Privacy policy

Information we process

• Merchant account, store, app configuration, and product information.
• Order, fulfillment, refund, and cancellation details relevant to configured journeys.
• Customer name, email address, and email-marketing consent state when needed to send an eligible message.
• Email scheduling, delivery, bounce, complaint, click, unsubscribe, and conversion records.
• Technical and security information needed to operate and protect the service.

We do not need customer phone numbers or postal addresses and do not request those protected fields from Shopify.

How we use information

We use information only to operate the app, enroll eligible sample orders, send merchant-configured follow-up, attribute qualifying purchases, provide reporting, prevent duplicate or inappropriate messages, support merchants, and meet security and legal obligations.

Promotional follow-up is limited to customers whose current Shopify email-marketing consent permits it. A customer can also unsubscribe specifically from SampleLift messages without changing their broader Shopify marketing preference.

Service providers and disclosure

We use Shopify to provide commerce data and authentication, Vercel to host the application, Neon to host the database, and Resend to deliver email. These providers process information on our behalf to provide their services. We may also disclose information when required by law, to protect rights or safety, or as part of a business transaction subject to appropriate safeguards. We do not sell customer personal information.

Retention and deletion

We retain information only as long as needed for the app’s operation, reporting, security, and legal obligations. Provider event records are removed after 91 days, and customer data-request exports expire after 30 days. Shopify’s mandatory customer and shop redaction requests delete the corresponding locally stored data. Merchants can uninstall the app to stop future processing.

Security and international processing

We use encrypted connections, managed encrypted storage, signed webhooks, access controls, data minimization, and operational review to protect information. Our providers may process information in countries other than the merchant’s or customer’s country, subject to their contractual and legal safeguards.

Requests and questions

Customers should generally contact the Shopify merchant from whom they purchased. Merchants can contact us about access, correction, deletion, or other privacy questions.