Privacy Policy — Salescape

Last updated: October 11, 2026

This Privacy Policy describes how Salescape (“we”, “us”, or “our”) collects, uses, and shares information when you use our Shopify application (the “App”). By installing or using the App, you agree to the terms of this policy.

1. Who we are

Salescape is a Shopify application that helps merchants sell subscriptions: design subscription offers, run A/B tests on storefront product pages, manage the subscriptions sold through Salescape plans, and track the resulting revenue. The App is operated by the Salescape team. For any questions about this policy, contact us at support@salescape.co.

2. Information we collect from merchants

When you install the App on your Shopify store, we collect:

• Store identifier: your myshopify.com domain and Shopify Shop ID, required to associate data with your store.
• OAuth access tokens issued by Shopify, used only to call the Shopify Admin API on your behalf within the scopes you approved during installation.
• Configuration you create in the App: subscription plans, offers, A/B test settings, layout preferences, copy, and styling.
• Product and theme metadata read via the Shopify Admin API: product titles, variant prices, and theme settings — strictly the minimum needed to render the widget and detect whether the app embed is enabled in your active theme.
• Order data received via the orders/paid webhook and read with the read_orders scope: order identifier, currency, order and line-item totals, product and variant identifiers, quantity, and the selling plan applied. We use this solely to attribute revenue and conversions to your offers and A/B tests. We do not collect or store the customer's name, email, billing/shipping address, or phone number from orders.
• Subscription data — only for subscriptions sold through Salescape plans: Shopify identifiers of the subscription contract, its customer and its orders; contract status, plan, price, currency and billing schedule; the result of each renewal billing attempt (success or failure reason, next retry date); and a log of actions taken on the subscription (whether the merchant, the customer, or the App's automated renewal process acted, what was done, and when). We do not collect the customer's name, email, address, or phone number.

We do not request, store, or process payment card details. Billing for the App itself is handled entirely by Shopify Billing API; we only receive the resulting subscription status.

3. Information we collect from your storefront visitors

When a visitor loads a product page containing the Salescape widget, the widget sends the following to our servers:

• A randomly generated anonymous visitor identifier (stored in the visitor's browser localStorage). This identifier is not linked to any personally identifiable information.
• The product ID being viewed and the variant ID the visitor selected.
• The store domain that loaded the widget.
• The experiment key and variant assignment if the product is part of an active A/B test, so that the same visitor consistently sees the same variant.
• Widget interaction events: when the widget is viewed and when a subscription or one-time option is added to cart. These events are sent to our analytics database and are tied only to the anonymous visitor identifier above.

We do not collect names, email addresses, billing addresses, IP addresses, or any other directly identifying information from storefront visitors.

4. How we use the information

We use the information described above to:

• Operate the App and render the widget on your storefront.
• Persist subscription plans and offers you configure.
• Bill subscription renewals on your behalf: on each scheduled billing date the App asks Shopify to charge the renewal. Shopify charges the payment method it keeps on file and creates the order — the App never receives payment details. If a payment fails, the App retries it and, if retries fail, pauses the subscription and shows it to you.
• Let your customers view and manage their subscriptions (pause, resume, skip, cancel, update payment method) in their Shopify customer account.
• Route A/B test traffic deterministically so visitors get a stable experience.
• Compute the revenue, conversion, and funnel analytics shown to you in the App.
• Respond to support requests you send to us.
• Comply with Shopify Partner Program requirements and applicable law.

We do not sell, rent, or share your data with third parties for advertising or marketing purposes.

5. Where we store data and how long we keep it

All data is stored on encrypted servers operated by Fly.io in the United States. We use managed PostgreSQL for application data and rely on Fly.io's automated backups for disaster recovery.

• Merchant configuration (offers, plans, A/B tests): retained while the App is installed and for 30 days after uninstall, then permanently deleted.
• Storefront analytics events (anonymous): retained for 12 months, then permanently deleted.
• Order analytics records (order/line-item totals, product and selling-plan identifiers — no customer PII): retained while the App is installed and deleted on store uninstall, or per a customers/redact request for the affected orders.
• Subscription records (contract identifiers, status, billing attempts, action log — no customer name, email, address, or payment details): retained while the App is installed; deleted on store uninstall (shop/redact), or per a customers/redact request for that customer's subscriptions.
• OAuth tokens: invalidated immediately on uninstall via the app/uninstalled webhook.

6. GDPR and CCPA compliance

Salescape complies with Shopify's mandatory privacy webhooks. When Shopify forwards us one of the following requests, we act on it within 30 days:

• customers/data_request — we return any data we hold associated with the identified customer. Because we do not store personally identifying information (only anonymous events, order totals/line items, and subscription status and billing records), this typically returns a minimal result.
• customers/redact — we delete any data we hold for the identified customer, including the order analytics records for the orders Shopify lists in the request and the subscription records for that customer.
• shop/redact — we delete all data associated with a store, 48 hours after the store uninstalls our App.

If you are an EU/EEA/UK or California resident and want to exercise your data rights directly, email support@salescape.co and we will respond within 30 days.

7. Cookies and similar technologies

The App itself uses Shopify's session cookies (set by Shopify, not by us) to authenticate your admin session. The storefront widget uses one localStorage key (salescape_visitor_id) to maintain stable A/B test assignment per visitor. We do not use third-party advertising cookies.

8. Security

We protect data with:

• TLS encryption for all traffic between your browser, the storefront widget, and our servers.
• Encryption at rest for our PostgreSQL database.
• Scoped OAuth access — we only request the minimum Shopify scopes needed to operate the App.
• HMAC verification on every webhook from Shopify.

No system is perfectly secure. If we become aware of a breach affecting your data, we will notify you within 72 hours.

9. Children

The App is intended for use by Shopify merchants and adult shoppers. We do not knowingly collect information about anyone under 13 years of age.

10. Changes to this policy

We may update this policy from time to time. When we do, we will revise the “Last updated” date at the top and, for material changes, notify you within the App.

11. Contact

Questions, data requests, or complaints:

Salescape Support
Email: support@salescape.co

If you are not satisfied with our response, you may also lodge a complaint with your local data protection authority.