Privacy Policy

Last updated: March 1, 2026

1. Data Collection, Use, and Processing

When you install and use UpsellCat, we may collect and process certain information from you and your Shopify store in order to provide, operate, maintain, and improve the application.

The information we may collect includes:

• Store information such as store name, domain, Shopify account identifiers, and contact details
• Configuration data relating to upsell offers created within the application
• Performance data relating to upsell offers, including impressions, views, clicks, acceptance rates, and conversions
• Order-related data necessary to process upsell transactions and provide functionality
• Technical data such as logs, device information, browser type, and diagnostic information used for troubleshooting and system performance
• Usage data relating to how merchants interact with the application

2. How We Use Your Data

This information is collected and used solely for legitimate business purposes, including:

• Providing and operating the UpsellCat service
• Enabling upsell functionality within merchant stores
• Monitoring performance and improving product features
• Troubleshooting technical issues and providing customer support
• Analysing usage trends to enhance user experience
• Ensuring security, fraud prevention, and platform integrity
• Complying with legal obligations

We do not sell, rent, or trade merchant data or store data to third parties for advertising or marketing purposes.

3. Customer Data

UpsellCat may process limited customer and order data strictly as required to execute upsell offers and related functionality within a merchant’s store.

We do not independently contact, market to, or sell to a merchant’s customers.

All customer data processing is performed on behalf of the merchant in accordance with Shopify’s platform rules and applicable data protection laws.

4. Analytics and Tracking Technologies

We may use third-party analytics and tracking technologies to understand how our website and application are used, improve functionality, and measure the effectiveness of marketing campaigns.

These services may include:

• Google Analytics
• Meta (Facebook) advertising and tracking technologies

These tools may collect information such as:

• Device type, browser type, and operating system
• Pages visited and interactions with our website or application
• Referral sources and traffic data
• General engagement metrics

This data is used only for:

• Analysing usage patterns and improving the service
• Monitoring application performance and reliability
• Measuring marketing campaign effectiveness
• Optimising user experience

Information collected through these services is subject to the privacy policies of the respective third-party providers.

We do not allow these tools to access merchant storefront data beyond aggregated usage information necessary for analytics purposes.

5. Cookies and Similar Technologies

Our website may use cookies or similar technologies provided by third-party services, including Google and Meta, to support analytics and marketing activities. Users may control cookie preferences through their browser settings.

6. Third-Party Services

We only share information with third parties where necessary to operate the service, including:

• Shopify APIs — we use the Shopify Admin API and Post-Purchase / Checkout Extension APIs to read product data and modify orders when customers accept upsell offers.
• Hosting and infrastructure providers — our application is hosted on Vercel. Request logs may be retained per Vercel’s privacy policy.
• Resend — we use Resend to deliver billing notification and marketing emails.
• Analytics providers — Google Analytics and Meta as described above.
• Payment processors — billing is handled through Shopify’s billing infrastructure.

All third parties are required to maintain appropriate confidentiality and security measures.

7. Data Retention and Deletion

We retain data only for as long as necessary to provide the service and fulfil legitimate business or legal obligations.

Upon uninstall of the UpsellCat application, we will delete or anonymise stored merchant data within a reasonable period, except where retention is required for legal, regulatory, or dispute-resolution purposes.

Session data is deleted immediately upon uninstallation. Full shop data (offers, events, billing records) is deleted upon receiving Shopify’s shop data erasure webhook, within 48 hours of the request.

Merchants may request data deletion at any time by contacting hello@upsellcat.com.

8. Legal Basis (GDPR / UK Data Protection)

Where applicable under data protection laws, our legal basis for processing information includes:

• Performance of a contract — providing the application service
• Legitimate interests — improving and maintaining the service
• Compliance with legal obligations

We comply with GDPR and Shopify’s mandatory privacy webhooks. You or your customers can request:

• Data access — request a copy of stored data via Shopify’s customer data request mechanism.
• Data deletion — request erasure of any order-associated event data via Shopify’s customer data erasure mechanism.
• Shop data erasure — all shop data is deleted when Shopify sends a shop redact webhook after uninstallation.

9. Data Security

We implement reasonable technical and organisational measures to protect data against unauthorised access, alteration, disclosure, or destruction. All communication between your store, Shopify, and our servers uses HTTPS encryption. We validate all webhook requests using HMAC signatures and restrict API access to verified Shopify store origins.

10. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated through the app dashboard.

11. Contact

For privacy questions or data requests, contact us at hello@upsellcat.com.