Privacy Policy
Effective date: September 14, 2026
This is a plain-language description of the privacy practices for Shopify apps built by PopGenie Apps ("we," "us"). It covers every app we publish; today that's Spin Rewards Pro, described in detail below. It is a draft policy and not a substitute for legal advice. If you have questions, contact us at support@popgenie.app.
Who this applies to
Our apps are used by Shopify merchants ("you" or "merchant") who install them on their store. Some of our apps, including Spin Rewards Pro, show a widget to the merchant's storefront visitors ("shoppers"). This policy explains what we collect from each.
We do not use cookies or trackers on this website, and our apps do not run advertising or analytics scripts.
Spin Rewards Pro
The following applies specifically to Spin Rewards Pro (the "App").
What we collect
From merchants
- Your shop domain (e.g. yourstore.myshopify.com).
- An Admin API access token issued by Shopify when you install the App, used to create discount codes and read store data needed by the App.
- Your campaign settings (wheel design, prize segments, discount rules, and similar configuration you enter).
- Billing and subscription status, managed through Shopify's billing system.
From shoppers (collected by the widget, on the merchant's behalf)
- The email address and/or phone number a shopper enters to spin the wheel.
- The discount code issued to that shopper, and when it was issued.
Aggregate usage data
- Impression and spin counts for each campaign, used to show merchants basic performance stats. These counts are aggregate and are not tied to an individual shopper's identity beyond the lead record described above.
Roles: who controls this data
For shopper data collected through the widget, the merchant is the data controller — they decide to run the campaign and use the resulting leads. PopGenie Apps acts as a data processor, handling that data only to operate the App on the merchant's behalf.
Why we collect it
- To display and run the spin-to-win widget on the merchant's storefront.
- To create unique, single-use discount codes in the merchant's Shopify store.
- To show the merchant their leads, impressions, and spin counts in the App's admin screens.
- To bill for the App's subscription and provide customer support.
We do not sell or share personal information with third parties for their own marketing purposes, and we do not use shopper data to serve ads.
Where data is stored
App data is stored on Google Cloud infrastructure: campaign, lead, and usage data in Firestore (US multi-region), and the application itself runs on Cloud Run (US region).
Subprocessors
| Subprocessor | Purpose |
|---|---|
| Google Cloud (Firestore, Cloud Run) | Hosting the App and storing App data |
| Shopify | Store platform, Admin API, and billing |
Data retention and deletion
- We keep merchant and campaign data for as long as the App is installed on a store.
- When a merchant uninstalls the App, we delete the Admin API access token immediately.
- All shop data is deleted within 48 hours of uninstall, in response to Shopify's mandatory
shop/redactwebhook. - When Shopify sends a
customers/redactrequest (for example, when a shopper asks the merchant to delete their data), we delete that shopper's lead records. - When Shopify sends a
customers/data_requestrequest, we provide the requested shopper data to the merchant as required.
Your privacy rights
Depending on where you live, you may have rights under laws such as the GDPR / UK GDPR or the CCPA/CPRA, including the right to:
- Access the personal data we (or the merchant) hold about you.
- Request correction of inaccurate data.
- Request deletion of your data.
- Request a copy of your data in a portable format.
- Object to certain processing.
We do not sell or share personal information as those terms are defined under the CCPA/CPRA, so there is no sale or share to opt out of.
See Privacy requests for how to make any of these requests, including who to contact if you're a shopper or a merchant. We aim to respond to verified requests within 30 days.
Security
We use encryption in transit (HTTPS/TLS) and at rest for stored data, and we restrict access to app data to what is needed to operate and support our apps (least-privilege access). No method of storage or transmission is 100% secure, but we work to protect data using industry-standard practices.
International data transfers
Our infrastructure runs in the United States. If you are located outside the US, your data may be transferred to and processed in the US. We rely on our subprocessors' own safeguards for cross-border transfers.
Children's privacy
Our apps are intended for use by Shopify merchants and their storefront customers in a general retail context. They are not directed at children, and we do not knowingly collect personal information from children.
Changes to this policy
We may update this policy from time to time, including as we add new apps. We will update the effective date above when we do. Material changes will be reflected here; continued use of an app after changes take effect means you accept the updated policy.
Contact us
Questions about this policy or your data: support@popgenie.app. To make a specific privacy request, see Privacy requests.