Legal
Privacy Policy
How xDiscount handles your store data, your shoppers' data, and the AI assistant you connect. The full policy is below; here is the short version.
The short version
A plain-language summary. It is not a substitute for the full text below.
-
We act on your behalf
You are the data controller for your store. We are the processor, and we access only what the app needs to price your discounts, render the offer card, and report performance.
-
We never sell data
Not your data, not your customers' data. The storefront pixel measures discount performance only, carries no shopper identifiers, and is never used for advertising.
-
No AI keys, no training
Connect AI runs through an assistant you connect yourself. We store no AI provider keys and never train models on your data.
-
You can get it deleted
Uninstall and we delete or de-identify your store and shopper data per Shopify's requirements. You can also request deletion at any time.
Introduction
This Privacy Policy explains how xDiscount, operated by DevOps Crowd Inc. (we, us, our), collects, uses, stores, shares, and protects information when you install and use our Shopify application, our website, and related services. By installing xDiscount, you agree to the practices described here. We act as a data processor for the store data and shopper data we handle on your behalf, and you, the merchant, are the data controller for your store. This policy also serves as our data processing agreement with you for the personal information we process on your instructions.
Information we collect from merchants
When you install and set up xDiscount, we collect your Shopify store URL and domain, your shop identifier, your email address, your account and plan details, your store currency and timezone, and your in-app settings and preferences. If you connect an AI assistant through Connect AI, we store a one-way hash of the key you generated, together with when it was created and when it was last used, so we can honour and revoke it. We never store the key itself, and we do not collect or store AI provider keys.
Store data we access through Shopify
With the permissions you grant at install, and as declared in the app's configuration, we access your product catalog and variants, your orders and order history, your discounts and the discount records xDiscount itself writes, your themes and theme app extension placements, and the customer events raised by our storefront pixel. Access to order data is Protected Customer Data under Shopify's rules, granted for the purpose of measuring discounted orders and stamping each one with the campaign that discounted it. We use this data to target discounts, evaluate their rules, render the storefront offer card, price the cart at checkout, and produce your analytics. We access only what is needed for the features you use.
Shopper data we collect on your storefront
To measure how your discounts perform, our storefront web pixel subscribes to exactly five events on your store: a product viewed, a product added to cart, a cart viewed, a checkout started, and a checkout completed. It records the product and variant involved, the quantity added, the product IDs in the cart on a cart viewed and in the checkout on a checkout started, and for a completed checkout the currency, the order total, and the title and type of each discount applied. A cart viewed and a checkout started carry no money and no quantities. Every event is folded into one daily total per store, so no per-shopper event trail is kept. The pixel runs inside Shopify's sandboxed pixel environment and respects the customer privacy and consent settings configured in your Shopify admin, so where consent is required and not given, the event is not collected. It records no shopper identifiers, no IP address, no device identifier, no page URLs and no cookies or browser storage, it is never used for advertising, and we never sell it. It cannot move your discounted-order count or a billable counter, because only Shopify's signed order webhook can do that.
How we use information
We use the information above to operate xDiscount: to store and validate your discount records, to evaluate item quantity, cart value and inventory conditions, to apply each discount's start and end dates against your store's timezone, to price cart lines and delivery through our Shopify Function, to render the storefront offer card and its gift picker, to power the Connect AI features you enable, to produce your analytics, and to meter your plan usage in discounted orders. We also use account information to provide support, send service and billing notifications, and secure the service.
AI features and your data
xDiscount's AI features work through an AI assistant you connect yourself, such as Claude or ChatGPT, over the /mcp endpoint on your app's URL, authenticated with a key you generate in Settings and can revoke at any time. When your assistant reads your store's data through xDiscount, that data is handled by your AI provider under your own account and their terms. The assistant works through typed tools only and never writes a discount record directly: every write goes through the same validated action the admin interface uses, and anything it creates is forced to draft at the model layer. We sell no AI subscription, we store no AI provider keys, and we do not use your data to train our own or any third party's foundation models. Revoking or regenerating the key cuts off access on the very next request, and your plan is re-checked when a key is generated and on every tool call, so access stops straight away if a plan that withholds Connect AI is ever introduced.
Subprocessors and third-party services
We use trusted subprocessors to run xDiscount: Shopify (store data, the app platform, the Function runtime, and billing), our application data and hosting providers, and our email provider for service and billing notifications. Any AI assistant you connect acts under your own account with its provider, not as our subprocessor. Each operates under its own privacy terms, and we share only the data needed to deliver the service. We never sell your data or your customers' data. A current list of subprocessors is available on request at privacy@xdiscount.app.
Customer data requests and deletion
We implement Shopify's three mandatory privacy webhooks: customer data request, customer redact, and shop redact. When a shopper or a store owner submits a request through Shopify, we provide, redact, or delete the relevant data in accordance with Shopify's requirements and within the required timeframes. Shop redact removes your store's data after uninstall. You can also contact privacy@xdiscount.app directly.
Data retention
We retain your discount records, settings, and analytics for as long as your account is active, so your dashboard keeps its history. Storefront pixel events are retained in aggregate for reporting and are not tied to a shopper identity. When you uninstall xDiscount, we delete or de-identify your store and shopper data in accordance with Shopify's requirements and its shop redact timeline, except where we must retain limited billing and security records to meet legal and tax obligations. You can request deletion at any time at privacy@xdiscount.app.
Security
We protect your data with encryption in transit and at rest. Every discount is written by a validated action rather than by the browser, and the checkout Function fails closed, so a record it cannot read produces no discount rather than a wrong one. We store no AI provider keys, we store only a one-way hash of your own Connect AI key, and every tool call is resolved to the store that owns that key and re-checked on every record it reads or writes. We apply access controls, store-level isolation, and least-privilege access, and xDiscount is a Shopify Partner application built to Shopify's data protection requirements. No method of transmission or storage is perfectly secure, but we work to protect your information.
International data transfers
We are based in Canada. Your data may be processed by us and our subprocessors in Canada, the United States, and other countries where they operate. Where required, we rely on appropriate safeguards for cross-border transfers, including standard contractual clauses. By using xDiscount, you understand your data may be processed outside your country of residence.
Your rights
Depending on where you live, you may have the right to access, correct, delete, and export your personal information, to object to or restrict certain processing, to be informed about automated processing, and to withdraw consent. We support these rights under the EU and UK GDPR and Quebec's Law 25, among other laws. To exercise your rights, contact privacy@xdiscount.app, and we will respond within 30 days. You may also lodge a complaint with your local data protection authority, including Quebec's Commission d'acces a l'information.
Changes to this policy
We may update this Privacy Policy as the product and the law evolve. We will post the updated version with a new effective date, and significant changes will be communicated in the app or by email.
Contact
Questions or requests: contact privacy@xdiscount.app or write to DevOps Crowd Inc., 1275 Av. des Canadiens-de-Montreal, Suite 5-129, Montreal, H3B 0G4, QC, Canada.