AppVerix Quantity Breaks: Privacy Policy
Last updated: 14 October 2026
AppVerix Quantity Breaks (“the app”) is a Shopify app published by AppVerix (“we”, “us”). This policy explains what the app collects when a merchant installs it, why, where it is kept, and how to have it deleted.
The app does not store personal data of a store’s customers. Offers, assignments and stats are merchant records. For any customer data that stays in Shopify, the merchant is the controller.
1. What we collect and why
From the merchant’s store (through Shopify’s API):
| Data | Why | Do we store it? |
|---|---|---|
| Shop domain, shop name, contact email, country and currency | To identify the store, open the app in Shopify Admin, and pick a default language | Shop domain, yes. Other shop profile fields are read when needed and not kept as a customer record |
| An access token from Shopify | So the app can stay installed and read products, collections or tags you pick in the assignment picker | Yes, in the login session, until you uninstall |
| Product, collection and tag identifiers you assign to an offer | To decide which offer applies on a product page or at checkout | Yes, as part of the offer assignment |
| Customer names, emails, addresses, payment details, or full order contents | The app does not need this to apply a quantity break | No |
What the app saves in its database:
- Your offers: name, tier quantities, percent or fixed amounts, the optional most-popular flag, display mode (table or quantity buttons), and a starter-template key if you used one.
- Assignments: which products, collections, tags or the whole store each offer is for (an id and a label you or Shopify provided).
- Merchant-only stats: counts such as how often an offer applied and units sold at a break. These contain no customer names, emails or addresses.
- Shop settings: the admin language you chose, and whether the product-page embed is on.
- Login session: shop domain, granted scopes, access token, and refresh token when Shopify issues one.
- Compliance log: the topic and payload Shopify sent on a privacy webhook, so we can show that we handled the request. These are not used for marketing.
Discounts at cart and checkout are calculated by Shopify Functions on Shopify’s side. We do not keep a copy of the shopper’s cart.
We do not collect payment card data, phone numbers, browsing data, analytics, or cookies for tracking. The app sets no advertising or analytics cookies. We do not sell or share personal data, and we do not use it for profiling or automated decisions.
2. Who processes data for us
| Provider | What for | Data they see | Location |
|---|---|---|---|
| Cloudflare (cloudflare.com) | Hosting for the app and its D1 database | Everything listed in section 1 | Globally distributed |
| Shopify | The platform the app runs on; also handles billing for the app | Already holds shop and catalog data; Functions apply the discount at checkout | See Shopify’s privacy policy |
Each provider has its own privacy terms. Where data leaves the EEA/UK, we rely on the provider’s Standard Contractual Clauses or other approved transfer mechanisms.
3. How long we keep it
- Offers, assignments, stats and shop settings: while the app is installed.
- When you uninstall: we delete the login session right away. Shopify sends us a
shop/redactrequest 48 hours later, and we then delete all of that store’s offers, assignments, stats, settings and compliance logs. - When a customer asks to be deleted (Shopify
customers/redact): we do not hold customer personal data to delete. We log that the request arrived. - Server logs: kept for up to 7 days.
4. Your rights and data requests
The app supports Shopify’s three privacy webhooks:
customers/data_request: we reply that we do not store that customer’s personal data.customers/redact: we have no customer record to delete; we log the request.shop/redact: we delete all data for the store.
Merchants can also email support@appverix.com to ask for a copy of their data or to have it deleted. We answer within 30 days. Customers of a store should contact the store first.
If you are in the EEA/UK you may also complain to your local data protection authority. In Brazil, the LGPD applies; contact us at support@appverix.com.
5. Security
- All traffic to the app uses HTTPS (TLS).
- The database is hosted on Cloudflare D1, which encrypts data at rest.
- Webhooks from Shopify are verified with their HMAC signature; unsigned requests are rejected.
- The app checks a Shopify session token on every admin request; it does not use third-party cookies.
- Access to production infrastructure is restricted and protected by two-factor authentication.
- If we learn of a breach that affects your data, we will tell you without undue delay and within 72 hours where the law requires it.
6. Changes
If we change this policy in a way that matters, we will update the date at the top and tell merchants inside the app or by email.
7. Contact
AppVerix. Email: support@appverix.com