Privacy Policy · Vyanra Rewards

Last updated: {date}. Replace the placeholders in Super Admin → Pages with your company details before publishing.

Who we are

{company_name} ("we", "us") provides a loyalty and rewards application for Shopify merchants ("the App"). This policy explains what data the App collects, why, and how it is handled.

Data we process on behalf of merchants

When a merchant installs the App we receive, through Shopify's API and webhooks, the data needed to run the loyalty program:

Store information: store name, domain, email, currency, timezone, plan.
Customer information: Shopify customer ID, email address, first and last name, tags, marketing consent, order count and total spend, locale and country, and — only if the customer chooses to provide it — birthday.
Order information: order ID, totals, discount codes used, refund and cancellation events (used to calculate and reverse points).
Program data we create: point balances and ledger entries, store credit entries, rewards redeemed and discount codes issued, VIP tier, referral codes and referral events (including hashed IP and device identifiers used solely for fraud prevention).

We act as a data processor for this data; the merchant is the data controller.

Why we process it

To award, track, expire and redeem loyalty points and store credit.
To send transactional loyalty emails on the merchant's behalf (welcome, points earned, rewards, expiry reminders, VIP changes, birthdays, referrals). Customers can unsubscribe with one click.
To sync loyalty attributes to marketing platforms the merchant has connected (Klaviyo, Omnisend) and to Shopify Flow.
To prevent referral fraud.
To produce aggregated analytics for the merchant.

Retention and deletion

We honour Shopify's mandatory privacy webhooks: customers/data_request (we export the customer's data to the merchant), customers/redact (we anonymise the customer's personal data) and shop/redact (we delete all store data 48 hours after uninstall).
Webhook logs are kept for 30 days and email logs for 90 days.

Security

Data is encrypted in transit (TLS) and access tokens and integration credentials are encrypted at rest. Every request from Shopify is verified by signature. Access to production systems is restricted to authorised staff with two-factor authentication.

Sub-processors

{hosting_provider} (hosting), {email_provider} (email delivery), {error_monitoring} (error monitoring). Marketing platforms receive data only when a merchant connects them.

Your rights

Customers should contact the merchant to exercise their rights; the merchant can fulfil requests through Shopify, which notifies us automatically. Merchants can contact us at {support_email}.

Changes

We may update this policy; the date at the top indicates the latest revision.