Privacy Policy

Scope & our role

BoostPop is used by Shopify merchants. For personal data about a merchant's storefront visitors and customers, the merchant is the data controller and BoostPop acts as a data processor on their behalf. Each merchant has its own privacy policy governing how it uses the data its store collects. For data about the merchant's own account, BoostPop is the controller.

What we collect

From storefront visitors

• Contact details you submit. When you choose to enter your details into a BoostPop popup, sign-up form, or spin-to-win wheel on a merchant's store, we store what that form collects — which may include your email address, phone number, name, birthdate, and postal address. We only collect these when you submit them.
• Approximate location. We derive an approximate country and region from your IP address at our edge in order to decide which widget to show. We do not store your IP address or build an individual profile from it.
• Anonymous interaction counts. We keep aggregate, hourly counts of widget activity (such as impressions, clicks, and sign-ups) per widget. These counts contain no name, email, or other identifier and are not linked to an individual.

From merchants

• Store domain, store owner name and email, store settings, currency, and country, provided by Shopify when the app is installed.
• Billing and usage information needed to operate the app's pricing.
• Credentials you choose to connect for email/marketing integrations (for example Mailchimp, Omnisend, or Klaviyo), so we can forward opt-ins on your behalf.

How we use data

• To display and operate the merchant's widgets and to deliver opt-ins, coupons, and sign-ups the visitor requested.
• To pass submitted contact details to the merchant and the merchant's connected marketing tools.
• To produce anonymous, aggregate analytics for the merchant (such as how many times a widget was shown or clicked).
• To provide, secure, support, and bill for the app, and to comply with our legal obligations.
• To email merchants about BoostPop. We use the store contact email Shopify gives us when the app is installed to send merchants occasional product news — new features and improvements. Every one of these emails has a one-click unsubscribe link, and unsubscribing is permanent: we will not send you product email again, and re-installing or a later sync will not undo it. This is separate from the service messages we need to send to run the app (such as billing, usage, and account notices), which are not marketing. We do not use storefront visitors' details for our own marketing, and we do not sell or rent any address.

How we share data

We do not sell personal data. We share it only as needed to run the service:

• With the merchant and their tools. Details you submit through a widget are shared with the merchant whose store you used and, where the merchant has connected them, with that merchant's email/marketing platform (e.g. Mailchimp, Omnisend, Klaviyo) and Shopify customer list.
• With service providers (sub-processors). We use infrastructure and tooling providers to run BoostPop, including DigitalOcean for hosting (United States) and a transactional email/automation service for merchant notifications. They process data only on our instructions.
• For legal reasons. Where required by law, or to protect the rights, safety, and security of users and the service.

AI assistant connections

Merchants can optionally connect BoostPop to an AI assistant (such as Claude, Claude Code, or Cursor) to manage their widgets conversationally. This is a merchant-facing feature that involves the merchant's own account data — not storefront visitors' personal data.

• What the assistant can access. Only the connecting merchant's own BoostPop data — their widgets and settings, anonymous aggregate performance counts, and their plan and usage information. A connected assistant cannot access the contact details that storefront visitors submit through widgets.
• Data sent to your chosen assistant. When a merchant connects an assistant, the BoostPop data it requests is sent to that third-party AI provider, which the merchant chooses and controls. That provider processes the data under its own terms and privacy policy; the merchant is responsible for the assistant they connect.
• Connection credentials. We store each connection's access credentials (OAuth tokens and API keys) in hashed form only, never in plain text. A merchant can revoke any connection at any time from the app's settings, and all connection credentials are deleted automatically when the merchant uninstalls the app.
• Usage analytics. We record anonymous, aggregate usage events for this feature (for example, that a connection was created or a command was run) to operate and improve it. These events contain no storefront visitor personal data.

Retention & deletion

• Contact details you submit are kept until the merchant deletes them, you are redacted at the merchant's request, or the merchant uninstalls the app.
• When a merchant uninstalls BoostPop, Shopify sends us a shop-redaction request (around 48 hours later) and we erase that store's stored contacts and account record.
• A merchant's contact email is also held by the email service we use to send product news. If you unsubscribe, we keep a permanent record of that choice so we do not email you again. When Shopify sends us the shop-redaction request after an uninstall, we erase the address from that service too — unless the same address still belongs to another store that has BoostPop installed, so that closing one store does not stop email for a store you kept.
• Anonymous aggregate counts contain no personal data and may be retained for analytics.

Your rights

Depending on where you live (for example under the GDPR or CCPA), you may have rights to access, correct, delete, or restrict the use of your personal data, and to object to certain processing.

Because a merchant controls the data its store collects, the most direct way for a storefront visitor to exercise these rights is through the merchant whose store you used. You may also contact us at [email protected] and we will assist the merchant in responding.

Shopify compliance

BoostPop honors Shopify's mandatory data-protection requests:

• Customer data request. When a shopper asks for their data, we make the contact details we hold for that shopper available to the merchant.
• Customer redaction. When a shopper is redacted, we delete the contact details we hold for that shopper on the merchant's store.
• Shop redaction. After a store uninstalls the app, we delete that store's stored contacts and account record.

Security & international transfers

We use reasonable technical and organizational measures to protect personal data. BoostPop is hosted in the United States; if you access it from elsewhere, your data may be transferred to and processed in the United States and other countries where we or our service providers operate.

Changes & contact

We may update this policy from time to time; we will revise the "last updated" date above when we do. Questions or requests can be sent to [email protected].