Easy Pointly — Privacy Policy

Easy Pointly (“we”, “us”, or “our”) is a Shopify app that provides loyalty points, tiered rewards, and referral program functionality to Shopify merchants (“merchants”) and their customers (“end customers”). This Privacy Policy explains what personal data we collect, why we collect it, and how we handle it.

We collect and process the following personal data:

• Customer name — displayed in the loyalty widget to personalise the customer experience.
• Shopify customer ID — used internally to link loyalty records to the correct customer account.
• Order data — order totals, line items, taxes, and shipping amounts are used to calculate points earned per order.
• Customer tags — read from Shopify to determine program eligibility based on merchant settings.
• Referral identifiers — anonymised numeric codes generated from customer IDs to power the referral program.

We do not collect email addresses, phone numbers, payment information, or billing addresses.

Personal data is used exclusively to provide the loyalty program service:

• Calculating and storing points balances and lifetime spend totals.
• Assigning customers to loyalty tiers.
• Generating discount codes when customers redeem points.
• Tracking referral relationships between customers.
• Displaying personalised loyalty information in the storefront widget.

We do not sell, rent, or share personal data with third parties for marketing or advertising purposes.

We process personal data on the basis of legitimate interests — specifically, providing the loyalty program service that merchants have installed and their customers choose to participate in. Merchants are the data controllers for their customers’ data; Easy Pointly acts as a data processor on their behalf.

• Customer loyalty data is retained for as long as the merchant’s app installation is active.
• When a merchant uninstalls Easy Pointly, their data is retained for 30 days to allow for reinstallation, then permanently deleted.
• When a data deletion request is received via Shopify’s GDPR webhooks, we delete the relevant records within 48 hours.

• Data is stored in a database hosted on Fly.io infrastructure.
• All data is encrypted at rest and all data in transit is protected by TLS/HTTPS.
• Database backups are encrypted and stored on Fly.io’s managed infrastructure.
• Access to production data is limited to authorised developers only.
• We maintain a security incident response procedure to detect, contain, and notify affected parties in the event of a data breach.

If you are located in the European Economic Area, you have the right to access, rectify, erase, restrict, or port your personal data, and to object to processing. Requests from end customers should be directed to the merchant whose store you purchased from. Merchants may submit requests to us at the contact address below. We process all requests within 30 days.

Easy Pointly implements all three Shopify mandatory GDPR webhooks:

• customers/data_request — we can provide all data held for a specific customer.
• customers/redact — we permanently delete all personal data for a specific customer.
• shop/redact — we permanently delete all data associated with a merchant’s store.

Easy Pointly does not use cookies or tracking technologies on merchant storefronts beyond what is necessary to display the loyalty widget to authenticated customers.

We may update this Privacy Policy from time to time. The “Last updated” date at the top reflects the most recent changes. Continued use of Easy Pointly after changes are posted constitutes acceptance of the updated policy.

For privacy-related questions or data requests, please contact:
Easy Pointly
Email: easypointly@gmail.com