Privacy Policy

For customer data, the merchant is the controller and we act as a processor on the merchant's behalf. We use the data only to provide the App's features to the merchant.

Store information (from Shopify, when you install the App)

• Store domain, store name, store contact email, currency, country, time zone, primary language, primary domain URL and Shopify plan name.
• An access token issued by Shopify so the App can call the Shopify Admin API for your store.

Store settings you create in the App

• Gift card product configuration, product images you select, page template and brand colors, email template, logo, email content and reply-to address.
• If you add your own sending domain: the domain name and its DNS verification status.

Gift card data (from orders placed in your store)

When a customer buys a gift card, the App reads the order through the Shopify Admin API and stores, for each gift card:

• order ID and order number, line item, amount and currency, and order timestamps;
• recipient name and recipient email, sender name and personal message, as entered by the buyer on the gift form;
• the buyer's order email, only when the buyer buys the card for themselves (it is used as the delivery address);
• scheduled delivery date, time and time zone, card design and language;
• the Shopify gift card ID, the last 4 characters of the code, and the full gift card code in encrypted form (AES-GCM);
• delivery status and a history of delivery events (for example queued, sent, failed, resent). This history does not include the gift card code.

The App does not collect customer phone numbers, postal addresses or payment details.

Recipient gift page

The gift page link contains a random token. We store only a one-way hash of it, not the token itself. To protect against abuse, the page applies per-IP rate limiting. We do not store IP addresses in our database.

Support chat (when you contact us in the App)

When you or your staff use the support chat in the App, we store:

• the messages you send and the replies from our support team and our AI assistant, with their timestamps;
• screenshots you attach (PNG, JPEG or WebP). We do not keep the original file name. Images may contain metadata such as location, so please share screenshots only;
• your store name and domain, your App plan, and the App page you had open when you started the chat.

We use this information only to answer your support requests. A copy of each message and screenshot is sent to our support team on Telegram so we can reply quickly. If our team has not replied after about 5 minutes, an AI assistant may draft a reply based on our help guides. AI replies are always labelled "AI assistant", and the AI assistant cannot view or change your store data. Please do not share your customers' personal data or full gift card codes in the chat.

• Create gift cards in your Shopify store after an order is paid.
• Send gift card emails to recipients at the chosen time, and resend them when you ask.
• Show the recipient's gift page with the code, card design, message and current balance (balance is read from Shopify each time and is not stored by us).
• Disable unsent gift cards when an order is cancelled or refunded, and show gift card status in the App.
• Keep the gift card product set up correctly and keep gift cards from paying for gift cards at checkout.
• Provide support to you, including through the in-app support chat, and respond to privacy requests.

We do not sell, rent or share personal data for advertising or marketing. We do not use it for profiling or automated decisions about customers.

Cloudflare Workers AI processes the text of support messages to draft automated replies. Cloudflare does not retain these inputs or outputs after the reply is generated and does not use them to train AI models.

About one hour after an email is accepted for delivery, we ask Brevo to delete its log entry for that email. Brevo may keep limited data as required by its own legal obligations.

• Gift card codes are encrypted at rest and are never written to application logs.
• The App's admin never shows the full code, only the last 4 characters.
• Data in transit uses HTTPS. Access to production data is limited to the people who operate the App.

• Store and gift card data is kept while the App is installed, so you can manage your gift cards and their history.
• When you uninstall the App, gift card emails stop. Shopify sends us a shop/redact request about 48 hours later. We then delete all data for your store: gift cards and their history, settings, products, sending domain, statistics, privacy requests, support chat messages and screenshots, and access tokens. After this, old gift page links stop working. Gift cards already issued stay in your Shopify store and remain usable there.
• Support chat messages and screenshots are deleted 2 months after each one is sent. Copies in our support team's Telegram account are deleted by our team when your store's data is deleted under shop/redact, or when you ask us.
• Application logs are kept for a short period by Cloudflare and contain store and gift card IDs, not codes, names, emails or messages. They do not contain support chat content.

The App supports Shopify's mandatory privacy webhooks:

• Customer data request (customers/data_request): we find the gift cards linked to the customer's orders or email and provide the data to the merchant within 30 days. We do not include gift card codes in this export.
• Customer redaction (customers/redact): we erase the recipient name, recipient email, sender name and message from that customer's gift cards, cancel any unsent deliveries, and ask Brevo to delete the related email logs. We keep the order reference, amount, currency, status and encrypted code, because the merchant needs them for accounting and the gift card itself is managed in Shopify.
• Shop redaction (shop/redact): described in section 5.

Customers should contact the merchant they bought from. Merchants can contact us at the address below.

Data is processed on Cloudflare's network, by Brevo and, for support chat, by Telegram, which may involve servers outside your country. We rely on these providers' safeguards for international transfers.

We will update the date at the top when this policy changes, and tell merchants in the App about significant changes.

Nexlo, Hanoi, Vietnam

Email: support@nexloapps.com