Privacy Policy

This Privacy Policy explains what information Aqua Loyalty collects, how we use it, and the choices available to merchants and their customers. It applies to the Aqua Loyalty app available on the Shopify App Store, our website, and the loyalty programs merchants run through us.

1. Information we collect

From merchants who install our Shopify app:

  • Your shop's domain, and an access token issued by Shopify that lets us act on your store's behalf for the permissions you approve during installation.
  • Order and refund data (such as order value, line items, and the associated customer's name and email address) that Shopify sends us automatically when an order is paid or refunded, so we can calculate and award loyalty points.
  • Product and collection data, if you choose to limit which products earn points.

From shoppers who join a loyalty program:

  • Name, email address, and (for accounts created directly on our website rather than through Shopify) a password.
  • Loyalty activity: points earned and redeemed, tier status, referral activity, and reward claims.
  • Basic technical information such as IP address and device/browser information, collected automatically when you visit our website or a merchant's storefront widget.

2. How we use the information we collect

  • To operate the loyalty program: award and track points, calculate VIP tier status, process referrals, and issue rewards.
  • To fulfill redemptions: when a shopper redeems points, we use the Shopify Admin API to issue a discount code or gift card back to that merchant's store on the shopper's behalf.
  • To provide the merchant-facing dashboard, both inside Shopify admin and on our own website, so merchants can configure and monitor their program.
  • To communicate with merchants and shoppers about their account or program activity.
  • To maintain security, prevent abuse, and comply with legal obligations.

We do not sell personal information, and we do not use order or customer data for advertising.

3. How we share information

  • With Shopify: to issue discount codes and gift cards for point redemptions, and to receive order, refund, and shop data via Shopify's APIs and webhooks.
  • With service providers: infrastructure and hosting providers who process data on our behalf under contract, solely to operate the service.
  • When required by law: if we are required to disclose information in response to a valid legal request.

We do not share shopper data across merchants. A shopper's loyalty account may span multiple loyalty programs, but each merchant only ever sees their own program's activity for that shopper.

4. Data retention and deletion

Shopify requires apps to support the following, and Aqua Loyalty implements each of them automatically:

  • Customer data request: if a shopper asks a merchant what data we hold about them, we log the request so the merchant can respond, describing the loyalty activity covered by this policy.
  • Customer redaction: if a shopper's data must be erased, we delete their transaction history and membership records for that specific merchant's loyalty program(s). Their platform-wide account is not deleted, since it may be linked to other merchants' programs they still participate in.
  • Shop redaction: when a merchant uninstalls the app, Shopify notifies us roughly 48 hours later and we permanently delete that shop's connection, its loyalty program configuration, and its staff access -- automatically, without requiring any action from the merchant.

Merchants and shoppers can also contact us directly to request access to, correction of, or deletion of their information, as described in Section 5.

5. Your choices and rights

  • You may access, update, or request deletion of your personal information by contacting us using the details on our contact page.
  • You can opt out of marketing emails using the unsubscribe link included in those emails; this does not affect transactional messages about your loyalty account.
  • Merchants can disconnect the app at any time from their Shopify admin, which triggers the shop redaction process described above.

6. Security

Access tokens and passwords are stored encrypted. All traffic between your browser, Shopify, and our servers is encrypted in transit (HTTPS/TLS).

7. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected by an updated revision date, and continued use of the app or website after changes take effect constitutes acceptance of the revised policy.