This policy explains how UAB Essential Upsells handles personal data in connection with the Shopify app Essential Upsell & Cross Sell (the "App").
1. Who we are
UAB Essential Upsells ("we", "us")
Company code 307589579, VAT code LT100020942015
Baltupio g. 45-27, LT-08324 Vilnius, Lithuania
Privacy contact: support@essential-apps.com (subject line: "Privacy")
We are a separate company from UAB Essential apps, which operates other apps under the Essential Apps brand. UAB Essential apps provides some services to us, such as support tools and our email platform, as described in section 5. Until 3 April 2026 the App was operated by UAB Essential apps (company code 306227239); since that date UAB Essential Upsells has operated the App and is responsible for the data described in this policy. We have not appointed a data protection officer.
2. Our two roles
| You are… | Our role | What applies |
|---|---|---|
| A merchant, or staff of a merchant, who installs or uses the App | Controller of your account, billing, support and marketing data | This policy (sections 3–11) |
| A shopper or customer of a store that uses the App | Processor for the merchant. The merchant is the controller | The merchant's privacy policy. Section 12 explains what the App does on stores |
3. Data about merchants and their staff
| Data | Source | Purpose | Legal basis (GDPR / UK GDPR) |
|---|---|---|---|
| Store details: store domain, store name, plan, currency, locale, settings, Shopify store ID | Shopify, when you install and use the App | Provide the App, configure features, determine applicable pricing | Contract (Art. 6(1)(b)) |
| Store contact email address | Shopify | Service and billing notices | Contract (Art. 6(1)(b)) |
| Staff user details: Shopify user ID, name, email address, language, whether the user is the account owner or a collaborator | Shopify, when a staff member uses the App | Provide the App, manage access, support | Contract; legitimate interests in operating the service (Art. 6(1)(f)) |
| Shopify access credentials (access tokens) | Shopify | Access your store data with the permissions you approved | Contract |
| Billing data: plan, charges, usage tier, attributed revenue totals, credits, subscription status | Calculated by the App; Shopify billing | Charge fees, calculate usage-based tiers, issue credits, accounting | Contract; legal obligation (accounting and tax, Art. 6(1)(c)) |
| Your App configuration: offers, products, discounts, texts, designs | You | Provide the App | Contract |
| Support conversations: name, email, messages, attachments, browser details | You, through the in-App chat or email | Respond to support requests | Contract; legitimate interests |
| Admin usage data: features used, in-App events, page performance measurements | Your use of the App's admin | Improve and secure the App | Legitimate interests in improving our product |
| Technical logs: IP address, browser, request times | Your browser, via our hosting provider | Security, fraud and abuse prevention, troubleshooting | Legitimate interests in security |
| Marketing contact: store contact email and store domain | Shopify | Product updates, news about Essential Apps, and win-back messages after uninstall | Legitimate interests in direct marketing, and EU e-privacy "soft opt-in" for similar products. You can opt out at any time (section 9) |
We do not use your data for automated decisions that have legal or similarly significant effects on you.
4. How long we keep merchant data
| Data | Retention |
|---|---|
| Store, staff, configuration and access data | Until we receive Shopify's shop deletion request (about 48 hours after uninstall). We then delete it after a grace period of up to 3 days, which protects merchants who reinstall |
| Admin usage data | Deleted together with store data |
| Billing records and monthly revenue totals used for billing | 10 years from the end of the year of the transaction, as required by Lithuanian accounting and tax law |
| Aggregated offer statistics (no customer data) | While you use the App. Deleted with your other store data after Shopify's shop deletion request |
| Support conversations | For as long as we need them to support you and other merchants well: to understand your store's history when you contact us again (including after a reinstall), to resolve recurring issues, and to handle any dispute. We review this periodically and delete conversations on request (section 8) unless we need them for a legal claim |
| Marketing contact | Until you unsubscribe, and in any case no longer than 24 months after uninstall |
| Technical logs | Up to 30 days in our hosting and cloud providers' logging systems. Cloud administrative audit logs (which record our staff's actions, not your customers' data) are kept by Google for 400 days |
| Backups | Database change history used for recovery is kept for up to 30 days, then automatically discarded |
5. Who we share data with
Shopify, which provides the platform the App runs on. Shopify's own privacy policy applies to Shopify.
Service providers that process data for us, including:
Vercel (hosting)
Neon / Databricks (databases)
Google Cloud (data processing pipeline)
Upstash (job queue)
Twilio SendGrid (email)
Help Scout and Google Workspace (support and email)
MailerLite (email marketing)
Cloudflare (network security and delivery)
Supabase (hosting of two interface images, through UAB Essential apps; it sees only the IP address of the browser loading them)
UAB Essential apps, which provides support, marketing and infrastructure services to us under a services agreement of 2026 and its data processing addendum.
Authorities, courts and advisers, where required by law or to establish, exercise or defend legal claims.
A buyer or successor of our business, if the App or our business is transferred. We will notify you as described in the Terms.
We do not sell personal data, and we do not share it for cross-context behavioural advertising.
6. International transfers
The App's servers and databases are located in the United States: hosting by Vercel (Ohio), databases by Neon (Ohio), and the data processing pipeline by Google Cloud (Iowa). Our job queue runs in the EU (Frankfurt). Support and email providers may also process data in the United States. Where a country does not have an adequacy decision, we rely on the EU–US Data Privacy Framework (and its UK Extension) where the provider is certified, or on the European Commission's Standard Contractual Clauses, together with the UK Addendum. You can request a copy of the relevant safeguards at support@essential-apps.com.
7. Security
We protect data with:
encryption in transit, encryption at rest by our database and cloud providers, and AES-256 encryption of stored Shopify access tokens;
access limited to authorised personnel;
signature verification of all Shopify webhooks and storefront requests; and
data minimisation: we do not request buyer names, emails or addresses from Shopify.
No system is completely secure, but we work to protect your data and will notify you and authorities of breaches as required by law.
8. Your rights
Depending on where you are, you have the right to:
access your personal data;
correct it;
delete it;
restrict processing;
receive a portable copy;
object to processing based on legitimate interests (and to object at any time to direct marketing); and
withdraw consent where we rely on consent.
To exercise these rights, email support@essential-apps.com. We reply within one month, which can be extended where the law allows. We may need to verify your identity.
Complaints: you may complain to the State Data Protection Inspectorate of Lithuania (Valstybinė duomenų apsaugos inspekcija, vdai.lrv.lt), to the supervisory authority where you live or work, or, in the UK, to the Information Commissioner's Office (ico.org.uk).
9. Marketing emails
You can unsubscribe at any time using the link in any marketing email, or by emailing us. Unsubscribing does not stop service and billing messages, which we need to send while you use the App.
10. US state privacy disclosures
This section applies to residents of California and other US states with comprehensive privacy laws, in relation to the merchant data we control.
Categories collected in the last 12 months:
identifiers (name, email, store domain, user ID, IP address)
commercial information (plan and billing history)
internet or other electronic network activity (admin usage, technical logs)
professional information (role in the store)
Sources: you, Shopify, and your use of the App.
Purposes: as in section 3.
Disclosed for business purposes to: the service providers in section 5.
Sale or sharing: we have not sold or "shared" (for cross-context behavioural advertising) personal information. We have no actual knowledge of selling or sharing personal information of anyone under 16.
Sensitive personal information: we collect account credentials (Shopify access tokens) solely to provide the App, and not to infer characteristics.
Retention: section 4.
Your rights: to know/access, delete, correct and opt out of sale/sharing (we do not sell or share), and not to be discriminated against for exercising them. You may use an authorised agent. Appeals: if we decline your request, reply to our decision to appeal. If your appeal is denied, you may contact your state Attorney General.
How to exercise: email support@essential-apps.com.
11. Children
The App is for businesses and is not directed to children. We do not knowingly collect children's personal data as a controller.
12. Information for shoppers on stores using the App
If you shop on a store that uses this App, the store is responsible for your data. Please read the store's privacy policy and contact the store first. We act on the store's instructions.
What the App does on a store:
Shows product offers, such as related products, bundles, quantity discounts and offers after checkout. To decide which offers to show, it may use:
the country you appear to be browsing from, derived from your IP address by our network provider and not stored by us; and
if you are logged in, the customer tags the store has given you. These tags are read in your browser and are not sent to us.
Counts offer views and cart interactions for the store's statistics. These events contain random event identifiers, the product or offer concerned and the time. They do not include your name, email, IP address or device identifiers.
Uses your browser's local storage (not cookies) to:
keep statistics events that have not been sent yet (up to 24 hours);
keep a temporary random identifier for the browser tab; and
remember countdown timer state.
The App does not set cookies and does not track you across websites.
Processes order details for orders that include offers: order and line-item identifiers, products, quantities, prices, discounts and any notes or custom fields attached to order lines (for example, a gift message entered on the store). It uses them to calculate the store's revenue from offers and our fees. It does not receive your name, email, phone number, address or payment details.
Processes post-purchase offers: if you accept an offer after checkout, the App verifies the order and prepares the order change that Shopify processes.
This data is stored by us for the store and deleted when the store asks Shopify to delete your data, or when the store uninstalls the App. If you contact us about a store's data, we will forward your request to the store.
13. Changes
We will post updates here and change the "Last updated" date. If changes are significant, we will notify merchants by email.
14. Contact
UAB Essential Upsells · Baltupio g. 45-27, LT-08324 Vilnius, Lithuania · support@essential-apps.com