Information We Collect
When you install OffersMax on your Shopify store, we collect and store the following information to provide our service:
| Data Type | What We Collect | Purpose |
|---|---|---|
| Store Identity | Your Shopify store domain (e.g. yourstore.myshopify.com) | Identify and associate your store with your account |
| Access Token | Shopify API access token generated during OAuth installation | Authenticate API requests to manage discounts, price rules, and read your store data |
| Offer Configuration | Offer names, types, trigger conditions, product selections, discount settings, display options | Store and serve your configured upsell and cross-sell offers |
| Widget Settings | Theme preferences, colors, positions, cart behavior settings | Customize the appearance and behavior of offer widgets on your storefront |
| Analytics Aggregates | Daily counts of views, clicks, conversions, and revenue per offer | Provide performance analytics in your dashboard |
| Subscription Status | Your current plan (Free or Standard) and subscription history | Enforce plan limits and manage billing |
Information We Do NOT Collect
OffersMax is designed with a privacy-first approach. We explicitly do not collect, store, or process any of the following:
- Customer names, email addresses, phone numbers, or any personal contact information
- Customer shipping or billing addresses
- Individual customer purchase history or browsing behavior
- Customer payment card information or financial data
- Customer IP addresses or device fingerprints
- Any personally identifiable information (PII) about your store's customers
- Your store's full order history or financial records
How We Use Information
We use the information we collect solely to provide and improve the OffersMax service:
| Use | Description |
|---|---|
| Serve offer widgets | Fetch your active offers and display them on your storefront product pages, cart page, and checkout |
| Create discount codes | Automatically create Shopify price rules and discount codes for your configured offer discounts |
| Display analytics | Show you performance metrics for your offers in the OffersMax dashboard |
| Enforce plan limits | Apply the appropriate feature restrictions based on your subscription plan |
| Process billing | Manage your subscription through Shopify's billing system |
| Provide support | Diagnose and resolve technical issues you report to our support team |
| Improve the service | Use aggregated, anonymized usage patterns to improve app features and performance |
We do not use your data for advertising, do not sell your data to third parties, and do not use your data for any purpose beyond operating the OffersMax service.
Data Sharing & Third Parties
We do not sell, trade, or rent your data to third parties. We share data only with the following service providers who help us operate OffersMax:
| Service Provider | Purpose | Data Shared |
|---|---|---|
| Shopify Inc. | Platform provider — OAuth authentication, billing, API access | App installation and subscription data as required by the Shopify Partner Program |
| Amazon Web Services (AWS) | Cloud infrastructure — hosting the OffersMax application and database | All app data is stored on AWS servers located in the United States (us-east-2 region) |
Both Shopify and AWS maintain their own privacy policies and security certifications. We have data processing agreements in place with these providers as required by applicable law.
Data Retention & Deletion
We retain your data only as long as necessary to provide the OffersMax service. Here is our data retention schedule:
| Event | Data Affected | Action | Timing |
|---|---|---|---|
| App uninstalled | Session / access tokens | Permanently deleted | Immediately |
| App uninstalled | Shop record, offers, analytics, settings | Retained temporarily for potential reinstallation | Up to 48 hours |
| shop/redact webhook (48hrs after uninstall) | All remaining shop data including offers, analytics, settings | Permanently and irreversibly deleted | Within 48 hours of webhook receipt |
| Customer data request | Customer personal data | No action required — we do not store customer personal data | Immediate response |
| Customer redact request | Customer personal data | No action required — we do not store customer personal data | Immediate response |
GDPR Compliance
OffersMax fully complies with Shopify's mandatory GDPR webhook requirements and the General Data Protection Regulation (GDPR) where applicable.
| GDPR Webhook | Trigger | Our Response |
|---|---|---|
| customers/data_request | A customer requests a copy of their data from your store | We confirm that OffersMax does not store any personal customer data. No customer data file is generated. |
| customers/redact | A customer requests deletion of their personal data | We confirm that OffersMax does not store any personal customer data. No deletion action is required. |
| shop/redact | 48 hours after your store uninstalls OffersMax | We permanently delete all store data including offers, analytics, settings, and session records. |
As OffersMax does not collect or process personal data about your customers, it functions as a data processor with minimal data processing obligations under GDPR. The data we do process (merchant store domain, access tokens, offer configurations) is processed on the legal basis of contract performance — specifically, to fulfil our service agreement with you as a merchant.
Data Security
We implement industry-standard security measures to protect your data:
- Encryption in transit: All data transmitted between your store and OffersMax uses HTTPS/TLS encryption
- Encryption at rest: All data stored on our AWS servers is encrypted at rest using AES-256 encryption
- Access token security: Shopify access tokens are stored securely in our database and are never exposed in frontend code, logs, or error messages
- Webhook validation: All incoming webhooks from Shopify are validated using HMAC signature verification to prevent unauthorized requests
- Infrastructure security: Our AWS infrastructure is configured with security groups, private networking, and regular security updates
- Least privilege: We request only the minimum Shopify API scopes necessary to operate OffersMax
While we implement strong security measures, no method of transmission over the internet or method of electronic storage is 100% secure. In the event of a data breach that affects your store, we will notify you in accordance with applicable law.
Cookies & Tracking
OffersMax uses minimal client-side storage for functional purposes only:
| Storage Type | What Is Stored | Purpose | Duration |
|---|---|---|---|
| sessionStorage | Whether an offer popup has been shown in the current browsing session | Prevent showing the same offer popup repeatedly in one visit | Cleared when browser tab is closed |
We do not use advertising cookies, tracking pixels, third-party analytics scripts, or any persistent cookies on your storefront. The OffersMax admin panel (embedded in Shopify Admin) uses session tokens provided by Shopify's App Bridge for authentication — these are managed by Shopify, not by us.
Your Rights
As a merchant using OffersMax, you have the following rights regarding your data:
- Right to access: You can view all your offer configurations, settings, and analytics at any time through the OffersMax dashboard
- Right to deletion: You can delete individual offers from the OffersMax dashboard at any time. Uninstalling the app will result in complete deletion of all your data within 48 hours
- Right to portability: Contact us at business@fovcommerce.com to request an export of your offer data
- Right to correction: You can edit your offer configurations and settings directly in the OffersMax dashboard at any time
- Right to withdraw consent: You can uninstall OffersMax at any time from your Shopify Admin, which will terminate data processing
To exercise any of these rights or if you have questions about your data, please contact us at business@fovcommerce.com.
Children's Privacy
OffersMax is a business-to-business (B2B) application intended for use by Shopify merchants, not by individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a minor, please contact us immediately at business@fovcommerce.com and we will take steps to delete such information.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:
- Update the "Last Updated" date at the top of this page
- Notify active merchants via the OffersMax dashboard banner
- For significant changes, provide at least 30 days notice before the changes take effect
Your continued use of OffersMax after any changes to this Privacy Policy constitutes your acceptance of the updated policy. We encourage you to review this page periodically.
Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
Fov Labs — Privacy Team
A product division of Fovcommerce · We respond to all privacy inquiries within 2 business days
✉ business@fovcommerce.com
Mailing address: Fovcommerce, India
App website: offersmax.fovcommerce.com
Shopify Partner: Fov Labs