Privacy Policy

NO7 SOFTWARE LIMITED (“we”, “us”, “our”, or the “Company”) operates the Anchor Loyalty application (the “App”, “Service”, or “Platform”) for Shopify merchants. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our App.

1. Definitions

• “Merchant” refers to Shopify store owners who install and use the App
• “End Customer” refers to customers of the Merchant's store who participate in loyalty programs
• “Personal Data” means any information relating to an identified or identifiable natural person
• “Processing” means any operation performed on Personal Data
• “Data Controller” means the entity that determines the purposes and means of Processing
• “Data Processor” means the entity that Processes data on behalf of the Controller

2. Data Controller and Processor Roles

2.1 For Merchant Data

NO7 SOFTWARE LIMITED acts as the Data Controller for data we collect directly from Merchants (account information, billing data, usage analytics).

2.2 For End Customer Data

NO7 SOFTWARE LIMITED acts as the Data Processor on behalf of the Merchant, who remains the Data Controller for their customers' Personal Data. Merchants are responsible for:

• Obtaining appropriate consent from their customers
• Providing privacy notices to their customers
• Responding to data subject requests from their customers
• Ensuring lawful basis for processing customer data

3. Information We Collect

3.1 Merchant Information

When Merchants install and use Anchor Loyalty, we collect:

3.2 End Customer Information

Through the App, we process the following End Customer data on behalf of Merchants:

3.3 Automatically Collected Information

• Log data (IP addresses, browser type, access times)
• Device information
• Cookies and similar technologies (for session management only)

4. How We Use Information

4.1 Primary Purposes

• Providing and maintaining the Anchor Loyalty service
• Calculating and awarding loyalty points based on customer purchases
• Processing reward redemptions and generating discount codes
• Tracking customer tier progression and spending milestones
• Managing referral program functionality
• Processing billing and payments

4.2 Secondary Purposes

• Analyzing usage patterns to improve the Service
• Detecting and preventing fraud or abuse (e.g., through device fingerprinting and rate limiting)
• Complying with legal obligations
• Communicating service updates and changes

4.3 Historical Order Import

During initial setup, with the Merchant's explicit consent, we may access the store's full order history to calculate retroactive loyalty points for existing customers. This is a one-time operation — order details (line items, payment info) are not stored. Only the calculated point values and order totals are retained for loyalty program operation.

4.4 Storefront Extensions

Anchor Loyalty provides theme, checkout, and customer account extensions that display loyalty information (points balance, available rewards, tier status) directly on the Merchant's storefront. These extensions access customer data only through authenticated Shopify APIs and do not collect additional data independently.

4.5 What We Do NOT Do

5. Data Sharing and Disclosure

We may share data only in the following circumstances:

5.1 Service Providers

We use trusted third-party service providers bound by Data Processing Agreements:

5.2 Legal Requirements

We may disclose data when required by:

• Valid legal process (court order, subpoena)
• Law enforcement requests with proper authority
• Regulatory requirements
• Protection of our legal rights

5.3 Business Transfers

In the event of merger, acquisition, or sale, data may be transferred to the successor entity with equivalent privacy protections.

6. Data Security

6.3 Security Incident Response

In the event of a data breach:

• We will notify affected Merchants within 72 hours
• We will notify relevant supervisory authorities as required
• We will document and investigate all incidents
• We will implement remediation measures

7. Data Retention

7.1 Active Accounts

We retain data for as long as the Merchant has the App installed and maintains an active account.

7.2 After Uninstallation

• App uninstall webhook: Upon receiving Shopify's app/uninstalled webhook, we immediately clean up session data and mark the installation as inactive.
• Shop redaction webhook: Most Merchant and End Customer data is permanently deleted within 48 hours of receiving Shopify's shop/redact webhook. However, we retain subscription data and basic store identifiers as a legitimate interest to prevent free-trial abuse and maintain necessary financial audit trails.
• Customer redaction webhook: Individual customer data is permanently deleted upon receiving Shopify's customers/redact webhook, including loyalty points, transaction history, referral codes, and tier membership. Anonymized aggregate data may be retained for analytics.
• Automated GDPR deletion: A scheduled process runs daily to process pending GDPR deletion requests.
• No backup retention: Deleted data is not retained in backups beyond 30 days.

7.3 Customer Data Requests

• Data access requests: Processed within 30 days
• Data deletion requests: Processed within 30 days
• Data portability requests: Processed within 30 days

7.4 Legal Hold

Data may be retained longer if required for:

• Ongoing legal proceedings
• Regulatory investigations
• Tax and accounting requirements (up to 7 years for financial records)

8. Your Rights Under GDPR

If you are located in the European Economic Area (EEA) or United Kingdom, you have the following rights:

8.1 Rights Summary

8.2 How to Exercise Your Rights

• Merchants: Contact us directly at info@no7software.co.uk
• End Customers: Contact the Merchant (store owner) who controls your data. We will assist Merchants in fulfilling requests.

8.3 Response Timeline

• We will acknowledge requests within 7 days
• We will complete requests within 30 days
• Complex requests may take up to 90 days with notice

8.4 Verification

We may need to verify your identity before processing requests to prevent unauthorized access.

9. International Data Transfers

9.1 Transfer Mechanisms

When we transfer Personal Data outside the EEA/UK, we use:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions where applicable
• Binding Corporate Rules where applicable

9.2 Shopify Integration

As the App operates within the Shopify platform, some data processing occurs through Shopify's infrastructure. Shopify maintains its own GDPR compliance measures and data processing agreements.

10. California Consumer Privacy Act (CCPA)

California residents have additional rights:

10.1 Rights

• Right to Know: What Personal Information is collected, used, shared
• Right to Delete: Request deletion of Personal Information
• Right to Opt-Out: Opt-out of sale of Personal Information (we do NOT sell data)
• Right to Non-Discrimination: Equal service regardless of privacy choices

10.2 “Do Not Sell” Disclosure

We do NOT sell Personal Information. We have not sold Personal Information in the preceding 12 months and have no plans to do so.

10.3 Categories of Information

In the preceding 12 months, we have collected:

• Identifiers (name, email, customer IDs)
• Commercial information (purchase history for points calculation)
• Internet activity (log data)

11. Children's Privacy

• Our Service is not directed to children under 16
• We do not knowingly collect Personal Data from children under 16
• If we discover such data has been collected, we will delete it promptly
• Parents/guardians may contact us to request deletion

12. Cookies and Tracking

12.1 Cookies We Use

• Essential cookies: Session management, authentication (strictly necessary)
• We do NOT use: Analytics cookies, advertising cookies, tracking cookies

12.2 Third-Party Cookies

The Shopify platform may set its own cookies. Refer to Shopify's Privacy Policy for details.

13. Changes to This Policy

13.1 Notification

• Material changes will be notified via email to Merchants
• Non-material changes will be posted with updated “Last Updated” date
• Continued use after changes constitutes acceptance

13.2 Version History

14. Contact Information

15. Additional Disclosures

15.1 Third-Party Links

Our Service may contain links to third-party websites. We are not responsible for their privacy practices.

15.2 Analytics

We may use aggregated, anonymized data for analytics purposes. This data cannot identify individuals.

15.3 Legal Basis Summary (GDPR Article 6)