This Privacy Policy describes how Hoop Loyalty App ("the App," "we," "us," or "our") collects, uses, and discloses information in connection with your use of our Shopify application. It applies to merchants who install the App and to the customers who interact with a merchant's store through it. We value your trust and aim to be clear about what we collect and why.
Our Role: Controller and Processor
Our role under data protection law, including the EU and UK General Data Protection Regulation ("GDPR"), depends on whose information is being processed.
- For a merchant's customer data — such as customer names, email addresses, orders, and loyalty balances — we act as a processor (a "service provider"). The merchant who installed the App is the controller and decides why and how that data is used. We process it only on the merchant's documented instructions, which are given through their use of the App and its settings.
- For merchant account data — such as the store domain, store contact email, plan, and billing status — we act as a controller, because we determine how that information is used to provide, support, and bill for the App.
If you are a customer of a store using the App and want your data accessed, corrected, or deleted, the fastest route is usually to contact the merchant directly, as they control that data. You may also contact us using the details below and we will assist the merchant in responding.
Information We Collect
When a merchant installs the App, we access certain information made available to us through the Shopify platform in order to operate the loyalty program. This includes store details such as the store's domain, name, contact email, currency, and subscription plan. It also includes customer information, such as a customer's name, email address, and Shopify customer identifier, which we use to track loyalty balances on the merchant's behalf.
We also process order information, including order totals, order identifiers, and any discount codes applied, so that points can be awarded and redeemed accurately. In the course of operating the App, we generate additional data of our own, such as points balances, loyalty tier status, redemption records, referral activity, and a history of account activity.
How We Use Information
We use the information described above to operate the loyalty program on behalf of the merchant. This includes awarding and redeeming points, determining and displaying tier status, generating discount codes, and applying rewards at checkout. Where a merchant has enabled optional email notifications, we use customer contact information to deliver those messages. We also use collected data to provide merchants with analytics about the performance of their loyalty program.
Legal Bases for Processing (EEA/UK)
If you are located in the European Economic Area or the United Kingdom, we rely on the following legal bases under Article 6 of the GDPR:
- Performance of a contract — to provide the App to the merchant under our terms, including operating their loyalty program, processing subscriptions, and providing support.
- Legitimate interests — to secure and improve the App, prevent fraud and abuse of loyalty rewards, and provide merchants with analytics about their own program. We balance these interests against the rights and freedoms of the individuals concerned.
- Consent — where required, for example for certain marketing or optional communications. Consent can be withdrawn at any time, and every automated loyalty email includes an unsubscribe mechanism.
- Legal obligation — where we must retain or disclose information to comply with applicable law.
Where we act as a processor for a merchant, the merchant is responsible for establishing the legal basis for processing their customers' personal data.
Service Providers and Sub-processors
We use a small number of trusted service providers to run the App. Each is bound by contractual confidentiality and data protection obligations, and each processes data only to provide their service to us:
- Shopify — the commerce platform the App runs on. Store, customer, and order data is read from and written to Shopify under Shopify's API terms and its own privacy policy.
- Railway — application hosting and the primary database (United States).
- Upstash — managed Redis, used for caching and background job queuing.
- Resend — transactional email delivery, used only where a merchant has enabled loyalty email notifications.
We do not sell personal information, and we do not use merchant or customer data to train machine learning models. If we add or replace a sub-processor, we will update this page.
International Data Transfers
The App is hosted in the United States, and our database and supporting infrastructure are located there. If you are located in the European Economic Area, the United Kingdom, or another region with data transfer restrictions, this means your personal information is transferred to, and processed in, a country outside your own which may not provide the same level of data protection as your home jurisdiction.
Where such a transfer takes place, we rely on appropriate safeguards recognised under Articles 44–49 of the GDPR — principally the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable) — entered into with the service providers listed above, together with technical measures including encryption in transit and encryption of access credentials at rest.
Merchants who require a Data Processing Agreement covering these transfers may request one using the contact details below.
Data Retention
We retain loyalty data for as long as a merchant has the App installed. If the App is uninstalled, or if we receive a valid request for deletion, the associated data is deleted or anonymized within thirty days, except where longer retention is required by law.
Shopify Data Requests and Redaction
The App complies with Shopify's mandatory privacy webhooks. We respond
to customers/data_request, customers/redact,
and shop/redact requests in order to provide or erase
customer data as required by Shopify and applicable law.
Your Rights
Depending on your jurisdiction, you may have the right to access, correct, export, or delete your personal information, and to object to or restrict certain processing, including rights available under the GDPR and CCPA. Customers wishing to exercise these rights should first contact the merchant whose store they interact with, or may contact us directly using the details below. We will respond to, forward, or otherwise act on such requests as appropriate.
Depending on where you live, these rights may include the right to access your personal information, to have it corrected or erased, to receive it in a portable format, to object to or restrict how it is processed, and to withdraw consent at any time where processing is based on consent. We do not charge a fee to exercise these rights, and we will not discriminate against you for doing so.
Right to complain. If you are in the European Economic Area or the United Kingdom and believe we have not handled your personal information properly, you have the right to lodge a complaint with your local data protection supervisory authority. We would appreciate the chance to address your concern directly first, using the contact details below.
Security
We take reasonable steps to protect the information we process. Data in transit is encrypted using HTTPS/TLS, and access tokens are stored in encrypted form. Access to production data is restricted to authorized personnel only. No method of transmission or storage is entirely secure, but we maintain commercially reasonable safeguards designed to protect your information.
Changes to This Policy
We may update this Privacy Policy from time to time. Continued use of the App after any such changes will signify your agreement to the updated terms.
Contact Us
If you have questions about this Privacy Policy or wish to make a request regarding your personal information, please contact us at hi@hoopinteractive.com.