📋 1. Introduction
RevenueBar ("we", "our", "us") is a Shopify application that helps merchants increase revenue through customizable announcement bars, promotional campaigns, and targeted messaging. This Privacy Policy describes how we collect, use, process, and protect your personal data when you install and use our application.
By installing and using RevenueBar, you agree to the terms outlined in this Privacy Policy. If you do not agree with any part of this policy, please uninstall the app from your Shopify store.
📊 2. Data We Collect
We collect limited data necessary for the app to function properly. Below is a summary of data types we may access or collect:
| Data Type | Purpose | Source |
|---|---|---|
| Shop Information | Identify your store and configure the app | Shopify API |
| Store Domain & Name | Display and manage app settings | Shopify API |
| Product Data | Create promotional campaigns and announcement bars | Shopify API |
| Order Data (read-only) | Provide analytics and measure campaign performance | Shopify API (webhooks) |
| Campaign Configuration | Store your bar designs, messages, and targeting rules | User input |
| Analytics Data | Track impressions, clicks, and conversion metrics | App usage |
Important: We do NOT collect personal data from your store's customers (such as names, emails, or payment information). RevenueBar only processes aggregated, anonymized analytics data.
⚙️ 3. How We Use Your Data
We use the collected data exclusively for the following purposes:
- App Functionality: To display announcement bars, promotional campaigns, and targeted messages on your storefront.
- Campaign Management: To manage and schedule your promotional campaigns, including A/B testing and performance tracking.
- Analytics & Reporting: To provide you with insights on campaign performance, including impressions, clicks, and conversion rates.
- Product Integration: To access your product catalog for creating product-based promotions and discount campaigns.
- Technical Support: To assist you with troubleshooting and customer support inquiries.
- Service Improvement: To improve and optimize the app's features and performance.
🔒 4. Data Storage & Security
We implement industry-standard security measures to protect your data:
- Encryption: All data is transmitted using TLS/SSL encryption (HTTPS).
- Secure Database: Data is stored in encrypted databases hosted on secure cloud infrastructure (MongoDB Atlas) with access controls and audit logging.
- Access Controls: Only authorized personnel have access to stored data, using role-based access control (RBAC).
- Authentication: Shopify OAuth 2.0 is used for secure authentication. API tokens are encrypted and securely stored.
- Regular Audits: We regularly review and update our security practices to address emerging threats.
Data Location
Your data is processed and stored on servers located in secure data centers. We use cloud providers that comply with international data protection standards, including SOC 2 and ISO 27001.
🤝 5. Data Sharing
We do not sell, trade, or rent your data to third parties. Your data may only be shared in the following limited circumstances:
- Shopify Platform: As required for app functionality through Shopify's API and OAuth system.
- Cloud Infrastructure Providers: Our hosting and database providers process data on our behalf under strict data processing agreements.
- Legal Requirements: If required by law, regulation, or valid legal process (e.g., court order or subpoena).
- Business Transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred to the successor entity.
No Third-Party Marketing: We never share your data with third parties for their marketing purposes.
🇪🇺 6. GDPR Compliance
If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, you are protected under the General Data Protection Regulation (GDPR). We comply with GDPR requirements as follows:
Legal Basis for Processing
- Contractual Necessity: Processing your data is necessary to provide the services you requested when installing the app.
- Legitimate Interest: We process analytics data to improve our services, balanced against your privacy rights.
- Consent: Where required, we obtain your explicit consent before processing certain types of data.
GDPR Rights
Under the GDPR, you have the following rights:
- Right to Access: Request a copy of the personal data we hold about you.
- Right to Rectification: Request correction of inaccurate personal data.
- Right to Erasure: Request deletion of your personal data ("right to be forgotten").
- Right to Data Portability: Request your data in a structured, machine-readable format.
- Right to Restrict Processing: Request that we limit how we use your data.
- Right to Object: Object to processing based on legitimate interest.
- Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent.
Shopify Mandatory Privacy Webhooks
RevenueBar fully implements and adheres to Shopify's mandatory GDPR webhooks:
- customers/data_request: When a customer requests their data via the merchant, Shopify triggers this webhook. Because RevenueBar does not store personal customer records, we report any relevant aggregated campaign metrics within 30 days.
- customers/redact: When a customer requests deletion of their personal data, Shopify triggers this webhook. RevenueBar promptly erases or anonymizes any customer-associated interaction records within 30 days.
- shop/redact: 48 hours after a merchant uninstalls RevenueBar, Shopify sends this webhook. RevenueBar permanently and securely purges all store information, access tokens, campaign configurations, and related analytics data from our databases.
Data Processing Agreement
We act as a data processor on behalf of Shopify merchants (data controllers). Our data processing practices comply with GDPR Article 28 requirements.
🗄️ 8. Data Retention
We retain your data for only as long as necessary:
- Active Use: Your data is retained for as long as the app is installed on your Shopify store.
- After Uninstallation: Upon app uninstallation, your campaign configurations and analytics data are automatically deleted within 30 days.
- Backup Data: Encrypted backups may persist for up to 90 days before being permanently purged.
- Legal Obligations: Some data may be retained longer if required by law or for legitimate business purposes (e.g., billing records).
Immediate Deletion: You can request immediate deletion of all your data at any time by contacting us. We will process your request within 30 days.
✅ 9. Your Rights
Regardless of your location, you have the following rights regarding your data:
- Access: Request information about the data we hold about your store.
- Correction: Request correction of any inaccurate data.
- Deletion: Request deletion of your data at any time.
- Export: Request a copy of your data in a portable format.
- Opt-Out: Uninstall the app at any time to stop all data processing.
To exercise any of these rights, please contact us using the information provided below.
📝 10. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes:
- We will update the "Last Updated" date at the top of this page.
- For significant changes, we will notify affected merchants through the Shopify admin panel or via email.
- Continued use of the app after changes are posted constitutes acceptance of the updated policy.
📧 11. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or your data, please contact us:
- Email: support@revenuebar.viformy.com
- Application: RevenueBar (Smart Announcement & Cart Rewards Bar for Shopify)
We aim to respond to all privacy-related inquiries within 5 business days.
For GDPR requests: If you are in the EEA and believe we have not adequately addressed your data protection concerns, you have the right to lodge a complaint with your local Data Protection Authority (DPA).