Privacy Policy — Optimalify Customer Account

Last updated: 21 June 2026

Summary: Optimalify lets merchants show banners on their customers' account pages. We do not collect, store, or process customers' personal data. Banner content is the merchant's own copy, stored inside the merchant's Shopify store.

This policy explains how the Optimalify Customer Account app ("Optimalify", "we", "us"), operated by Optimalify, handles information when a Shopify merchant installs and uses the app.

What we access

On install, the app is granted these Shopify Admin permissions, used only to create and manage banner content:

• Metaobjects & metaobject definitions (read/write) — to store banner entries.
• Translations (read/write) and locales (read) — to localize banner copy.
• Checkout & accounts configurations (read) — to deep-link the merchant to the editor.

The app requests no protected customer data scopes. The customer-account extension reads the merchant's banner content to render it; it does not read, collect, or transmit any shopper's personal information.

What we store

• A Shopify offline access token per installed shop, kept only to make authenticated Admin API calls on the merchant's behalf. Stored securely and deleted on uninstall or on a shop/redact request.
• Banner content is stored in the merchant's own Shopify store, not on our servers.

We do not store customer names, emails, addresses, orders, or any shopper personal data.

How we use information

Only to provide the app: authenticate Admin API calls, save/read banner content, and render banners on customer-account pages. We do not sell or share data, and we do not use it for advertising.

Compliance / GDPR webhooks

• customers/data_request — we hold no customer personal data, so there is none to return.
• customers/redact — we hold no customer personal data, so there is nothing to erase.
• shop/redact — we delete that shop's stored session/token data.
• app/uninstalled — we delete the shop's session/token on uninstall.

We comply with applicable data-protection laws including GDPR and CCPA/CPRA.

Subprocessors

• Heroku (Salesforce) — application hosting.
• PostgreSQL database — encrypted storage of shop session tokens.
• Shopify — platform and APIs.

Data retention & security

Shop session/token data is retained while the app is installed and deleted on uninstall or shop/redact. Banner content lives in the merchant's store. Tokens are stored in a secured database, transmitted over HTTPS, and never exposed in client or extension bundles.

Changes

We may update this policy; material changes are reflected by the "Last updated" date above.

Contact

Questions or data requests: mia@optimalify.org.