Summary
This policy explains how Concat Apps ("we") handles information in PopSpin ‑ Spin Wheel Popup, a Shopify app (the "App"), and on this website.
- We collect what the App needs to show your popups, create discount codes and give you subscribers and analytics.
- We never sell personal information, and we do not use your shoppers' details for our own marketing.
- Shoppers' details are sent to other services only when you connect them, such as Klaviyo or a webhook.
- When you uninstall the App, Shopify asks us to erase your store's data 48 hours later, and we do.
Who is responsible
For information about merchants (the store owners and staff who use the App), Concat Apps decides how it is used and is responsible for it.
For information about store visitors who use a PopSpin popup, the merchant decides what to collect and what to do with it, and is responsible for it. We process it on the merchant's behalf, to provide the App. Visitors with questions about their data should contact the store first; we will help the store answer.
Information about merchants
- Your store's address, name, plan and the settings you make in the App, such as campaigns, rules and email templates.
- The store owner's name and email, which Shopify provides, used to contact you about your account.
- What you send us in support chat, contact forms and feature requests.
- How you use the App's admin: we record sessions in the admin (not on your storefront) to find and fix bugs. Shopify's session tokens are removed from recordings.
- Credentials you add for your own mail server or for integrations. These are stored encrypted.
Information about store visitors
When a visitor uses a PopSpin popup on a store, the App may collect:
- What they enter in the form: email address, phone number and name, depending on the fields the merchant turns on, and whether they ticked the email marketing consent checkbox.
- Their reward: the prize they won, its discount code and when it expires.
- Their IP address, to apply play limits and stop abuse. If the merchant turns on location for a campaign, the IP address is also sent to ipapi.co to find the approximate country, region and city.
- Email confirmations: when double opt-in is on, when the visitor confirmed their subscription.
- Browser storage: the App remembers in the visitor's browser that they have played and what they won, so the popup does not show again too soon and the reward can be shown again. This is stored in the browser, not sent to us.
- Interactions: views, plays, closes and code copies are counted per campaign and per day. These counts do not identify anyone.
Information from Shopify
With the permissions you approve when installing, the App uses Shopify's Admin API to:
- Create or update a Shopify customer for each signup, with the email marketing consent they gave.
- Create and read discount codes for prizes.
- Read how much the customers PopSpin added have spent, for the Analytics page.
- Check whether the App's theme embed is turned on, and read the products and files you choose for prizes and images.
- Store campaign settings and translations in your store, so the popup can show them.
How we use information
- To run the App: show popups, pick prizes, create codes, send the emails you turn on and fill in your reports.
- To send signups to the integrations you connect.
- To support you, and to tell you about your account, such as reaching your monthly limit.
- To keep the App secure, prevent abuse and fix problems.
- To meet legal obligations.
Integrations you connect
On paid plans you can send signups to other services. These are chosen and controlled by you, the merchant, and that service's own privacy policy applies to what it receives:
- Klaviyo: the visitor's email, phone, name, consent, reward and code, sent with the API key you provide.
- Webhooks: the same details, sent to the addresses you add, such as Zapier, Make or your own server.
- Your own mail server: reward emails are sent through the SMTP server you connect.
Events waiting to be sent are queued for up to 7 days. Once delivered they are deleted after 7 days, and after 30 days if they could not be delivered. Delivery logs keep only the outcome, never the contents.
How long we keep it
- Subscribers and settings are kept while the App is installed, unless you ask us to delete them.
- When Shopify sends us a request to erase a shopper's data, we delete their subscriber record, confirmations, queued emails and queued integration events.
- When you uninstall the App, Shopify asks us to erase your store's data 48 hours later, and we delete it then, unless the App has been installed again. We keep only what the law requires, such as billing records.
This website
popspin.app is hosted by Cloudflare. We count visits with Cloudflare Web Analytics, which does not use cookies or track you across sites. This website sets no cookies. If you email us, we use your message only to reply.
Security
Data is encrypted in transit. Passwords and API keys you give the App are encrypted at rest. Access to production data is limited to the people who need it to run and support the App. No system is perfectly secure, and we will tell affected merchants promptly if a breach affects their data.
Your rights
Depending on where you live, you may have the right to access, correct, export or delete your personal information, or to object to how it is used. Merchants can export subscribers in the App at any time, and can erase a shopper's data by requesting erasure for that customer in Shopify, which tells us to delete it too. To make a request, email support@concatapps.com. Store visitors should contact the store, which can ask us for help.
Changes to this policy
We will update the date at the top when this policy changes, and tell merchants in the App or by email about important changes.
Contact
Concat Apps
Kathmandu, Nepal
support@concatapps.com