Privacy Policy

1Who we are

PromoLock is operated by Akash Chaterjee, trading as WEBx47 (“we”, “us”, “our”), of Mansarovar, Jaipur, RJ, 302020, IN. PromoLock is a Shopify app that controls discount code and gift card usage at checkout, creates bulk discount codes, protects discounts against fraudulent reuse, and provides analytics to the merchants who install it.

For the personal data described below, the merchant who installs PromoLock is the data controller and we act as a data processor on their behalf.

2Data we process

Merchant account data. We store the name and email address of the store owner and staff, obtained through Shopify authentication, used to operate the app and provide support.

Fraud-prevention data. When a merchant enables PromoLock’s discount fraud protection, we keep a record of each discount-code redemption on the store so that repeated redemptions of single-use codes can be recognised — including where one person attempts them through duplicate or alias accounts. For each redemption we store the customer ID, email address, phone number, first and last name, street address, and postal code, together with the order reference, discount code, and order date. This data is stored only for merchants who switch fraud protection on, is used solely to decide whether a discount code may be redeemed, and is never used for marketing, profiling beyond that decision, or any other purpose.

Order data we access. To provide analytics, PromoLock accesses order data, which can include customer details such as names and email addresses. For analytics we store only non-identifying details — order ID, variant ID, discount amount, payment method, discount code, and title. Customer identity fields are retained only as part of the fraud-prevention data described above, and only for stores that have enabled fraud protection; for all other stores they are read transiently and not stored.

Customer data we access. To let a merchant lock a gift card to a specific customer, PromoLock reads the merchant’s existing customer records and, where the merchant chooses, creates a new customer record (such as name and email) on the merchant’s behalf. This customer data is used only to set up the gift card lock; it is held in the merchant’s Shopify store, not stored in PromoLock’s own systems.

We use all of the above only to provide PromoLock’s functionality — controlling discount and gift card usage and providing analytics to the merchant. We do not sell personal data or use it for any unrelated purpose.

3Where data is stored & how long we keep it

Data we store is held in a database operated via PlanetScale and hosted on Amazon Web Services in the United States (region: us-east-1), encrypted at rest and in transit.

Merchant account data and the non-identifying order details described above are retained for the duration of the app installation.

Fraud-prevention data is kept on a rolling basis for a maximum of 365 days from the order date and is then deleted automatically. Records belonging to cancelled orders are deleted when we learn of the cancellation, and records belonging to a specific customer are deleted when the merchant or Shopify sends a redaction request for that customer.

All data associated with a store is deleted when the merchant uninstalls PromoLock.

4Sub-processors

We rely on the following sub-processors to provide the service. Each processes personal data only as needed to support PromoLock:

• Amazon Web Services, Inc. — database hosting (United States)
• PlanetScale, Inc. — database platform (United States)
• Mantle — billing and subscription management (receives merchant account data such as email and store domain)
• Upstash, Inc. — background job scheduling and message queue (QStash), used to run PromoLock’s scheduled and background tasks (United States)

5International data transfers

Where personal data of individuals in the UK or EU is transferred to the United States or India, those transfers are made under appropriate safeguards, including the Standard Contractual Clauses adopted by the European Commission and their UK equivalent.

6Security

We apply appropriate technical and organisational measures to protect personal data, including encryption at rest and in transit, access controls, separation of production and test environments, and limiting the data we store to what each feature requires.

7Data subject rights

Individuals may exercise their rights — access, correction, and deletion — by contacting the merchant, who is the data controller. We assist merchants in responding to these requests and honour Shopify’s mandatory privacy webhooks: on a customer data request we provide the merchant with the data we hold for that customer, and on a redaction request we delete it.

8Changes to this policy

We may update this policy from time to time. Any changes will be posted on this page with a revised “last updated” date.

9Contact

Questions about this policy can be sent to akash@promolock.app