Privacy Policy
Vibe96 Loyalty · Last updated 22 October 2026
This policy explains what personal data the Vibe96 Loyalty app for Shopify ("the app") processes, why, and how it is protected. The app is provided by Vibe96 ("we").
Who is responsible
For the shoppers of a store, the merchant who installed the app decides how their data is used (the merchant is the "controller"). We process that data only to run the app for the merchant (we are the "processor"), as described in the data processing terms.
What we store
| Data | Why |
|---|---|
| Store domain, app settings, and the access token Shopify gives the app (encrypted) | To run the app for the store |
| The shopper's Shopify customer ID (encrypted) | To know whose points are whose |
| Points balance and points history: type, amount, date, and a short note such as an order number or reward code (note encrypted) | To show balances and history to the merchant and shopper |
| One-way fingerprints of customer and order IDs | To find records and avoid counting an order twice, without storing the IDs in plain form |
We do not store shoppers' names, email addresses, phone numbers or addresses. The app does not request access to these fields. When a paid order arrives, the app reads the order subtotal to calculate points and does not keep it.
What we use it for
Only to award, take back (after refunds) and redeem loyalty points, and to show this to the merchant and the shopper. We do not use the data for advertising, profiling, or automated decisions with legal or similarly significant effects, and we never sell or rent it.
Who we share it with
- Shopify: the app works through Shopify's systems, for example to create reward discount codes.
- our server hosting provider: hosts the server and database the app runs on.
We share data with no one else, unless the law requires it.
How we protect it
- All traffic uses HTTPS (encrypted in transit).
- Customer IDs, history notes and access tokens are encrypted in the database (AES-256).
- Every request from Shopify is checked for a valid Shopify signature.
- Access to the server is limited to the people who maintain the app.
How long we keep it
- While the app is installed, so balances stay correct.
- When a store uninstalls the app, its access token is deleted at once. All of the store's data, including all shopper data, is deleted when Shopify sends its deletion request (48 hours after uninstalling).
- When a merchant or shopper asks Shopify to erase a shopper's data, Shopify tells the app and we delete that shopper's records.
- Server logs contain no shopper personal data and are kept for 14 days.
Shoppers' rights
Shoppers can ask the store they bought from to see or delete their data; the store's request reaches us through Shopify and we act on it. Merchants can see every shopper's points history in the app, and can contact us at support@vibe96.com.
Changes
If this policy changes, we update the date at the top and tell merchants inside the app.