Privacy Policy

Scope & our role

BoostPop is used by Shopify merchants. For personal data about a merchant's storefront visitors and customers, the merchant is the data controller and BoostPop acts as a data processor on their behalf. Each merchant has its own privacy policy governing how it uses the data its store collects. For data about the merchant's own account, BoostPop is the controller.

What we collect

From storefront visitors

• Contact details you submit. When you choose to enter your details into a BoostPop popup, sign-up form, or spin-to-win wheel on a merchant's store, we store what that form collects — which may include your email address, phone number, name, birthdate, and postal address. We only collect these when you submit them.
• Approximate location. We derive an approximate country and region from your IP address at our edge in order to decide which widget to show. We do not store your IP address or build an individual profile from it.
• Anonymous interaction counts. We keep aggregate, hourly counts of widget activity (such as impressions, clicks, and sign-ups) per widget. These counts contain no name, email, or other identifier and are not linked to an individual.

From merchants

• Store domain, store owner name and email, store settings, currency, and country, provided by Shopify when the app is installed.
• Billing and usage information needed to operate the app's pricing.
• Credentials you choose to connect for email/marketing integrations (for example Mailchimp, Omnisend, or Klaviyo), so we can forward opt-ins on your behalf.

How we use data

• To display and operate the merchant's widgets and to deliver opt-ins, coupons, and sign-ups the visitor requested.
• To pass submitted contact details to the merchant and the merchant's connected marketing tools.
• To produce anonymous, aggregate analytics for the merchant (such as how many times a widget was shown or clicked).
• To provide, secure, support, and bill for the app, and to comply with our legal obligations.

How we share data

We do not sell personal data. We share it only as needed to run the service:

• With the merchant and their tools. Details you submit through a widget are shared with the merchant whose store you used and, where the merchant has connected them, with that merchant's email/marketing platform (e.g. Mailchimp, Omnisend, Klaviyo) and Shopify customer list.
• With service providers (sub-processors). We use infrastructure and tooling providers to run BoostPop, including DigitalOcean for hosting (United States) and a transactional email/automation service for merchant notifications. They process data only on our instructions.
• For legal reasons. Where required by law, or to protect the rights, safety, and security of users and the service.

Retention & deletion

• Contact details you submit are kept until the merchant deletes them, you are redacted at the merchant's request, or the merchant uninstalls the app.
• When a merchant uninstalls BoostPop, Shopify sends us a shop-redaction request (around 48 hours later) and we erase that store's stored contacts and account record.
• Anonymous aggregate counts contain no personal data and may be retained for analytics.

Your rights

Depending on where you live (for example under the GDPR or CCPA), you may have rights to access, correct, delete, or restrict the use of your personal data, and to object to certain processing.

Because a merchant controls the data its store collects, the most direct way for a storefront visitor to exercise these rights is through the merchant whose store you used. You may also contact us at privacy@boostpop.app and we will assist the merchant in responding.

Shopify compliance

BoostPop honors Shopify's mandatory data-protection requests:

• Customer data request. When a shopper asks for their data, we make the contact details we hold for that shopper available to the merchant.
• Customer redaction. When a shopper is redacted, we delete the contact details we hold for that shopper on the merchant's store.
• Shop redaction. After a store uninstalls the app, we delete that store's stored contacts and account record.

Security & international transfers

We use reasonable technical and organizational measures to protect personal data. BoostPop is hosted in the United States; if you access it from elsewhere, your data may be transferred to and processed in the United States and other countries where we or our service providers operate.

Changes & contact

We may update this policy from time to time; we will revise the "last updated" date above when we do. Questions or requests can be sent to privacy@boostpop.app.