How We Handle Your Customer Data on the Essential Loyalty Program & Rewards
How We Handle Your Customer Data on the Essential Loyalty Program & Rewards
A loyalty program has to store customer information — a points balance has to belong to someone, and rewards have to still be there when a customer comes back three months later. This article explains what we store, who else is involved, how long we keep it, and what happens when a customer asks to be deleted. The binding legal version is our Data Processing Agreement (DPA) — Essential Loyalty is covered in Annex 1.4.
🔒 What we store and why
Customer data we store:
- ✅ Name, email address, phone number, language and customer tags — to identify the customer, attach their points and send emails in the right language
- ✅ Email and SMS marketing consent (from Shopify) and email unsubscribe status — for consent checks
- ✅ Birthday (day and month, plus year if given) — for birthday rewards
- ✅ Total spent, number of orders, and the orders that earned points — to work out how many points to award and which tier applies
- ✅ Points balances and history, tiers, rewards redeemed (discount codes, store credit), referral codes and who referred whom
- ✅ Submissions customers send you for points (text, amounts, images) and your review decision — the images are stored in your own Shopify Files
- ✅ Delivery, open and click events for the loyalty emails we send for you
- ✅ Program totals (members, points issued, rewards redeemed)
What we never store:
- ❌ Card, bank, or any payment details — payments are handled entirely by Shopify
- ❌ Customer addresses — we don't ask for or keep street addresses, cities, or postal codes
- ❌ Advertising or tracking cookies, and no browsing history from your storefront
Why we need these fields: a points balance has to belong to a person, so we need something to identify them by. Email and phone are also how we match customers when you upload a CSV of balances from another loyalty app. Name is used in the widget greeting and in loyalty emails. If a field isn't used by a feature, we don't ask for it. Customers could type sensitive details into free-text or image submissions, so set up submission actions with that in mind.
Watch out — email tracking. Loyalty emails we send for you (reward redeemed, points expiring, birthday) count deliveries, opens and clicks, so you can see how they performed. That's tracking on our own emails only — not on your storefront. Tracking and unsubscribe links use internal IDs, not email addresses, and per-email open/click records are deleted after 13 months.
🍪 Cookies and browser storage
The app sets no advertising or tracking cookies. To make rewards work on your storefront it uses:
- One functional cookie,
__honeypop_el_discount_pending— carries a reward code the customer just redeemed into the cart - A localStorage key — so the same referral-link visit isn't counted twice
- sessionStorage flags — to remember reward state during the visit
As the controller, you decide how these are handled in your store's cookie consent banner (DPA Section 2.3).
🤝 Who else is involved
Running the app means using a few established service providers. Under GDPR these are our sub-processors for Essential Loyalty (DPA Annex 1.4):
- UpCloud USA Inc — application server, managed PostgreSQL database and monitoring (United States, Chicago)
- Cloudflare — proxy (security and performance layer) in front of the app
- Google Cloud — Pub/Sub, which delivers store events (like a new order) from Shopify to the app; region not pinned, so US or EU
- Postmark — sends the loyalty emails to your customers (United States)
- Sentry — error monitoring so we can fix technical problems; personal data is redacted from error logs (United States)
Services we use for all our apps are listed in DPA Annex 2: Help Scout (this help centre, support inbox and in-app chat), Google Workspace (our support mailbox) and GitHub (source code, no personal data by design). Shopify is where your customer and order data comes from — it's your platform, not our sub-processor.
Your loyalty program data is processed primarily in the United States (UpCloud, Chicago). Transfers outside the EEA are covered by DPA Section 8 (EU–US Data Privacy Framework or the EU Standard Contractual Clauses). We give at least 30 days' notice by email before adding or replacing a sub-processor.
Integrations you switch on yourself
These stay off unless you connect them in Settings → Integrations, and they run under your own account with that provider — they are your providers, not our sub-processors:
- Klaviyo — receives the customer's email plus their loyalty details (points, tier, referral code, birthday) and loyalty events, so you can build automations
- Omnisend — receives the customer's email and the same loyalty details
- Postscript — no customer data is sent at present
- Judge.me — sends review information to us so we can award review points; we don't send it customer data
When a customer is deleted, we pass it on to your integrations. We send the deletion to Klaviyo automatically. Omnisend doesn't offer a way for apps to delete profiles, so remove the customer in your Omnisend account yourself.
We also add your store's contact email to our own mailing list so we can send product updates. That's your address as a merchant — never your customers'.
🗄️ Security
- All connections are encrypted in transit (TLS)
- The managed PostgreSQL database and its backups are encrypted at rest by UpCloud. The application server's disk is not encrypted at rest — access to it is limited to authorised personnel
- Shopify access tokens are encrypted at application level, with key rotation
- Production systems are accessible only to authorised personnel who need access for their role; multi-factor authentication is enforced on company email accounts and our source-code organisation
- If a personal data breach affects your data, we notify your store's contact email without undue delay — where feasible within 48 hours
The full list of technical and organisational measures is in DPA Annex 3. If you need more to demonstrate compliance, email support@essential-apps.com (DPA Section 10).
⚖️ Your compliance position
We — UAB Essential apps — act as a data processor on your behalf. You're the controller: it's your store, your customers, and your privacy policy that applies to them. Our processing is governed by our Data Processing Agreement, which forms part of our Terms of Service, so no separate signature is needed. Terms, privacy policies and the DPA are all at essential-apps.com/legal.
- GDPR (EU/UK). We store only what a loyalty feature actually uses, process it only on your instructions to run your loyalty program, and never sell customer data or use it for our own marketing. Access and deletion requests are handled automatically (below).
- CCPA/CPRA and other US state laws. We don't sell or share customer personal information, including for cross-context behavioural advertising (DPA Section 11).
🙋 Customer data requests
When a customer exercises their rights, Shopify passes the request to us automatically and we act on it. Nothing is needed from you, apart from Omnisend (see above).
| Request | What we do |
|---|---|
| Customer asks for their data | We automatically compile everything we hold on them — profile details, points, activity, rewards, orders — and email it to your store's contact address, so you can pass it on |
| Customer asks to be deleted | We erase all their personal details, delete their submission images, remove references to them from other customers' referral history, and send the deletion to Klaviyo if connected. The points record stays but is no longer linked to a person, so your program totals don't change |
| You uninstall the app | See the timeline below |
These run even if your store is paused or already uninstalled.
⏳ How long we keep data
| Data | How long |
|---|---|
| Member profiles and loyalty data | While you use the app; erased per customer on a deletion request, and all of it on uninstall (below) |
| Email open/click records | 13 months per email sent (earlier on uninstall or plan downgrade) |
| Submission images | Deleted 90 days after you review them, or straight away if the customer is deleted |
| Error logs (personal data redacted) | 7–30 days |
| Web server access logs | 7 days |
| Records of privacy requests and of access to customer data | 10 years — kept as compliance evidence (Lithuanian Civil Code limitation period) |
| Database backups | Daily, kept 15 days |
🗑️ What happens after you uninstall
We hold on to data briefly so that reinstalling brings your program back with points, tiers, and history intact instead of empty. After that it's deleted — records are removed, along with any images you uploaded.
| When | What happens |
|---|---|
| About 48 hours after uninstall | Shopify asks us to delete your store's data, and we do |
| From 48 hours, checked daily | Our own daily clean-up deletes any store confirmed as uninstalled, in case Shopify's request doesn't reach us |
| Day 30 | If the uninstall was never confirmed, transactional data is removed |
| Day 60 | Anything remaining is deleted |
In practice a normal uninstall is fully deleted within about two to three days. Copies in database backups disappear as those backups expire (15 days); the only thing kept longer is the record of privacy requests listed above.
Why not straight away? Merchants often reinstall within the same week, and a short window means the program comes back intact. Before deleting anything we also re-check with Shopify that the store really is uninstalled and that no new orders or points have arrived — and stop rather than delete if we can't confirm it. A working store is never deleted by mistake.
📌 In short
- We store the minimum a loyalty program needs — no payment details, no addresses
- One functional cookie (for redeemed reward codes), no tracking cookies
- Five sub-processors for this app (DPA Annex 1.4), plus Klaviyo, Omnisend, Postscript or Judge.me only if you connect them
- Program data processed primarily in the United States; database and backups encrypted at rest, everything encrypted in transit
- Data requests and deletions are handled automatically through Shopify
- A normal uninstall is fully deleted in about two to three days, by day 60 in every case, and backup copies expire within 15 days
- Full legal details: essential-apps.com/legal/dpa (Annex 1.4)