Privacy Policy

PopupGenius (“the app”, “we”, “us”) is a Shopify app that creates AI-designed upsell popups. This policy explains what data we handle when a merchant installs the app and when shoppers interact with the popups it creates. Questions? Email [email protected].

Data we collect

• Merchant data: your Shopify store domain and basic store info, the popups and settings you create, your plan/billing status, and the messages you send to the in-app AI designer.
• Shopper data (only when you enable email/lead capture): the email address — and optionally first name and phone number — a shopper submits in a popup, together with their marketing consent. We also record popup events (views, clicks, add-to-cart, purchases) to produce your analytics.

How we use it

• Run the app: create and show popups, generate designs with AI, apply discounts, and show you analytics.
• Sync captured leads to your Shopify customer list — only with the shopper’s consent.
• Provide support and improve the product.

We do not sell personal data and do not use it for advertising.

Who we share it with

We share data only with the providers needed to run the service:

• Shopify — the platform your store and our app run on.
• Google (Gemini API) — processes your design prompts and chat messages to generate popup designs.

We do not share personal data with anyone else.

Retention & deletion

We keep data while the app is installed. Captured shopper contact details are automatically purged after a limited, configurable retention period. We honour Shopify’s data-request and data-erasure webhooks (customers/data_request, customers/redact, shop/redact). When you uninstall the app or ask us to, we delete your data.

Your rights

Merchants and shoppers can request access, correction, deletion or a copy of their personal data (GDPR / CCPA). Shoppers should first contact the store they shopped with; merchants and data requests can email [email protected].

Security

We use reasonable technical and organisational measures to protect data, including encryption in transit, access controls, and EU-based hosting.

Changes

We may update this policy from time to time; the date at the top shows the latest version.

Contact

Questions about this policy or your data? Email [email protected].