Privacy Policy for Cart Addon Upsell

1. Overview

Cart Addon Upsell (“we”, “our”, or “the App”) provides cart drawer cross-sell and addon recommendation solutions for merchants on the Shopify e-commerce platform. We are committed to protecting the privacy of our merchants and their customers in strict accordance with the European Union General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).

2. Information We Collect

To provide core recommendation and attribution services, we access the following data via official Shopify APIs:

• Store Configuration Data: Merchant shop domain, installed theme status, and merchant-defined product recommendation rules.
• Aggregated Order Data: Order ID, item quantity, and attributed incremental revenue specifically tied to addon recommendations via the _addon_source attribute.

Zero Personally Identifiable Information (PII) Stored: The App does NOT store customer names, email addresses, phone numbers, billing/shipping addresses, or credit card information. All transactions and checkouts are processed exclusively through Shopify's secure platform.

3. How We Use Collected Data

Data collected is used exclusively for:

• Matching merchant-configured upsell rules with products currently in the customer's cart.
• Calculating and displaying real-time store performance metrics (impressions, conversion rate, and attributed revenue) in the merchant dashboard.
• Processing refund chargebacks to ensure accurate revenue reporting.

4. Data Retention and Deletion (GDPR / CCPA)

We support automated data erasure. When an app uninstalls, Shopify sends mandatory webhooks. Forty-eight hours after uninstallation, the shop/redact webhook triggers an automated transaction that permanently deletes all stored rules, attribution records, and session tokens associated with the store from our databases.

5. Security

All data in transit is encrypted using Transport Layer Security (TLS 1.3). Access to our backend infrastructure is strictly restricted, monitored, and compliant with Shopify Security Requirements.

6. Contact Us

If you have questions about this Privacy Policy or your data rights, please contact our Data Protection team at: sxhtgzr@gmail.com.