Privacy Policy

2. Information we collect

The information we process depends on how Flowperk is used.

2.1 Information received from Shopify

When a merchant installs or uses Flowperk, we may receive information from Shopify that is necessary to provide the App, including:

• Shopify store identifiers and store domain;
• information about the merchant's Shopify store and configuration;
• Shopify access credentials and authentication information required to connect the App to Shopify;
• order information required to determine whether an order qualifies for a reward;
• product, variant, collection, tag or other commerce information where required by campaign rules;
• customer-related information associated with an order where required to determine reward eligibility, prevent duplicate rewards, enforce campaign limits, or provide other configured Flowperk functionality; and
• information concerning discounts and rewards created or redeemed through Flowperk.

We seek to access and process only the Shopify data necessary to provide Flowperk's functionality.

We do not intentionally collect payment card numbers or other complete payment credentials through Flowperk.

2.2 Information provided by merchants

When merchants configure or use Flowperk, we may process information including:

• campaign settings;
• reward configurations;
• campaign eligibility rules;
• content entered into campaigns;
• App preferences and configuration;
• subscription or plan information;
• support requests and communications; and
• other information voluntarily provided to us.

2.3 Information relating to customers

When a customer places an order or interacts with a Flowperk-powered experience, we may process information necessary to determine campaign eligibility, issue and display rewards, enforce campaign restrictions, and measure reward performance.

Depending on the merchant's configuration and the Shopify data made available to Flowperk, this may include:

• Shopify customer or order identifiers;
• order values and order contents;
• products or collections purchased;
• customer tags or eligibility attributes;
• previous-order or customer-order-count information;
• discount information;
• reward eligibility;
• rewards issued, revealed or redeemed;
• timestamps associated with these events; and
• technical information necessary to operate and secure the service.

Flowperk does not use merchant customer information to independently advertise Flowperk to those customers.

2.4 Technical information

When Flowperk is accessed, our systems and infrastructure providers may automatically process technical information such as:

• IP address;
• browser and device information;
• timestamps;
• requested URLs;
• application events;
• error reports;
• security logs; and
• diagnostic and performance information.

We use this information to operate, troubleshoot, secure and improve Flowperk.

3. How we use information

We process information where necessary to:

• provide and operate Flowperk;
• authenticate merchants and maintain the connection between Flowperk and Shopify;
• evaluate merchant-defined campaign eligibility rules;
• issue, display, manage and track rewards;
• prevent duplicate or unauthorised reward issuance or redemption;
• provide campaign analytics and reporting;
• maintain the reliability and security of the App;
• diagnose errors and provide technical support;
• prevent fraud, misuse and security incidents;
• administer subscriptions and accounts;
• comply with applicable law and Shopify platform requirements; and
• communicate with merchants about the operation of the service.

We do not sell merchant or customer personal information.

We do not use personal information obtained through Shopify to build advertising profiles or to independently market third-party products to a merchant's customers.

4. Legal bases for processing

Where UK GDPR or EU GDPR applies and Flowperk acts as a data controller, we process personal information under one or more appropriate legal bases.

These may include:

Where Flowperk processes customer personal information on behalf of a merchant, the merchant is responsible for establishing the appropriate lawful basis for that processing and providing any notices or obtaining any consents required by applicable law.

5. Automated campaign decisions

Flowperk automatically evaluates orders and other permitted Shopify data against campaign rules configured by the merchant.

For example, a merchant may configure a campaign to issue a reward when an order exceeds a particular value, contains specified products, or satisfies another campaign condition.

These automated evaluations determine eligibility for promotional rewards. Flowperk does not use this functionality to make decisions that we intend to have legal or similarly significant effects on customers.

The merchant determines the campaign rules and rewards offered through Flowperk.

6. How we share information

We do not sell personal information.

We may disclose or make information available to carefully selected service providers where necessary to operate Flowperk. These providers may include:

• cloud hosting and infrastructure providers;
• database and storage providers;
• application hosting providers;
• monitoring, logging and error-reporting providers;
• email or communications providers;
• payment or subscription-management providers; and
• professional advisers where reasonably necessary.

These providers are permitted to process information only for the purposes for which it has been provided to them and subject to appropriate contractual and security obligations.

We may also disclose information where reasonably necessary:

• to comply with law, regulation, legal process or a valid governmental request;
• to enforce our agreements or protect our legal rights;
• to investigate or prevent fraud, abuse or security incidents;
• to protect the rights, property or safety of Flowperk, merchants, customers or others; or
• in connection with a merger, acquisition, restructuring, financing or sale of all or part of the business, subject to appropriate safeguards.

Shopify separately processes personal information according to its own privacy practices.

7. International data transfers

Flowperk is operated from the United Kingdom.

Some service providers used to operate Flowperk may process or store information outside the United Kingdom or European Economic Area.

Where personal information is transferred internationally, we take appropriate measures required by applicable data-protection law. Depending on the destination and circumstances, these may include adequacy regulations or decisions, recognised contractual safeguards such as applicable standard contractual clauses or the UK International Data Transfer Agreement/Addendum, or another legally recognised transfer mechanism.

Further information about safeguards applicable to a particular transfer may be requested using the contact details below.

8. Data retention

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including providing Flowperk, maintaining security and audit records, resolving disputes and satisfying legal, accounting or contractual obligations.

Retention periods depend on the type of information and why it is processed.

When a merchant uninstalls Flowperk, we cease accessing new Shopify data through that installation and delete or anonymise personal information that is no longer required, subject to reasonable technical backup periods and any information we must retain for legal, security, fraud-prevention or dispute-resolution purposes.

We also process valid deletion requests received through Shopify's mandatory privacy mechanisms in accordance with Shopify requirements and applicable law.

9. Shopify privacy requests

Shopify provides mechanisms through which merchants and customers can exercise privacy rights concerning information processed by apps.

Flowperk supports Shopify's mandatory privacy compliance mechanisms, including requests relating to:

• customer data access;
• customer data deletion; and
• deletion of shop data following uninstall where applicable.

When Flowperk acts as a processor for a merchant, customers should normally direct requests concerning their store data to the merchant from whom they purchased. We will assist merchants with valid requests as required by applicable law and our obligations as their service provider.

10. Your privacy rights

Depending on your location and applicable law, you may have rights concerning your personal information, including rights to:

• request access to personal information;
• request correction of inaccurate information;
• request deletion of information;
• request restriction of certain processing;
• object to certain processing;
• request portability of eligible information;
• withdraw consent where processing relies on consent; and
• complain to an applicable data-protection authority.

These rights are subject to exceptions and limitations under applicable law.

If you are a customer of a Shopify merchant using Flowperk and your request concerns information processed by Flowperk on that merchant's behalf, you should normally contact the merchant directly. The merchant can then submit or coordinate the request with Shopify and Flowperk where necessary.

Merchants and other individuals may contact us using the details in Section 16.

11. California and other US state privacy rights

Residents of certain US states may have additional privacy rights under applicable state privacy laws, including rights to access, correct, delete or obtain a copy of certain personal information and, where applicable, opt out of certain forms of sale, sharing, targeted advertising or profiling.

Flowperk does not sell merchant or customer personal information for monetary consideration.

We also do not use Shopify merchant customer information for cross-context behavioural advertising.

Where Flowperk acts as a processor or service provider for a merchant, requests concerning merchant-controlled customer information should generally be submitted to that merchant.

12. Security

We use reasonable administrative, technical and organisational safeguards designed to protect personal information against unauthorised access, disclosure, alteration, loss or destruction.

These measures may include, as appropriate:

• encrypted network communications;
• access controls;
• authentication and authorisation controls;
• restricted production access;
• secure management of credentials and secrets;
• infrastructure and application monitoring;
• logging and error monitoring;
• software and dependency maintenance;
• backups and recovery procedures; and
• procedures for responding to security incidents.

No internet-based service can guarantee absolute security. We therefore cannot guarantee that information will never be accessed, disclosed, altered or destroyed despite our safeguards.

13. Data minimisation

Flowperk is designed to process only information reasonably necessary to provide the functionality requested by merchants.

We periodically review the Shopify API permissions and customer information required by the App and seek to avoid collecting personal information that is unnecessary for Flowperk's operation.

14. Children's privacy

Flowperk is a business service intended for Shopify merchants and is not directed specifically at children.

We do not knowingly use Flowperk to independently collect personal information from children for marketing or profiling purposes.

Merchants are responsible for ensuring that their use of Flowperk complies with laws applicable to their customers, including any requirements concerning children.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to Flowperk, our data-processing practices, service providers, legal requirements or Shopify requirements.

When we make material changes, we will update the “Last updated” date above and, where required, provide additional notice.

We encourage merchants to review this policy periodically.

16. Contact us

Questions, requests or concerns regarding this Privacy Policy or Flowperk's processing of personal information can be sent to:

If you are located in the United Kingdom and believe your data-protection rights have been infringed, you may also have the right to complain to the UK Information Commissioner's Office (ICO).

If you are located elsewhere, you may have the right to contact your local data-protection or privacy authority.