Privacy Policy

1. Who we are

Oxify (“we”, “us”) makes Shopify apps, including Oxify Cart Drawer & Upsells and Oxify Quantity Breaks (the “Apps”), and runs this website. This policy covers both. Last updated: October 21, 2026.

2. What we collect

• Store data – store name, domain, Shopify store ID, plan, owner email.
• App data – your settings, offers, and usage and error logs.
• Shopify data you authorise – products, orders and, only where a feature needs it, limited customer data. We never collect card numbers or passwords; Shopify handles billing.
• Website data – details you submit in forms (name, email, store URL) and standard analytics and advertising pixel data (cookies).

3. How we use it

To run, secure and improve the Apps, give support, send billing and service notices, and, with your consent or where the law allows, send product updates (unsubscribe anytime).

4. We do not sell or share your data

We do not sell or share personal information of merchants or their customers. California residents have the right to know what personal information we collect and how we use it, and we will not discriminate against anyone for exercising their privacy rights. We respond to California requests within 45 days.

5. Who we share it with

Only with service providers that help us run the Apps (hosting, analytics, error tracking, email), where required by law, or in a business sale or merger. They may use the data only for our services.

6. Shopify and GDPR

We follow Shopify’s privacy-law requirements (GDPR, CCPA and similar). The Apps are subscribed to all three of Shopify’s mandatory compliance webhooks, and we verify Shopify’s signature on each one:

• Uninstall – login sessions, which hold the store’s access tokens, are deleted right away.
• Customer data request – we provide the merchant any data we hold about that customer.
• Customer erasure – we delete that customer’s post-purchase orders, events and linked records.
• Shop erasure – Shopify sends this 48 hours after uninstall; we then delete the store’s post-purchase orders, events, impressions and checkout-offer data.

We complete each request within 30 days, unless the law requires us to keep certain records (for example billing). For the merchant’s customers, the merchant is the data controller and Oxify is the processor acting on the merchant’s instructions. You are responsible for your own store’s privacy notice and lawful basis.

7. Retention and deletion

We keep data only while the App is installed and for as long as the law or a legitimate business need requires. To request access, correction or deletion at any time, email contact@oxify.app. We may verify your identity first.

8. Your rights

Depending on where you live, you can access, correct, delete, restrict or port your data, object to processing, and withdraw consent. Email contact@oxify.app and we’ll reply within 30 days. You may also complain to your local data authority.

9. Security and breaches

We use reasonable safeguards such as HTTPS and access controls. No system is completely secure, and we can’t guarantee absolute security. If a data breach affects your data, we will notify affected merchants without undue delay, and within 72 hours where the law requires.

10. International transfers

Our servers may be outside your country; where we transfer personal data internationally we rely on appropriate safeguards such as standard contractual clauses.

11. Children

Our Apps and website are not for anyone under 16, and we do not knowingly collect their data.

12. Changes and contact

We may update this policy and will change the date above; material changes may be notified by email or in-app. Questions: contact@oxify.app.