Privacy policy

Daily Drops is a Shopify app that lets a store run a calendar of daily offers — one door opens each day, with a discount, a gift or a message behind it. This policy explains what the app collects when a merchant installs it and when that merchant's customers use the calendar, how it is used, and how it is deleted.

Information about merchants

• Your store. Your shop's address and the access Shopify grants the app when you install it, so the app can work in your admin.
• Your staff account. When you open the app, Shopify tells it who is signed in (name and email). It is used only to keep you signed in.
• What you build. Your calendars: dates, look, wording, the offers on each day, and the products, collections and discounts they use. The app reads products and collections from your store and creates discount codes, gift discounts and (if you ask it to) a page in your store.
• Support chat. The app's admin has a chat for writing to us. It carries your store's name, address and contact email, so we know who is asking and can reply by email, and keeps what you write to us. It is never on your storefront and holds nothing about your customers.
• Your plan. Which Daily Drops plan your store is on. Charges are made and held by Shopify; the app never sees payment details.

Information about your customers

The app collects this on the merchant's behalf, to run their calendar. The merchant decides how their customers' information is used, under their own privacy policy.

• A visitor cookie, with consent. A random identifier in a cookie (advent_visitor, kept 90 days) so the calendar remembers which doors a browser has opened and counts visitors once. It is set only when the shopper allows analytics in the store's cookie choices (Shopify's Customer Privacy API); without that, opens are not counted and no cookie is set. It does not identify the person and is not used to track them anywhere else.
• Store sessions, with consent. While a calendar runs, the app counts the store's visits (sessions) to know which plan fits it, using a timestamp kept in the shopper's browser. It counts only when the shopper allows analytics, and sends nothing that identifies them.
• Email, for a prize draw. If a door has a prize draw or a golden ticket and a customer enters it, the email address they type, so the merchant can draw a winner and contact them.
• Access-code recipients. If the merchant gives customers personal access codes, the name, email and Shopify customer ID the merchant adds for each one.
• Orders placed with a calendar's code. To show the merchant what their calendar brought in, the app reads the store's orders and keeps, for each order that used one of the calendar's codes, its order number, the code and what the order came to. It does not keep who placed the order — no name, email, address or phone number.
• IP address, briefly. When someone types an access code, their IP address is kept for 15 minutes to stop codes being guessed, then deleted.

The app does not collect payment details — checkout is Shopify's — and does not use advertising or analytics trackers.

How the information is used

Only to provide the app: to show the calendar, open today's door, apply its code, run draws, and show the merchant how their calendar is doing. Information is never sold or rented, and is not used to advertise.

Who else handles it

• Shopify, which hosts your store and processes all orders and app charges.
• Google Cloud, where the app and its database run, in the United States.
• OpenAI, only if a merchant asks the app to draft their calendar's wording. The app then sends product titles, prices and the tone the merchant describes — never customer information.
• Crisp, which runs the support chat in the app's admin: your conversations with us and your store's name, address and contact email — never customer information.

How long it is kept, and deletion

• Merchant and customer information is kept while the app is installed.
• When a customer asks a store to erase their data, Shopify tells the app and it deletes that customer's draw entries, access-code details, door history and the orders of theirs it counted, for that store.
• When a customer asks for a copy of their data, the app gives the store what it holds on them.
• 48 hours after a store uninstalls the app, Shopify tells the app and it deletes everything it holds for that store — its calendars, customers' entries and access codes, and plan records.

Your rights

Depending on where you live (for example under the GDPR or the CCPA), you may have the right to see, correct or delete personal information, and to object to its use. Customers of a store should contact that store first; it controls their information and can make the request through Shopify. Merchants can contact us directly.

Security

Everything is sent over HTTPS, the database is encrypted at rest (Google Cloud SQL) and access to it is restricted, and Shopify access is limited to what the app needs to work.

Changes

If this policy changes, the date at the top changes with it. Significant changes are shown in the app.

Our terms of service include the data-processing terms between Daily Drops and the stores that install it.

Contact

Questions about privacy: admin@zaah.com.