This policy explains how UAB Essential apps handles personal data in connection with the Shopify app Essential Loyalty Program & Rewards (the "App"). The App lets stores run loyalty programmes: points, VIP tiers, referrals and rewards for their customers.
1. Who we are
UAB Essential apps ("we", "us")
Company code 306227239, VAT code LT100015773711
Baltupio g. 45-27, LT-08324 Vilnius, Lithuania
Privacy contact: support@essential-apps.com (subject line: "Privacy")
We have not appointed a data protection officer.
2. Our two roles
| You are… | Our role | What applies |
|---|---|---|
| A merchant, or staff of a merchant, who installs or uses the App | Controller of your account, billing, support and marketing data | This policy (sections 3–11) |
| A customer of a store that runs a loyalty programme with the App | Processor for the merchant. The merchant is the controller and decides how its programme works | The merchant's privacy policy and programme terms. Section 12 explains what the App does with your data |
3. Data about merchants and their staff
| Data | Source | Purpose | Legal basis (GDPR / UK GDPR) |
|---|---|---|---|
| Store details: store domain, Shopify store ID, settings, plan and usage | Shopify; your use of the App | Provide the App; billing | Contract (Art. 6(1)(b)) |
| Store contact email address | Shopify | Service and billing notices; marketing (see below) | Contract; legitimate interests |
| Shopify access credentials (encrypted) | Shopify | Access your store with the permissions you approved | Contract |
| Credentials for services you connect (Klaviyo, Judge.me) | You | Sync your programme with your own tools | Contract |
| Your programme settings: points rules, tiers, rewards, referral programme, email templates, page and widget designs | You | Provide the App | Contract |
| Support conversations: name, email, messages | You | Respond to support requests | Contract; legitimate interests |
| Error data and technical logs (IP address, browser, request times) | Your use of the App | Security, troubleshooting | Legitimate interests |
| Marketing contact: store contact email and store domain | Shopify | Product updates and news about Essential Apps | Legitimate interests in direct marketing, and EU e-privacy "soft opt-in" for similar products. You can opt out at any time (section 9) |
We do not use your data for automated decisions that have legal or similarly significant effects on you.
4. How long we keep merchant data
| Data | Retention |
|---|---|
| Store details, settings, programme data and credentials | Until we receive Shopify's shop deletion request (about 48 hours after uninstall). We then delete all of your store's data, including your customers' loyalty data |
| Billing records | 10 years from the end of the year of the transaction, as required by Lithuanian accounting and tax law |
| Marketing contact | Removed from this App's mailing group when you uninstall (you may remain on lists of other Essential Apps you use) |
| Support conversations | For as long as we need them to support you and other merchants well: to understand your store's history when you contact us again (including after a reinstall), to resolve recurring issues, and to handle any dispute. We review this periodically and delete conversations on request (section 8) unless we need them for a legal claim |
| Error data and logs | Error data up to 90 days; server access logs 7 days; most application logs 7–30 days. Records of privacy-request handling and of our staff's access to customer data: 10 years, to demonstrate compliance and to establish or defend legal claims |
| Backups | Daily database backups, kept for 15 days |
5. Who we share data with
Shopify, which provides the platform the App runs on.
Service providers that process data for us, including:
UpCloud (server hosting, managed database and monitoring, United States – Chicago)
Cloudflare (network security and delivery)
Google Cloud (delivery of Shopify events; United States or EU)
Postmark (email delivery)
Sentry (error monitoring, United States)
Help Scout and Google Workspace (support and email)
MailerLite (email marketing)
Slack and Make.com (internal operations)
Services you choose to connect, such as Klaviyo, Omnisend, Postscript or Judge.me: we exchange programme data with them on your instruction. They act under your own agreement with them.
Authorities, courts and advisers, where required by law or to establish, exercise or defend legal claims.
A buyer or successor of our business, if the App or our business is transferred.
We do not sell personal data, and we do not share it for cross-context behavioural advertising.
6. International transfers
The App's servers and database are located in the United States (Chicago). Delivery of Shopify events may run in the United States or the EU. Email delivery and support tools may also process data in the United States. Where a country does not have an adequacy decision, we rely on the EU–US Data Privacy Framework (and its UK Extension) where the provider is certified, or on the European Commission's Standard Contractual Clauses, together with the UK Addendum. You can request a copy of the relevant safeguards at support@essential-apps.com.
7. Security
We protect data with:
encryption in transit, and encryption of stored Shopify access credentials (with key rotation);
server access only with SSH keys (password login disabled);
signature verification of Shopify webhooks and storefront requests;
unsubscribe and tracking links that do not contain customers' email addresses; and
complete erasure of a customer's data, including references in other customers' referral history, when Shopify asks us to delete it.
No system is completely secure, but we work to protect your data and will notify you and authorities of breaches as required by law.
8. Your rights
Depending on where you are, you have the right to:
access your personal data;
correct it;
delete it;
restrict processing;
receive a portable copy;
object to processing based on legitimate interests (and to object at any time to direct marketing); and
withdraw consent where we rely on consent.
To exercise these rights, email support@essential-apps.com. We reply within one month, which can be extended where the law allows. We may need to verify your identity.
Complaints: you may complain to the State Data Protection Inspectorate of Lithuania (Valstybinė duomenų apsaugos inspekcija, vdai.lrv.lt), to the supervisory authority where you live or work, or, in the UK, to the Information Commissioner's Office (ico.org.uk).
9. Marketing emails
You can unsubscribe at any time using the link in any marketing email, or by emailing us. Unsubscribing does not stop service and billing messages, which we need to send while you use the App.
10. US state privacy disclosures
This section applies to residents of California and other US states with comprehensive privacy laws, in relation to the merchant data we control.
Categories collected in the last 12 months:
identifiers (name, email, store domain, IP address)
commercial information (plan and billing history)
internet or other electronic network activity (errors, technical logs)
Sources: you, Shopify, and your use of the App.
Purposes: as in section 3.
Disclosed for business purposes to: the service providers in section 5.
Sale or sharing: we have not sold or "shared" (for cross-context behavioural advertising) personal information. We have no actual knowledge of selling or sharing personal information of anyone under 16.
Sensitive personal information: we collect account credentials (Shopify access tokens and connected-service credentials) solely to provide the App, and not to infer characteristics.
Retention: section 4.
Your rights: to know/access, delete, correct and opt out of sale/sharing (we do not sell or share), and not to be discriminated against for exercising them. You may use an authorised agent. Appeals: if we decline your request, reply to our decision to appeal. If your appeal is denied, you may contact your state Attorney General.
How to exercise: email support@essential-apps.com.
11. Children
The App is for businesses and is not directed to children. We do not knowingly collect children's personal data as a controller.
12. Information for customers of stores using the App
If you are a member of a store's loyalty programme, the store is responsible for your data and for the programme's rules. Please read the store's privacy policy and programme terms, and contact the store first. We act on the store's instructions.
What the App keeps about you for the store:
your name, email address, phone number, language and customer tags, copied from your customer account at the store;
whether you agreed to receive email or SMS marketing from the store;
your birthday, if you give it to the store for birthday rewards;
your points balance and history, VIP tier, the rewards you redeemed (discount codes, store credit), your total spent and number of orders at the store, and the orders that earned you points;
your referral code and the people you referred or who referred you. Visits to your referral link are counted with only the date, not the visitor's identity;
photos or text you submit to earn points (for example a social post), and the store's decision on them. Photos are stored in the store's Shopify files and deleted 90 days after the store reviews them.
What the App does with it:
calculates and shows your points, tier and rewards in the store, your customer account, checkout and receipts;
creates the rewards you redeem, such as discount codes or store credit, in Shopify;
sends you programme emails on the store's behalf (for example points earned, rewards expiring, your birthday). These emails include an unsubscribe link. They also contain a small tracking image and tracked links, so we record whether they are opened or clicked; the store sees these statistics. Individual open and click records are deleted after 13 months;
if the store connects Klaviyo, Omnisend or Judge.me, exchanges your programme data with them (for example so a review you write earns points).
In your browser, the App uses a small cookie that carries a reward you redeemed to the cart, and local or session storage to avoid counting the same referral visit twice or re-applying a reward you removed. It does not track you across websites.
Deletion: when the store or Shopify asks us to delete your data, we erase it completely, including your name or email shown in other members' referral history and photos you submitted. We also ask the store's connected Klaviyo or Omnisend account to delete you. When the store uninstalls the App, all of its programme data is deleted (photos already in the store's own Shopify files stay with the store).
If you contact us about a store's data, we will forward your request to the store.
13. Changes
We will post updates here and change the effective date. If changes are significant, we will notify merchants by email.
14. Contact
UAB Essential apps · Baltupio g. 45-27, LT-08324 Vilnius, Lithuania · support@essential-apps.com