Privacy Policy

1. Who We Are

Compel ("we," "us," or "our") is a Shopify application that provides conversion optimization tools for Shopify merchants. Our app is available at apps.shopify.com/compel and our website is trycompel.com.

For privacy inquiries, contact us at: privacy@trycompel.com

2. Who This Policy Covers

This Privacy Policy covers two groups of people:

• Merchants — Shopify store owners and their team members who install and use the Compel app.
• Shoppers — End customers who visit Shopify stores where Compel widgets are active. Compel processes limited, anonymized shopper data on behalf of merchants to render certain widgets (specifically the Recent Sales Popup).

3. Data We Process

3.1 Merchant Data

When a merchant installs Compel, we store the following in our database:

3.2 Shopper Data (Recent Sales Popup Only)

To power the Recent Sales Popup widget, Compel reads recent order data from the merchant's Shopify store via the Shopify Admin API. We apply strict data minimization:

Critical: This data is never stored. It is fetched from Shopify, sanitized in memory, and returned to the shopper's browser. It is never written to our database, never logged, and never retained after the API response is sent. Client-side, it is cached in browser sessionStorage for up to 15 minutes and automatically cleared when the browser session ends.

3.3 Analytics Data (Anonymous)

Compel's storefront widgets track anonymous impression and engagement events to power the Persuasion Analytics dashboard. This data includes:

• Widget type that was viewed or interacted with
• Page type (product, collection, cart, etc.)
• Anonymous session ID (randomly generated, not linked to any individual)
• Timestamp

No personally identifiable information is included in analytics events. IP addresses are not logged.

4. How We Use Data

We use the data described above solely to:

• Provide and operate the Compel app and its widgets
• Render conversion widgets on the merchant's storefront
• Display analytics data to the merchant in their Compel dashboard
• Diagnose technical issues and maintain service reliability
• Communicate with merchants about their account (transactional only)

We do not use any data for advertising, profiling, resale, or any purpose beyond operating the service.

5. Data Sharing

We do not sell personal data. We do not share personal data with third parties except:

• Shopify Inc. — as required to operate on the Shopify platform. Our use of Shopify APIs is governed by Shopify's Privacy Policy.
• Infrastructure providers — our hosting provider (Railway) processes data to run our servers. They operate under appropriate data processing agreements.
• Legal requirements — if required by law, court order, or governmental authority.

6. Data Retention

• Shopper personal data: Not retained. Passes through memory only.
• Merchant account data: Retained while the app is installed. On uninstall, merchant data is marked inactive and deleted within 30 days.
• Anonymous analytics events: Retained for 90 days on a rolling basis, then permanently deleted.
• Deleted on request: Merchants may request immediate deletion of all their data by contacting privacy@trycompel.com.

7. Security

We implement the following security measures:

• All data transmission uses HTTPS/TLS encryption
• Database encryption at rest via our hosting provider
• Shopify access tokens are stored encrypted
• No customer personal data is written to disk or database
• Access to production systems is restricted to authorized personnel only
• We maintain a Security Incident Response Policy (available on request)

In the event of a data breach affecting merchant or shopper data, we will notify affected merchants within 72 hours of becoming aware of the incident, in accordance with applicable law.

8. GDPR Rights (EEA & UK Merchants and Shoppers)

If you are located in the European Economic Area or United Kingdom, you have the following rights under GDPR:

• Right of access — request a copy of the personal data we hold about you
• Right to rectification — request correction of inaccurate data
• Right to erasure — request deletion of your personal data
• Right to data portability — request your data in a machine-readable format
• Right to object — object to processing of your personal data
• Right to restrict processing — request that we limit how we use your data

To exercise any of these rights, contact us at privacy@trycompel.com. We will respond within 30 days.

Note: Because Compel does not store shopper personal data, most shopper data requests can be fulfilled immediately (there is nothing to provide or delete).

9. CCPA Rights (California Residents)

California residents have the right to:

• Know what personal information is collected about them
• Know whether their personal information is sold or disclosed, and to whom
• Opt out of the sale of their personal information (we do not sell personal information)
• Request deletion of their personal information
• Not be discriminated against for exercising their privacy rights

10. Shopify-Specific Disclosures

Compel is built on the Shopify platform and complies with Shopify's Partner Program Agreement and API Terms of Service. Specifically:

• We only request the minimum API scopes required to operate each widget
• We implement all required GDPR webhooks: customer data request, customer data erasure, and shop data erasure
• When a merchant uninstalls Compel, we receive a webhook notification and begin the data deletion process within 48 hours
• We do not use Shopify customer data for any purpose beyond the stated functionality

11. Children's Privacy

Compel is a business tool for Shopify merchants and is not directed at children under 13. We do not knowingly collect personal information from children.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify merchants of material changes via email or an in-app notice at least 14 days before changes take effect. Continued use of Compel after the effective date constitutes acceptance of the updated policy.