Privacy policy
This policy explains how Appify COD & Upsell (“the App”), provided by Appify Creations, handles information when a Shopify merchant installs or uses the App.
Information we process
The App receives the merchant’s Shopify store domain, installation authorization, granted scopes, and technical session information needed to authenticate the merchant and provide the service. Shopify session records can include limited staff-account identifiers, such as a user ID, name, email address, locale, and account role.
The customer form and order workflows can process buyer names, email addresses, phone numbers, shipping and billing addresses, cart items, order contents, and form responses. The App can retain abandoned form submissions, order identifiers, attribution data, fraud-prevention identifiers, verification records, and messaging records to operate the features enabled by the merchant. The App does not request card numbers or other payment credentials in its customer form.
If a merchant contacts support, we process the email address, store identifier, problem description, and any screenshot the merchant chooses to send. Merchants are asked not to include passwords, payment credentials, or customer personal data.
How information is used
We use this information to authenticate the store, display and configure the customer form, create and manage Shopify COD draft orders and orders, show offers, calculate order totals, prevent abuse, and troubleshoot service errors. Depending on merchant settings and available integrations, the App also uses it for abandoned-order recovery, phone verification, order notifications, analytics, and order exports. Configuration and workflow records are stored by the App; relevant order data is sent to Shopify.
Shopify and service providers
Shopify hosts the merchant’s store and Admin and receives draft orders and orders created through its APIs. The App’s web service is hosted by Fly.io. When an integration is configured and used, relevant information can also be sent to its provider: for example, contact and message data to Twilio, order and opted-in abandoned-form data to a merchant’s Google Sheet, opted-in abandoned checkout events to a connected Klaviyo or Omnisend account, address queries to Google Places, or notification and customer access reports to the configured email service. Analytics destinations depend on the merchant’s tracking configuration. The availability of an integration does not mean it is enabled for every store.
Retention and deletion
Installation sessions are retained while the App is installed and are deleted when Shopify notifies us that the App was uninstalled. Other App-held configuration and customer workflow records can remain until the applicable cleanup or redaction runs. The App authenticates Shopify’s mandatory privacy webhooks and implements customer-data export, customer redaction, and shop redaction handlers. Copies retained in Shopify or a merchant-controlled third-party service may require management in that service, particularly after the App loses access to it.
Your choices and rights
Merchants can change the enabled features and integrations in the App and uninstall it from Shopify Admin. Customer access or deletion requests submitted through Shopify can include App-held form, abandoned-order, order, verification, or messaging records. Contact us for help with information held by the App or a privacy request.
Security and changes
We use access controls, HTTPS, signed Shopify requests, and data minimization to protect the service. We may update this policy when the App or legal requirements change; the effective date above will be revised.
Contact
Privacy and support requests can be sent to creationsappify@gmail.com.