Privacy Policy

1. Who we are

This policy explains how Madyan Alkarhani, an individual operating Upsellano from Lebanon ("we", "us"), handles personal information in connection with the App and the website upsellano.com.

• Operator: Madyan Alkarhani, individual operator, Lebanon
• Privacy contact: privacy@upsellano.com
• Support contact: support@upsellano.com
• Where the App is offered: initially only to merchants whose Shopify business location is in one of these countries and territories: the United States, Canada, Australia, New Zealand, the United Arab Emirates, Saudi Arabia, Qatar, Kuwait, Bahrain, Oman, Jordan, Lebanon, Egypt, Morocco, Tunisia, Algeria, Iraq, Libya and the Palestinian Territories. The App is not offered to merchants located in the European Union or the United Kingdom; we will review those markets separately before offering the App there.
• Representative in the EU and the UK: none appointed. Upsellano is operated from Lebanon and has no establishment in the EU, the EEA or the UK. Because this initial launch excludes merchants in the EU and the UK, we have not appointed a representative in the EU or in the UK. We will re-evaluate whether the GDPR or the UK GDPR applies to us, and whether we need a representative, before we open the App to merchants in the EU or the UK, and when a material change in our processing of order data affects that assessment. Where we process shoppers' data for a merchant, the merchant is the controller: please contact the merchant, and we will assist them. You can contact us directly at privacy@upsellano.com, and you may complain to your local supervisory authority.

This policy is published at https://upsellano.com/privacy.

2. Summary

• The App is a tool for Shopify merchants. It shows offers (quantity breaks, bundles, upsells, mix & match, a sticky add to cart bar and a cart goal bar) on the merchant's store, measures how they perform, and lets the merchant run A/B tests of how offers look.
• We don't request or store shoppers' names, email addresses, phone numbers or physical addresses. The App doesn't store customer IDs, and its code doesn't read, store or log shoppers' IP addresses (for our hosting provider's own logs, see section 5).
• Storefront analytics are stored as aggregated daily counts with no identifiers, and are sent only when Shopify's customer privacy settings allow analytics for that shopper. To count each event once, each event's random page-view identifier is also kept for 48 hours; it is generated for one page view, isn't linked to a customer, and comes with no name, email address, phone number or address (section 5).
• For order lines that include the App's offers, we keep a minimal record of the line, with no customer details, to calculate the revenue the App generated, the merchant's plan usage and their analytics.
• We don't sell personal information, share it for cross-context behavioral advertising, use it for advertising, or use it to train artificial intelligence models.
• Detailed records are kept for 13 full calendar months after the month they were recorded, then deleted or reduced to aggregated totals. Detailed order records are kept for a shorter period, 6 full calendar months after the month of payment, then reduced to aggregated totals and keyed refund-matching codes kept for 13 more full calendar months (section 11). The data the App holds for a store is deleted about 48 hours after the merchant uninstalls the App.

3. Our role

• Merchants' shoppers. The merchant decides why and how its shoppers' data is used, and is the controller (or, under California law, the "business"). When the App processes storefront or order data about the merchant's shoppers, we act as the merchant's processor (or service provider), only to provide the App to that merchant, under our Data Processing Agreement at https://upsellano.com/dpa, which forms part of our Terms of Service. Shoppers with questions about their data should contact the merchant whose store they used; we help the merchant respond (section 12).
• Our plan billing. On the merchant's behalf, as its processor, the App adds up the merchant's attributed order lines (section 6) into one revenue total for each billing cycle and shows it to the merchant. That total is a single amount for the store, with no order, line or customer reference. We also use it to measure the merchant's plan usage under our Terms of Service: which plan limit applies, and whether the merchant needs to upgrade to lift a restriction. We never move a merchant to a higher plan without its approval: a plan changes only when the merchant approves it on Shopify's confirmation page. For this use the totals are information about the merchant (section 4), not about its shoppers, and we are the controller. Where the merchant is an individual (for example a sole trader) and the law treats those totals as their personal data, we use them because they are needed to perform our contract with the merchant (legal basis where the GDPR or UK GDPR applies: Article 6(1)(b)). We don't use the order lines or other information about shoppers for our own purposes.
• Merchants. For the information about merchants that we need to run the App and our business (store details, configuration, plan and billing status, support and privacy correspondence), we are the controller.
• Website visitors. For visitors to upsellano.com we are the controller (section 8).

4. Information about merchants

When a merchant installs and uses the App, we store:

• Store details: the store's myshopify domain, its Shopify ID, its currency, whether it is a development store, and when the App was installed or uninstalled. When we need to send a service, billing, security or legal notice, we may read the store's contact email address from Shopify for that purpose. The App also reads the store's name and time zone from Shopify when its pages load, to greet the merchant and show dates in the store's time; it doesn't store them.
• Access to the store: the access token Shopify issues so the App can call Shopify's APIs for the store, and related session records. The App uses store-level (offline) access only, so it doesn't store staff names or email addresses. Access tokens are encrypted by the App (AES-256-GCM) and are never written to logs.
• App configuration: the offers, settings, styles and A/B tests the merchant creates, and the products and variants they use (including product titles and handles saved with an offer).
• Plan and billing status: the merchant's plan and its status as reported by Shopify, and the attributed revenue measured for each billing cycle (sections 6 and 7). We never receive card or bank details: Shopify bills merchants.
• Correspondence: emails merchants send to support@upsellano.com or privacy@upsellano.com, and our replies.

Why we use it, and our legal bases (where the GDPR or UK GDPR applies): to provide the App and our support under our Terms (performance of a contract); to keep the App secure, prevent abuse and improve its reliability (our legitimate interests in running a secure service); and to keep records the law requires (legal obligation).

5. Storefront analytics and A/B tests

What is sent

When the App's widgets are on a page, the shopper's browser may send events: a widget was shown, an option was selected, or a product was added to the cart through a widget. Each event contains only:

• the module and offer,
• the A/B test version, when one is assigned,
• the event type,
• the time,
• a random identifier for the page view, generated for that page view only and used to drop duplicate events.

Events are sent to the App through the Shopify app proxy on the store's own domain, and the App checks that each request came through Shopify for that store.

Consent (Shopify customer privacy)

• Before sending anything, the widgets ask Shopify's Customer Privacy API whether analytics is allowed for this shopper. This reflects the shopper's choices and the store's privacy settings for the shopper's region, which the merchant manages in Shopify.
• If analytics isn't allowed, or the answer isn't available, nothing is sent. The App's server also rejects events that don't carry the storefront's consent flag.
• A/B tests: a version is shown, stored and measured only when analytics is allowed. While Shopify's answer is still loading, a widget with a test waits for it, hidden, for at most about a second. Shoppers without that permission, or whose answer doesn't arrive in time, see the default (Control) version and aren't counted; a version stored on an earlier visit is kept but not used. If a shopper declines analytics, including on the page, the widget returns to Control at once, unsent events are dropped and the stored version is removed.
• Nothing is sent from Shopify's theme editor.

What is stored

• Daily counts: per store, day (UTC), module, offer, A/B version and event type. Events are added to these counts as they arrive, and the time is reduced to the day.
• Short-lived duplicate-check records: for each event received, a record of its page-view identifier, event type, module, offer and A/B version, and the time it was received. These records are used only so that a repeated event counts once, contain nothing else about the shopper, and are deleted after 48 hours, in practice within about a day after that (section 11).
• Counts of events that couldn't be recorded (for example over a rate limit), per store and day, so the App can say when figures are incomplete.

What isn't collected

• The App's code doesn't read, store or log shoppers' IP addresses.
• The App's server reads the browser's user-agent on each analytics request only to ignore bots, and on the App's own pages only to decide how the page is delivered; it isn't stored or logged. The App doesn't determine or store anyone's location.
• Shopify adds the logged-in customer's ID to signed app proxy requests. The App uses the request only to check Shopify's signature; it doesn't store or log that ID.
• The App's request logs record the method, the path (without query strings), the response status and size, and the response time.
• Our hosting provider's network may process the IP addresses of requests to the App to deliver them. Requests to the App pass through Render's infrastructure, including Cloudflare as Render's network provider. Render may process network and request metadata, including IP address and device data and HTTP request details (such as the method, status, host, requested path or URL and a request ID), for hosting, security and operational logging. Render documents that the logs available to its customers are kept for a period that depends on the workspace plan (7, 14 or 30 days); Render may keep its own records under its own privacy policy.
• The App doesn't use Shopify Web Pixels or customer-event tracking.
• Shopify's privacy webhooks (section 12) include the customer's ID, email address and phone number. The App receives them, doesn't read them, and doesn't store or log them.

Browser storage and cart properties

• The widgets set no cookies.
• When analytics is allowed and an offer has an A/B test, the shopper's version is kept in the browser's localStorage so they keep seeing the same one. It has no expiry date and isn't removed when the test ends (it is then no longer used). It is removed if the shopper declines analytics, or when the shopper clears their browser's storage.
• A shopper who closes the sticky add to cart bar keeps it closed for that browser session (sessionStorage). This only remembers the shopper's own choice and is never sent to us.
• Products added through the App's offer widgets carry hidden cart line properties naming the App's offer, and the A/B version when one is assigned, so orders can be attributed. The offer property is added for every shopper; the A/B version is added only while analytics is allowed. They contain no personal data.

Purpose

To show the merchant how their offers perform and to measure A/B tests. Storefront figures are estimates.

6. Order data

To measure the revenue the App's offers generate, the App reads the merchant's paid orders, refunds and cancellations through Shopify (read_orders access, protected customer data Level 1). Shopify gives the App access to the last 60 days of orders.

• What the App asks Shopify for. For each order: its identifier, payment status, cancellation time and whether prices include tax. For each line: its identifier, product, variant, quantity, price, discounts, taxes and cart line properties. For each refund: its identifier, date, refunded lines and amounts. The App doesn't ask for customers' names, email addresses, phone numbers, physical addresses or customer IDs.

• What it may receive and discards at once. Cart line properties can contain information that a shopper or another app added (for example personalisation text). The App keeps only its own offer and A/B properties and discards the others as soon as it receives them, without storing or logging them. Shopify's privacy-request notifications include the customer's email address or phone number; the App reads only the order numbers in them and doesn't store or log the rest.

• What it keeps, and only for order lines that include the App's offers:

  • the order, line and refund references;
  • the module, offer and A/B version;
  • the quantity;
  • the amount after discounts and before tax, in the shop's and the order's currencies, and whether prices included tax;
  • for measuring plan usage in USD, the exchange rate applied to the line, with its source and date, and the USD amount;
  • refunded amounts, cancellations, dates and payment status.

  The references are Shopify's own identifiers. They don't name anyone, but the merchant can link them to a customer, so we treat them as personal data and protect them as such. Other order lines are discarded when received.

• When an order counts. An order counts when Shopify reports it as paid. A partially paid order (for example one paid with a deposit) counts only once it is fully paid, for the full value of its attributed lines. Refunds of those lines are subtracted when they happen. A cancellation is recorded as a status and changes attributed revenue only through its refunds.

• Consent: order attribution applies to every order that contains the App's offer property, whatever the shopper's analytics choice, because it measures the merchant's own sales. The A/B version is recorded only for shoppers who allowed analytics.

• Purposes: on the merchant's behalf, the merchant's attributed revenue, analytics and A/B test results, and letting the merchant audit and reconcile them. The per-cycle total of attributed revenue is also used to measure the merchant's plan usage (section 3).

• After the detail period. Detailed records are reduced after 6 full calendar months (section 11). From then on the App keeps keyed one-way codes instead of the references, so that a later refund still reduces attributed revenue and the order is never counted twice. The codes don't contain the order or line number, but the App can match them to an order it is given, so they remain personal data.

• Orders influenced only by the cart goal bar aren't recorded.

7. How we use information

We use the information above only to:

• provide, operate and support the App's features;
• show the merchant analytics and A/B test results;
• measure the merchant's plan usage from its attributed revenue totals, and show which plan limit applies (we never move a merchant to a higher plan without its approval);
• read the merchant's plan status from Shopify (through the Shopify Partner API) and apply our Terms;
• keep the App secure, prevent abuse and fix problems.

We don't sell personal information or share it for cross-context behavioral advertising. We don't use merchant or shopper data for advertising, don't combine one merchant's data with another's, and don't use it to train artificial intelligence models. We don't make decisions with legal or similarly significant effects about anyone by automated means: A/B tests only change how an offer looks, at random.

8. Website visitors

upsellano.com is a static website. It sets no cookies, runs no scripts, has no forms and loads nothing from other websites, so we don't show a cookie banner. Like any web host, our host's servers receive visitors' IP addresses and browser details to deliver pages and protect the site, and record them in access logs (the IP address, the page requested, the browser, the country, the size and the time). We use these logs only to run and secure the website (our legitimate interest). Our host, Hostinger, provides these access logs, with request and IP information, to our account, where they can be viewed for up to seven days. Hostinger may separately keep operational and security records under its own policies and data processing addendum; we don't represent that those copies are deleted after seven days.

Our website doesn't track visitors over time or across other websites, so it doesn't respond differently to "Do Not Track" signals.

9. Service providers

• Shopify: the platform the App runs on and the merchant's own commerce provider. It provides authentication, store data, the app proxy and billing under its own terms with the merchant.
• Hosting: Render, in its US East (Virginia) region, for the App's web service, scheduled jobs and PostgreSQL database. Render uses its own sub-processors, listed at https://render.com/trust.
• Email: Hostinger hosts our mailboxes (support@upsellano.com and privacy@upsellano.com) and relays outgoing mail through MailChannels. They process the messages merchants send us and our replies.
• Website: Hostinger hosts upsellano.com, through its content delivery network.

Render and Hostinger process personal data for us under their data processing agreements, and MailChannels as Hostinger's sub-processor. Under its own terms, Render also handles limited connection and activity data about use of its platform as an independent controller. No other provider receives personal data.

10. International transfers

We operate from Lebanon, and the App's data is stored in the United States (Render, US East). Personal data from merchants and their shoppers in other countries is therefore transferred to the United States and accessed from Lebanon. Neither country has a general adequacy decision from the European Commission or the UK; the United States is covered only for organisations certified under the EU-U.S. Data Privacy Framework and its UK Extension.

• For personal data we process for merchants, our Data Processing Agreement includes the European Commission's Standard Contractual Clauses (controller to processor) and the UK International Data Transfer Addendum.
• Render, our hosting provider, is certified under the EU-U.S. Data Privacy Framework and its UK Extension, and its data processing agreement with us also includes the Standard Contractual Clauses and the UK Addendum.

Emails we send pass through MailChannels in the United States, and our mailboxes are hosted by Hostinger, whose data processing addendum includes the Standard Contractual Clauses and the UK Addendum for transfers. Hostinger operates a distributed international infrastructure, and we don't represent the server or location used for our mailboxes as fixed to a single country.

You can ask for a copy of the relevant safeguards at privacy@upsellano.com.

11. Retention and deletion

The App's scheduled daily jobs carry out the deletions above. We chose 13 full calendar months so that merchants can compare a full year with the same month a year earlier and settle billing for any cycle in that period; we review the periods regularly.

12. Data requests and erasure

The App responds to Shopify's mandatory privacy webhooks:

• Customer data request: the App records the request (Shopify's request number, dates, outcome and, until it is answered, which of the named orders it holds records for). It never stores the customer's ID, email or phone. If it holds nothing for those orders, the request is closed as "No data held". Otherwise the merchant sees it in the App (a notice on the App's home page and a Customer data requests page), with a summary and a CSV of the records held for those orders: order, line and refund references, offer, A/B version, quantity, amounts, refunds, status and dates. The CSV is generated when the merchant downloads it and isn't kept. Once the merchant marks the request as sent (or after 60 days), the order references are removed from it.
• Customer erasure: the named orders' records are removed at once. Their amounts are kept only within monthly totals per offer and as billing amounts with their time and currency, with no order, line, refund or customer reference, so the store's totals and plan stay correct. So that an erased order is never recorded again (for example when Shopify resends an order update) and its later refunds still reduce the store's billed revenue correctly, the App keeps, for each erased order and each of its counted lines and refunds, a keyed one-way code made from the Shopify IDs with a secret key, and for a counted line the offer, currency, whether prices included tax and the amount not yet refunded. This record contains no order number, customer details or contact information, but because it can be matched to an order by someone holding both the secret key and the store's order numbers, we treat it as personal data, protect it accordingly and delete it 13 full calendar months after the erasure.
• Shop deletion: Shopify sends this about 48 hours after a merchant uninstalls. We then delete all of the data the App holds for the store: sessions, configuration, styles, A/B tests, analytics, order records, plan status and the records above. Database backups expire within 3 days, and support emails are kept as section 11 describes.

13. Your rights

• Shoppers: please contact the merchant whose store you used. The merchant controls your data, and Shopify passes your requests to us through the webhooks in section 12.
• Merchants and website visitors: depending on where you live, you may have the right to access, correct or delete your personal information, to object to or restrict its use, to receive a copy in a portable format, and to withdraw consent where we rely on it. Email privacy@upsellano.com. We may need to confirm your identity and your connection to the store, and we answer within one month (or the shorter period your law sets).
• Complaints: please tell us first at privacy@upsellano.com so we can try to put things right. You can also complain to the data protection authority where you live or work, or where you think an infringement happened; in the UK that is the Information Commission.
• California: we act as a service provider to merchants and currently don't meet the thresholds of a "business" under the California Consumer Privacy Act. We don't sell or share personal information as that law defines those terms.

14. Security

• HTTPS for all traffic between Shopify, browsers and the App; webhook and app proxy requests are verified with Shopify's signatures.
• TLS for every connection between the App and its database, which is reachable only from the App's private network.
• Database encryption at rest by the hosting provider, backups included.
• Shopify access tokens additionally encrypted by the App (AES-256-GCM), with keys kept in the hosting provider's secret settings, not in source code.
• No access tokens, secrets or customer data in logs; request logs without URL query strings.
• Administrative access to production limited to the operator, using two-factor authentication.

No system is perfectly secure. If a security incident affects personal data we process for a merchant, we notify that merchant without undue delay, as our Data Processing Agreement sets out, so it can meet its own obligations. If an incident affects personal data we control, we notify the authorities and the people affected where the law requires it.

15. Children

The App is a business tool for merchants and isn't directed to children. We don't knowingly collect information from children.

16. Changes to this policy

We may update this policy. We post the new version at https://upsellano.com/privacy with a new effective date. For material changes we tell merchants in the App and by email to the store's contact email address (both where available) at least 30 days before they take effect, unless the law requires a change sooner. We will not start processing a new kind of shopper data before this policy describes it.

17. Contact

• Privacy: privacy@upsellano.com
• Support: support@upsellano.com