request correction of inaccurate or incomplete data
• Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data
• Right to Restrict Processing: Request limitation of how we use your data
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent

To exercise these rights, please contact us at privacy@nolimitsolutions.co.uk

6. GDPR Compliance Webhooks

We have implemented mandatory GDPR compliance webhooks:

• customers/data_request: We compile the data we hold about that customer (promotion targeting and discounted orders) and send it to the store owner within 30 days
• customers/redact: When Shopify sends the request, we remove the customer from promotion targeting and delete the analytics records for the orders Shopify lists
• shop/redact: When Shopify sends the request, 48 hours after uninstallation, we delete all of the shop's data

7. Data Retention

We retain your data only as long as necessary:

• Active Users: While you have an active subscription
• Post-Uninstall: Up to 48 hours after app uninstallation (for shop data)
• Legal Requirements: As required by law or to resolve disputes
• Anonymized Analytics: Aggregated, anonymized data may be retained indefinitely for research and improvement purposes

8. Data Security

We implement industry-standard security measures to protect your data:

• Encryption in transit (HTTPS/TLS)
• Encryption at rest (Cloudflare D1)
• Shopify access tokens that expire after one hour and rotate
• Operator access protected by Cloudflare Access
• HMAC verification for all webhook communications

9. International Data Transfers

Your data may be transferred to and processed in countries outside the European Economic Area (EEA). When we transfer data internationally, we ensure appropriate safeguards are in place, such as:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions by the European Commission
• Other legally approved transfer mechanisms

10. Cookies and Tracking

Our app uses minimal cookies and tracking technologies:

• Essential Cookies: Required for app functionality and authentication
• Analytics Cookies: To understand how you use our app (with your consent)

You can control cookie preferences through your browser settings.

11. Children's Privacy

Our service is not directed to individuals under 16 years of age. We do not knowingly collect personal data from children. If we become aware of such collection, we will delete the data immediately.

12. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements. We will notify you of material changes via email or through the app. Continued use of the app after changes constitutes acceptance of the updated policy.

13. Contact Us

For privacy-related questions, concerns, or to exercise your rights:

14. Supervisory Authority

If you believe we have not addressed your privacy concerns adequately, you have the right to lodge a complaint with your local data protection authority:

• UK: Information Commissioner's Office (ICO) - ico.org.uk
• EU: Your national data protection authority