SCRATCHME
Privacy Policy
Last updated: 8 July 2026
ScratchMe (“the App”, “we”, “us”) is a Shopify app that shows a welcome / reward popup on a merchant’s online store to capture email and, optionally, phone subscribers, issue single-use discount codes, and report simple analytics to the merchant. This policy explains what personal data the App processes, why, and how it is protected.
Controller vs processor. For personal data collected from shoppers through the popup, the merchant (the store that installed the App) is the data controller. ScratchMe acts as a data processor on the merchant’s behalf.
1. Information we process
- Shopper details (via the popup): the email address and — if the shopper chooses to provide it — the phone number they submit, along with their marketing consent choices.
- Order attribution (for ROAS analytics): when an order is paid, we read the order’s total amount and the discount code used, to attribute revenue to the reward popup. We do not store customer names, addresses, or payment details from orders.
- Store & configuration data: the store’s myshopify domain and the popup settings the merchant configures.
We do not collect more personal data than is needed to provide the App.
2. How we use the information
- To display the popup and issue each visitor a unique, single-use discount code.
- To sync new subscribers to the merchant’s own Klaviyo account, if the merchant connects one.
- To show the merchant aggregate analytics (views, sign-ups, redeem rate and ROAS).
We do not use personal data for any other purpose, and we do not sell personal data.
3. Sharing & sub-processors
- Klaviyo — where the merchant configures it, subscriber email/phone and consent are sent to the merchant’s Klaviyo list. Klaviyo processes that data under its own terms.
- Infrastructure — the App is hosted on Cloudflare and stores data in a secured database. These providers process data only to host the service.
We never sell personal data and never share it for third-party advertising.
4. Storage, security & retention
- Data is transmitted over encrypted connections (HTTPS/TLS) and access is restricted.
- Retention & deletion. We keep personal data only as long as needed to provide the App, and we honour Shopify’s mandatory data-privacy requests:
- Customer redaction — when a shopper (via the merchant) requests deletion, we erase that person’s captured record and issued code.
- Shop redaction — when a merchant uninstalls the App, we erase all of that store’s data (within Shopify’s 48-hour window).
- A merchant may also request deletion of their store’s data at any time by contacting us.
5. Your rights
Shoppers can exercise access and deletion rights through the store they interacted with; the merchant relays these requests to us and we action them via the mechanisms above. Merchants can contact us directly for any data request.
6. Changes to this policy
We may update this policy; the “last updated” date above reflects the latest version.
7. Contact
Questions or data requests: bselimbuyukelci@gmail.com.