How We Handle Your Customers’ Data on Essential Upsell & Cross Sell
Essential Upsell & Cross Sell shows offers on your store, applies the discounts you set up and reports how those offers perform. To do that, it handles a limited set of customer-related data. It does not store customer names, email addresses, phone numbers, postal addresses or payment details.
You are the controller of your customers’ data, and we process it on your behalf. This guide is a plain-language summary. The binding terms are in our Data Processing Agreement (see Annex 1.1) and Privacy Policy.
What the app uses this data for
- Showing offers, including any targeting rules you set by customer tag or country
- Applying the discounts you configure
- Running post-purchase offers
- Attributing revenue to offers in your analytics
- Calculating your plan tier, which is based on the revenue your offers add
What data the app handles
| Data | What it includes | How it is handled |
|---|---|---|
| Order identifiers | Order ID, order number, line-item IDs and, for post-purchase offers, the checkout reference | Stored with order analytics, for orders that contain one of our offers |
| Order contents | Products, variants, titles, quantities, prices, discounts, currency, timestamps, test flag and sales channel | Stored with order analytics, for orders that contain one of our offers |
| Line-item properties | Our own offer properties in full. For properties added by your theme or other apps, only the property name. | Stored with order analytics. Values from your theme or other apps reach us with the order but are not stored |
| Customer tags | Tags you have given a logged-in customer | Read in the customer’s browser to apply your targeting. Not sent to or stored on our servers |
| Approximate location | A country code derived from the visitor’s IP address at the network edge, used when an offer targets by country | Returned to the browser and not stored by the app |
| Storefront events | Random event IDs, the product or offer, offer label, counts and timestamps | Stored for analytics. They contain no IP address, user agent or customer ID |
| Browser storage | Unsent analytics events, a random ID for the browser tab and countdown timer state | Kept in localStorage and sessionStorage. The app sets no cookies |
| Privacy requests | Shopify customer ID and order IDs from Shopify’s privacy webhooks | Email and phone are removed before storage. Records are kept for 90 days |
Two limits are worth knowing:
- Values such as gift messages still reach us with the order and can stay in transit for up to 7 days, but they are not stored with order analytics. Please don’t use line-item properties to collect sensitive data.
- Our hosting and network providers may record IP addresses and browser details in request logs, along with the Shopify customer ID of a logged-in customer. These logs are kept for up to 30 days.
How access is limited
- By Shopify: Shopify approved the app for Level 1 protected customer data, which excludes name, address, phone and email fields. Shopify redacts fields an app is not approved for.
- By our webhook settings: we ask Shopify to send only the order and line-item fields listed above. We do not request customer details.
- By our own processing: Shopify’s mandatory privacy webhooks do include a customer’s email and phone, so that a request can identify them. We remove both before anything is stored.
What each permission is for
| Permission shown by Shopify | What the app uses it for |
|---|---|
View customers (read_customers) |
Lists the customer tag names in your store, so you can pick them when targeting an offer. The app does not query individual customer records |
View orders (read_orders) |
Looks up specific orders for post-purchase offers and for bundles sold through an offer |
Edit products (write_products) |
Lets you pick products for offers. The app does not create, edit or delete products |
Edit discounts (write_discounts) |
Creates and manages the app’s own automatic discounts, which apply your offer discounts at checkout |
View Online Store (read_themes) |
Checks whether the app embed is turned on in your theme |
| View other data (locales, Markets, inventory, product listings, selling plans) | Supports translations, market targeting, product availability and selling plans in offers |
Shopify’s screens group permissions into broad categories, so they can list more than the app uses. The App Store listing shows customer geolocation, IP address, browser and operating system. The app’s use of these is limited to the country lookup and request logs described above. The listing also shows store owner details, which our Privacy Policy covers.
How long data is kept
| Data | Retention |
|---|---|
| Order analytics and storefront events | While the app is installed. Deleted for specific orders on a Shopify customer redaction request, and for the whole store on a shop redaction request |
| Post-purchase analytics keyed by checkout reference | Until shop redaction, because they cannot be matched to a customer on a customer redaction request |
| Daily aggregated analytics, with no order or customer identifiers | While the app is installed. Deleted on shop redaction |
| Privacy-webhook records | 90 days |
| Backups and logs | Up to 30 days |
After you uninstall, Shopify sends the shop redaction request about 48 hours later. We wait up to 3 days in case you reinstall, then delete the data within Shopify’s 30-day deadline.
Where data is stored
Data is stored and processed primarily in the United States, using Vercel, Neon and Google Cloud. Background billing jobs run in the EU on Upstash. The full list of sub-processors is in the DPA.
What you need to do
The app’s storefront analytics do not currently read Shopify’s Customer Privacy API consent signals. Please treat them as essential processing in your consent setup.
For privacy questions, email support@essential-apps.com with “Privacy” in the subject line.