Privacy Policy

Last updated: July 30, 2026

This Privacy Policy describes how Digi Spin & Loyalty ("the App"), operated by Digielicit Infotech Pvt. Ltd. ("we", "us"), collects, uses, and protects information when merchants install the App on their Shopify stores and when their customers interact with loyalty and spin wheel features.

1. Who this policy applies to

• Merchants — Shopify store owners who install the App
• Customers — end shoppers who earn or redeem points, spin the wheel, or use referral features on a merchant's storefront

2. Information we collect

Depending on how the merchant configures the App, we may process:

• Shopify shop domain and shop identifier
• Merchant admin session data (OAuth tokens stored securely for app operation)
• Customer Shopify ID and loyalty data (points balance, tier, transaction history)
• Order-related data needed to award or claw back points (order ID, totals — via Shopify webhooks)
• Spin wheel participation records (prizes, optional lead capture if enabled by merchant)
• Referral codes and referral relationships
• Notification channel configuration (e.g. webhook URLs, email provider settings set by merchant)

We do not require customers to create a separate account with us. Customer data is linked to their Shopify customer account on the merchant's store.

3. How we use information

• Operate loyalty points, tiers, redemptions, and spin wheel features
• Process billing for the App through Shopify's billing system
• Send notifications configured by the merchant (email/SMS/webhook)
• Prevent fraud, enforce rate limits, and maintain service security
• Comply with legal obligations and Shopify platform requirements

4. Data storage and retention

Data is stored in encrypted PostgreSQL databases hosted on secure cloud infrastructure. Each merchant's data is isolated by shop identifier.

• When a merchant uninstalls the App, OAuth sessions are removed immediately. Other shop data is deleted within 48 hours via Shopify's shop/redact compliance webhook unless we are legally required to retain it.
• When a customer requests deletion, we remove their loyalty profile, points history, spin records, and referral data associated with their customer ID.

5. Data sharing

We do not sell personal data. We share data only with:

• Shopify — as required for app operation, OAuth, billing, and webhooks
• Service providers — hosting and database (e.g. Railway, Supabase) under contractual safeguards
• Third-party notification providers — only when configured by the merchant
• Authorities — when required by law

6. Your rights (GDPR / CPRA)

Merchants and their customers may request access to or deletion of personal data. Shopify sends mandatory compliance webhooks to the App when requests are made through a store. Merchants may also contact us directly.

To exercise rights or ask questions, email support@app-studio.in.

7. Security

We use HTTPS, signed Shopify App Proxy requests, webhook HMAC verification, and shop-scoped database queries. Access tokens and secrets are stored in environment variables, not in source code.

8. Children

The App is not directed at children under 13. Merchants are responsible for their store's compliance with applicable laws.

9. Changes

We may update this policy. The "Last updated" date will reflect changes. Continued use of the App after updates constitutes acceptance.

10. Contact

Digielicit Infotech Pvt. Ltd.
Email: support@app-studio.in
Website: https://app-studio.in