Privacy Policy — Aqua Offers Loyalty

Last updated: July 24, 2026

This Privacy Policy explains how Aqua Offers Loyalty ("the App," "we," "us") collects, uses, and protects information when a merchant installs the App on their Shopify store, and when that merchant's customers interact with the loyalty program the App powers.

1. Information We Collect

When a merchant installs the App, we receive and store:

Store information: the shop's domain, name, and contact email, and an access token issued by Shopify that authorizes the App to act on the merchant's behalf. Access tokens are stored encrypted and expire automatically; a refresh token (also encrypted) is used to renew them.
Order information: for each paid order, the order ID, line items, purchase amount, and the currency, so we can calculate and award loyalty points.
Customer information: the customer's email address (and, where available, phone number) associated with an order, used solely to identify or create their loyalty account and associate it with the correct store.
Loyalty activity: points earned, points redeemed, tier progress, referral activity, and any discount codes or gift cards issued through the program.

We do not collect payment card numbers, passwords, or other sensitive authentication data — payment processing is handled entirely by Shopify.

2. How We Use Information

We use the information above only to operate the loyalty program the merchant has configured:

Calculating and awarding points on paid orders
Reversing points proportionally when an order is refunded
Tracking tier progress and applying tier-based point multipliers
Processing point redemptions and issuing the resulting discount code or gift card through Shopify's API
Displaying point balances to customers on the storefront and to merchant staff in the Shopify admin and point-of-sale
Attributing referrals between customers

We do not use this information for advertising, do not build advertising profiles, and do not sell or rent it to third parties.

3. How Information Is Shared

Customer and order information is shared only with:

Shopify, to issue discount codes or gift cards as part of a point redemption, and to receive order/refund/customer webhooks
The merchant who installed the App, who can see their own store's members, orders, and point activity within the embedded app

We do not share data with data brokers, advertising networks, or any other third party.

4. Data Retention and Deletion

If a merchant uninstalls the App, their store's data is deactivated but retained for a limited period in case of reinstallation, consistent with Shopify's data retention requirements for uninstalled apps.
When Shopify sends a shop/redact webhook (issued automatically roughly 48 hours after uninstall), all of that store's data is permanently deleted from our systems.
When Shopify sends a customers/redact webhook (triggered when a customer requests erasure, or when required by law), that customer's store-specific data is deleted while preserving the underlying loyalty account only if it is still linked to other stores.
When Shopify sends a customers/data_request webhook (triggered when a customer requests their data), we provide the requested customer's order and loyalty data to the merchant, who is responsible for delivering it to the customer.

5. Security

All communication between the App, Shopify, and merchants' browsers is encrypted in transit (TLS/HTTPS). Every webhook Shopify sends us is verified using HMAC signature verification before being processed, so requests cannot be spoofed. Shopify access tokens are encrypted at rest and are never exposed to the storefront or to merchant staff.

6. Customers' Rights

If you are a shopper who has earned or redeemed loyalty points through a store using this App and want to access, correct, or delete your data, please contact the merchant (the store) directly — they control your data as it relates to their store. You may also contact us at the address below and we will assist the merchant in fulfilling your request.

7. Children's Privacy

The App is intended for use by merchants operating e-commerce stores and is not directed at children. We do not knowingly collect information from children under 13 (or the relevant age of consent in your jurisdiction).

8. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by an updated "Last updated" date above.

9. Contact Us

Questions about this Privacy Policy or how your data is handled can be sent to: