Privacy Policy

This Privacy Notice for Promly ("we," "us," or "our") describes how and why we might access, collect, store, use, and/or share ("process") your personal information when you use our services ("Services"), including when you:

• Visit our website at https://promly.app or any website of ours that links to this Privacy Notice
• Install or use PromoOS, our promotional campaign management app for Shopify stores
• Join our waitlist or engage with us in other related ways, including any marketing or events

Questions or concerns? Please contact us at contact@promly.app.

1. What Information Do We Collect?

Store data (via Shopify OAuth)

When you install PromoOS from the Shopify App Store, Shopify provides us with:

• Store information: Shop domain, store name, and email address
• Shopify access token: Encrypted at rest using AES-256-GCM and used to make authorized API calls to your store on your behalf
• Store metadata: Plan type, currency, and timezone
• Product catalog: Product titles and IDs (read-only, to configure promo targeting)
• Theme data: Theme configuration for displaying promotional content via app blocks
• Order data: Aggregate order information via webhooks (discount usage, revenue totals) — we do not store individual customer details from orders
• Discount codes: We create and manage discount codes on your behalf as part of promo campaigns

Data you create in the app

• Promo configurations: Campaign names, discount settings, start/end dates, placement content, and uploaded images
• Deployment history: Records of when promotions were activated or deactivated on your store
• Aggregate metrics: Daily totals for orders, revenue, and discount usage per promo (not linked to individual customers)
• Event logs: Promo lifecycle events (created, scheduled, deployed, deactivated) for audit and debugging
• Access audit logs: Records of when order data is processed (store scope and resource ID only — no customer PII)

Waitlist data

If you join our waitlist, we collect: name, email address, website URL, and company size.

Information automatically collected

• Log and usage data: IP address, browser type, device information, pages viewed, features used, and timestamps
• Session data: Encrypted HTTP-only session cookies used to keep you authenticated while using the app
• Session replay (signed-in merchants only): Recordings of how you use the PromoOS app, such as clicks, navigation, and what is shown on screen (see Section 5)

What we do NOT collect

Promly does not store customer personally identifiable information (PII). We do not collect or retain:

• Individual customer names, emails, or contact information
• Payment or credit card details
• Customer shipping or billing addresses
• Individual order details (only aggregate metrics)

2. How Do We Process Your Information?

• To provide and deliver the Services: We use your Shopify access token to read and write discount codes, products, and themes on your store as directed by your actions within PromoOS
• To manage your account and subscription: We use your store and billing information to manage your plan and process subscription payments through Shopify Billing
• Performance tracking: Displaying aggregate promo performance metrics on your dashboard
• To improve our Services: We may use aggregated, non-identifiable usage data to understand how the app is used and improve its features
• To communicate with you: We may contact you via email for service updates, important notices, or (with your consent) marketing communications
• For security and fraud prevention: We monitor usage to detect abuse and unauthorized access
• To comply with legal obligations: We process data as required by applicable law

3. What Legal Bases Do We Rely On?

We only process your personal information when we have a valid legal reason to do so.

If you are located in the EU or UK, this section applies to you.

The GDPR and UK GDPR require us to explain the legal bases we rely on:

• Performance of a Contract: We process your information to fulfill our contractual obligations — providing the PromoOS service you have installed and subscribed to
• Legitimate Interests: We process certain data (such as usage analytics, session replay inside the app, and security monitoring) based on our legitimate interest in operating and improving our service
• Legal Obligations: We may process data to comply with applicable laws and regulations
• Consent: We may process your information for marketing communications where you have given consent — you can withdraw consent at any time by contacting us

This Privacy Notice is governed by the laws of Israel. Israeli privacy law (Protection of Privacy Law, 5741-1981) and the Israeli Privacy Protection Regulations (Data Security) apply to our processing activities.

4. When and With Whom Do We Share Your Personal Information?

We use the following third-party services to operate Promly. These providers process your data only as necessary to deliver the service:

• Shopify: Platform integration for store data, discounts, and theme management. Shopify's own privacy policy governs how they process your data as a platform.
• Render.com: Application hosting and managed PostgreSQL database (Oregon, US)
• Cloudflare: Frontend hosting and CDN
• Resend: Transactional email delivery
• Anthropic: AI model provider. When you use the Text to Promo feature, the promotional brief you type is sent to Anthropic's API for processing. Anthropic processes this data in the United States. The brief contains only the campaign intent you provide (e.g., "20% off dresses this weekend") — no customer PII, no order data, no Shopify credentials. Anthropic's data use is governed by their Privacy Policy.
• PostHog: Product analytics. We use PostHog to understand how visitors use our marketing website and how merchants use PromoOS, including page views, clicks, and feature usage and, for signed-in merchants, session replay (see Section 5). In the app, this is tied to your store ID and shop domain, not your name or email. On the marketing website, this is active by default and stops if you decline cookies (see Section 5). PostHog's data use is governed by their Privacy Policy.
• Google (Analytics and Ads): On our marketing website, Google Analytics measures visitor traffic and content performance, and Google Ads records when an install can be attributed to a Google ad (using Google's own click identifier). Both are off by default and only run if you accept cookies. Google's data use is governed by their Privacy Policy.
• Meta (advertising measurement): On our marketing website, the Meta Pixel records page views and, if you click through, your click on our "Install" button, so we can measure the performance of our ads on Facebook and Instagram (using Meta's own cookie and browser identifiers). This is off by default and only runs if you accept cookies (see Section 5). No customer PII, order data, or Shopify credentials are sent to Meta. Meta's data use is governed by their Privacy Policy.
• OpenAI (advertising measurement): On our marketing website, OpenAI's measurement tools record page views, clicks through to our Shopify App Store listing, and app installs, so we can measure the performance of our ads on ChatGPT. This runs by default unless you decline cookies (see Section 5). Unlike the other providers in this list, OpenAI is not only processing this data on our behalf — under OpenAI's Conversion Terms, OpenAI may also use it to build advertising audiences and to improve OpenAI's own products, and OpenAI and Promly are each independently responsible for this data under applicable privacy law. No customer PII, order data, or Shopify credentials are sent to OpenAI — only your visit to our marketing pages and, if you click through, your click on our "Install" button. OpenAI's data use is governed by their Privacy Policy. See Section 13 for your rights regarding this sharing.
• Business transfers: If we are involved in a merger, acquisition, or sale of assets, your information may be transferred. We will notify you before your information becomes subject to a different privacy policy.
• Legal requirements: We may disclose your information where required by law or to protect our legal rights.

We do not sell your personal information, and we do not share it with third parties for their own marketing purposes — the advertising-measurement sharing described above is solely so we can measure our own ad campaigns, and you can turn it off at any time (see Section 5).

5. Do We Use Cookies and Other Tracking Technologies?

Essential cookies (the PromoOS app)

The Promly app uses essential session cookies to maintain your authenticated session. These are HTTP-only, secure cookies with SameSite protection that cannot be accessed by client-side scripts. These are required to use the app — refusing them will prevent you from using the authenticated portions of PromoOS.

Session replay (the PromoOS app)

When you are signed in to the PromoOS app, we use PostHog session replay to record how the app is used: clicks, navigation, and what appears on screen. We use these recordings to find usability problems and improve PromoOS. Text you type into form fields is masked and is not recorded. Information shown on screen, such as promo names, discount values, and your store's domain, may be visible in a recording. We do not record the headers or bodies of requests and responses between the app and our servers, and query parameters in page addresses (such as your shop and store ID) are removed, apart from advertising campaign tags. Recordings are kept for 30 days. We do not record visitors to our marketing website who are not signed in. If you have declined cookies on our website in your browser, replay is off in that browser. To ask us to delete recordings of your sessions, see Section 16.

Analytics and advertising cookies (the marketing website)

On our marketing website (promly.app), we use cookies from PostHog, Google, Meta, and OpenAI to understand visitor behaviour and measure how well our advertising is working (see Section 4). PostHog and OpenAI are active by default; Google Analytics, Google Ads, and Meta are off by default. All of them are controlled by the cookie banner shown on your first visit:

• Accept: keeps PostHog and OpenAI's advertising measurement active, and turns on Google Analytics, Google Ads, and the Meta Pixel.
• Decline: turns off all of the above for your browser. Only essential session cookies remain, if you sign in to the app.

You can change your choice at any time by clearing the site's local storage in your browser (the banner will reappear), or by blocking or deleting cookies in your browser settings — see your browser's help documentation for how. Most browsers also let you refuse or delete cookies globally.

6. Do We Offer Artificial Intelligence-Based Products?

As part of our Services, we offer products, features, or tools powered by artificial intelligence, machine learning, or similar technologies (collectively, "AI Products"). These tools are designed to enhance your experience and provide the Text to Promo functionality. The terms in this section govern your use of the AI Products within our Services.

Use of AI Technologies

We provide the AI Products through third-party service providers ("AI Service Providers"), including Anthropic. As outlined in their respective terms and privacy policies, our AI Service Providers may train their AI models on the data we exchange with them.

• AI Service Provider: Anthropic
• Intended Functions: AI insights, Natural language processing
• Data Processed: The promotional brief you enter in the Text to Promo feature — for example, "Run a 20% off campaign on dresses this weekend." This is merchant-authored campaign intent only. No customer PII, no order data, and no Shopify credentials are included in what is sent to Anthropic.

How We Process Your Data

All personal information processed using our AI Products is handled in line with our Privacy Notice and our agreement with Anthropic. If you use our AI Products, you consent to this. We will not use your data for training or improving AI models without your separate, explicit consent.

How to Opt Out

If you do not wish your promotional briefs to be processed by Anthropic's AI, simply do not use the Text to Promo feature. All other PromoOS functionality is available without it. To request deletion of any data already processed, contact us at contact@promly.app.

7. Shopify Platform and Data

Platform dependency

PromoOS operates as a third-party application on the Shopify platform. Service availability depends on the availability of Shopify's platform and APIs. We are not liable for interruptions, changes, or discontinuation of services caused by Shopify. Users must comply with Shopify's Terms of Service in addition to ours.

Shopify API scopes we use

PromoOS requests the following Shopify API access, used solely to provide the promotional campaign features of the app:

• Read and write discount codes and price rules
• Read and write theme assets (for banner display via app blocks)
• Read products and collections (for promo targeting)
• Read store information and settings
• Read Shopify Rollouts that affect your discounts (so the app can show when a Rollout changes who gets a discount)
• Read aggregate order data via webhooks (no customer PII)

GDPR compliance

Shopify sends us mandatory GDPR webhooks. Here is how we handle each:

• Customer data access requests: Acknowledged and confirmed as containing no customer-identifiable data (we store only aggregate metrics)
• Customer data erasure requests: Acknowledged and confirmed — no customer PII to erase
• Shop data deletion (on uninstall): About 48 hours after you uninstall, Shopify sends us a deletion notice, and we then permanently delete your store data from our database. Analytics and session replay recordings are handled separately; see Section 8 for details.

To ask for deletion of your data, including analytics, see Section 16.

8. How Long Do We Keep Your Information?

We retain data only as long as necessary. Automated purge jobs run daily to enforce these retention windows:

• Active stores: Promo configurations, uploaded assets, and store settings are retained while the app is installed and your store is active
• Aggregate promotional metrics (daily revenue, order counts, discount usage per promo): retained for 730 days (2 years), then automatically purged
• Event logs (promo creation, deployment, status changes): retained for 365 days (1 year), then automatically purged
• Access audit logs (records of order data processing): retained for 365 days (1 year), then automatically purged
• Session replay recordings (signed-in merchants): retained for 30 days, then automatically deleted
• Uninstalled stores: Store data is deleted after Shopify's deletion notice, about 48 hours after uninstall. Analytics, replay recordings and backups follow the schedules below.
• Waitlist data: Retained until you unsubscribe or request deletion

When all of your data is deleted

• If you uninstall PromoOS: About 48 hours after you uninstall, Shopify sends us a deletion notice. When it arrives, we permanently delete your store data from our database: your store record and access token, promos and their settings, uploaded assets, metrics, event logs, sessions, AI drafts, and email sequence state. If you have reinstalled by the time the notice arrives, we do not delete anything.
• Session replay recordings: Deleted automatically 30 days after they are made, whether or not you uninstall.
• Usage analytics (PostHog): Analytics tied to your store ID are not removed automatically when you uninstall. We delete them, along with any replay recordings, when you ask us to (see Section 16).
• Backups and service providers: Encrypted backups of our database held by our hosting provider age out on the provider's own rolling schedule. Records held by other service providers we use, such as email delivery, follow their own retention periods.

9. How Do We Keep Your Information Safe?

All merchant data is stored and processed in Oregon, United States (Render.com US-West region).

• Encryption at rest: Your Shopify access token is encrypted using AES-256-GCM before storage. Database backups are encrypted by the hosting provider.
• Encryption in transit: All data transmitted between your browser, our servers, and Shopify uses TLS/SSL
• Session security: HTTP-only, secure session cookies with SameSite protection and CSRF middleware
• Webhook verification: All Shopify webhooks are verified using HMAC-SHA256 timing-safe signatures with 24-hour replay prevention
• Access logging: Every access to order data is logged in an audit trail with store scope, resource type, and timestamp — no customer PII is recorded
• Access controls: Access to production systems and databases is restricted to authorized personnel only

No electronic transmission over the internet can be guaranteed to be 100% secure. You should only access the Services within a secure environment.

10. Do We Collect Information from Minors?

PromoOS is intended for use by Shopify store owners and operators, who must be at least 18 years of age. We do not knowingly collect personal information from children under 18. If you believe we have collected information from a minor, please contact us at contact@promly.app.

11. What Are Your Privacy Rights?

Depending on your location, applicable data protection laws may give you the following rights:

• Right to access — request a copy of the personal information we hold about you
• Right to rectification — request correction of inaccurate information
• Right to erasure — request deletion of your personal information (uninstalling the app triggers automatic deletion of your store data; you can also email us, see Section 16)
• Right to restrict processing — request that we limit how we use your data
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interests
• Right to withdraw consent — where processing is based on consent, withdraw it at any time
• Unsubscribe from marketing — click the unsubscribe link in any email we send, or contact us directly

If you are located in the EEA or UK and believe we are unlawfully processing your personal information, you also have the right to complain to your Member State data protection authority or UK data protection authority.

To exercise any of these rights, contact us at contact@promly.app.

12. Controls for Do-Not-Track Features

Most web browsers include a Do-Not-Track ("DNT") feature. As no uniform technology standard for recognizing DNT signals has been finalized, we do not currently respond to DNT signals. If a standard is adopted that we must follow, we will update this Privacy Notice accordingly.

California law requires us to let you know how we respond to web browser DNT signals. Because there currently is no industry or legal standard for honoring DNT signals, we do not respond to them at this time.

13. Do United States Residents Have Specific Privacy Rights?

If you are a resident of California, Colorado, Connecticut, or another US state with applicable privacy legislation, you may have additional rights. PromoOS does not sell personal information.

California residents — sale and sharing. We do not sell personal information. Under the CPRA, sending advertising-measurement data (page views, ad clicks, install events) to OpenAI's advertising tools may be treated as "sharing" for cross-context behavioural advertising, because OpenAI is not solely a service provider for this data (see Section 4). You can opt out of this sharing — and of PostHog, Google Analytics/Ads, and the Meta Pixel — at any time via the cookie banner on promly.app (Section 5). To exercise this or any other right under this section, email us at contact@promly.app.

To exercise your rights, email us at contact@promly.app.

14. Do We Make Updates to This Notice?

We may update this Privacy Notice from time to time. The updated version will be indicated by an updated "Last updated" date at the top. If we make material changes, we will notify you by email or through a notice in the app. We encourage you to review this Privacy Notice periodically.

15. How Can You Contact Us?

If you have questions about this privacy policy, wish to exercise your data rights, or have concerns about how your data is handled, please contact us at:

16. How Can You Review, Update, or Delete the Data We Collect From You?

Based on the applicable laws of your country or state, you may have the right to request access to the personal information we collect from you, correct inaccuracies, or delete your personal information. To submit a request:

• Email us at contact@promly.app
• Uninstall PromoOS from your Shopify store. This triggers deletion of your store data about 48 hours later; analytics and replay recordings follow Section 8.

Asking us to delete your data

To ask us to delete your data, email contact@promly.app from the email address on your Shopify store, or include your store's .myshopify.com address. We may ask you to confirm that you own the store. Once we have verified this, we will delete the data described in Section 8, including your analytics profile and replay recordings, and confirm to you by email, within 30 days. If you only visited our marketing website, that analytics data is not linked to your name or email. Contact us and we will explain how to find your browser's analytics ID so we can locate and delete it.