This policy applies to data processed through the App, related payment services, our website, and support communications. It does not apply to third-party services, such as Shopify, Klaviyo, or Google Analytics, that have their own privacy policies.
Have questions? Email us directly at support@innoloyalty.com.
1) Roles and Scope
Merchants
When a Shopify merchant installs and uses the App, the merchant is typically the data controller of customer personal data because the merchant decides why and how customer data is used for its Inno pay. We generally act as a data processor or service provider for that customer data, processing it on the merchant’s instructions.
Customers
Customers may interact with Inno pay widgets, Inno pay pages, payment list, qr-code, and other payment features provided through a merchant’s Shopify store. Customers should direct privacy requests to the merchant first. We will assist merchants in fulfilling applicable privacy requests where required.
Website Visitors and Support Contacts
When visitors use our website or contact us for support, we may process information directly for website operations, support, security, and business administration.
2) Information We Collect
A) Merchant and Store Information
We may collect merchant and store information from Shopify or directly from the merchant, including:
- Store name, store domain, and Shopify store identifiers
- Merchant contact information associated with the Shopify store, such as store owner or account contact name and email address, where available through Shopify or provided by the merchant
- Locale, timezone, and other store settings
- Billing-related status, such as whether a subscription is active
- App settings, configuration choices, and support communications
We do not receive or store full payment card details from Shopify billing.
B) Customer, Order, and Payment Information
As needed to run Inno pay features configured by the merchant, we may process:
- Customer identifiers, such as Shopify customer ID
- Customer name, where needed to identify the customer and operate payment features
- Order-related information needed to calculate and manage payment activity, such as order ID, order totals, and currency
We only access customer and order data that is reasonably necessary to provide the App and related payment services.
C) App, Device, and Technical Information
We may collect technical and usage information related to the App and Services, including:
- Log data, such as IP address, device/browser type, timestamps, and request information
- App usage events, such as pages visited or actions within the App admin
- Error logs and performance metrics
- Security and diagnostic information
D) Cookies and Similar Technologies
If a merchant publishes storefront Inno pay features, such as a Inno pay widget, the App may use cookies or similar technologies that are essential or functional to provide the Services. For example, these technologies may help maintain login or session state, display payment amount, and show payment status.
Our website may use Google Analytics to help us understand website traffic and improve website content. Google Analytics may collect information such as pages visited, device/browser information, approximate location derived from IP address, referral source, and usage events.
We do not use third-party advertising cookies in the App for ad targeting or cross-site tracking. Merchants remain responsible for ensuring their storefront cookie disclosures and consents meet local requirements.
3) How We Use Information
We use information to:
- Provide and operate payment features, including order ID, payment amount, and currency
- Maintain payment or payment request records, authentication, and App settings
- Provide customer support and respond to requests
- Monitor, debug, secure, and improve the App and Services
- Analyze website traffic and improve website content
- Comply with legal obligations and enforce our terms
4) Legal Bases for Processing
For individuals in the EEA or UK, our legal bases for processing may include:
- Contractual necessity: to provide the App and Services to merchants, including processing merchant, store, customer, order, and payment data needed to operate Inno pay features.
- Legitimate interests: to operate, secure, debug, improve, and support the App and Services, provided those interests are not overridden by individuals’ rights.
- Compliance with legal obligations: to meet applicable legal, regulatory, platform, or lawful request obligations.
Where required, merchants are responsible for establishing an appropriate legal basis for their customer communications, marketing activities, and Inno pay operation.
5) Email Notifications and Klaviyo Integration
The App can send selected payment events to Klaviyo so merchants can configure their own email flows and templates, such as payment updates or status confirmations.
We do not send marketing emails to customers on the merchant’s behalf unless the merchant independently configures that within Klaviyo or another tool.
Data sent to Klaviyo depends on the merchant’s configuration and may include customer identifiers and Inno pay related event properties.
Klaviyo’s processing is governed by the merchant’s agreement with Klaviyo and Klaviyo’s privacy policy.
7) Data Retention
We retain information only as long as needed to provide the Services, comply with legal, accounting, or reporting requirements, resolve disputes, enforce agreements, maintain security, or meet Shopify’s privacy requirements.
When a merchant uninstalls the App, Shopify may send us a shop redaction request after uninstall. We process applicable Shopify privacy and deletion requests in accordance with Shopify’s requirements and applicable law.
Where we receive a valid Shopify privacy webhook or deletion request, we will complete the required action within the timeframe required by Shopify, unless retention is required by law or necessary for legitimate business purposes such as security, fraud prevention, billing records, or dispute resolution.
Merchants may contact us at support@innoloyalty.com to request deletion assistance where applicable.
8) Shopify Privacy Requests
We respond to applicable privacy requests received through Shopify’s required privacy mechanisms, including:
- Customer data requests
- Customer redaction requests
- Shop redaction requests
Where applicable, we process these requests in accordance with Shopify’s requirements and applicable law.
Customers should generally contact the merchant first regarding privacy requests related to a merchant’s Inno pay payment. We will assist the merchant in fulfilling applicable requests as needed.
9) Security
We use reasonable administrative, technical, and organizational measures designed to protect information from unauthorized access, disclosure, alteration, or destruction.
However, no method of transmission or storage is completely secure. We cannot guarantee absolute security.
10) International Transfers
We may process and store information in countries other than the merchant’s or customer’s country. Where required, we use appropriate safeguards for cross-border data transfers.
11) Privacy Rights and Choices
Merchants
Merchants can access and manage merchant information in the App and in Shopify. Merchants may also contact us to request access, correction, or deletion of certain data.
Customers
Customers should contact the merchant, meaning the Shopify store they purchased from or interacted with, to request access, correction, deletion, or other rights regarding customer personal data used for that merchant’s Inno pay application.
We will support merchants in fulfilling applicable privacy requests where required.
Depending on location, individuals may have rights under laws such as GDPR, UK GDPR, CCPA/CPRA, and other applicable privacy laws, including:
- Access to personal information
- Correction of inaccurate data
- Deletion
- Objection or restriction, in certain cases
- Data portability, in certain cases
To submit a request, contact support@innoloyalty.com and include the Shopify store domain and details of the request. We may need to verify identity and authority before processing the request.
12) Children’s Privacy
The Services are not directed to children, and we do not knowingly collect personal information from children under the age required by applicable law.
If you believe a child has provided personal information through the Services, contact us and we will take appropriate steps.
13) Changes to this Privacy Policy
We may update this Privacy Policy from time to time. We will post the updated version and revise the “Last updated” date above.
Material changes may be communicated through the App or other reasonable means.
14) Contact Us
If you have questions about this Privacy Policy or our data practices, contact us at:
Innoflow Ltd.Email: support@innoloyalty.com