Who we are
Eversogood Web Services Pty Ltd. Contact us at support@eversogoodapps.com.
Eversogood Popup: what it collects
- Email addresses submitted to the popup. These go straight into the
merchant's Shopify store as a customer with marketing consent.
- A masked copy of the last five addresses per store, so the merchant can
confirm signups are arriving. Only the first and last character of the local part survive.
- Counts: how often the popup was shown, scratched, completed, by day,
by theme and by which popup. These are numbers, not people, and cannot be traced back to
an individual.
- Filtered traffic: a count of the automated visits kept out of those
numbers, and the name of the network they came from, such as a cloud provider. Counts and
network names only, never an IP address and nothing about a person.
Eversogood Discount Stacker: what it collects
- From each paid order: its total and which of your discounts came off each
line, read from Shopify's paid-order webhook so the dashboard can show what your own
promotions took off. No name, email address, phone number or postal address is read
or stored.
- A copy of your campaigns, their names, settings and Shopify's own usage
counts, so the dashboard can list them.
- The discount codes on your campaigns, so they can be listed, exported and
removed from the dashboard.
- On the shopper's own device: the discount code they arrived with, kept for
that browsing session only, and where you run a countdown, its end time in a first-party
cookie so the timer does not restart on the next page. Nothing is sent anywhere else and no
identifier for the shopper is created.
The discount itself is calculated inside Shopify's own checkout by a Shopify Function, so no
shopper data passes through us to price an order.
Both apps
We store your store details: domain, name, timezone and currency, plus an
encrypted access token so the app can do its job.
What they do not collect
No names, phone numbers, addresses or payment details. No tracking of shoppers across sites,
no advertising identifiers, no third-party analytics on your storefront. The storage described
above stays on the shopper's own device and is read only by your storefront.
Who we share it with
Nobody. Data is not sold, rented or passed to advertisers. The apps run on Cloudflare Workers
and store their records in Cloudflare D1; Cloudflare processes that data on our behalf and
nothing else.
How long it is kept
Masked signups are kept only as the most recent five per store. Campaign records and
aggregate counts are kept while the app is installed. When a merchant uninstalls, Shopify sends
a redaction request about 48 hours later, and every record belonging to that store is deleted.
Erasure requests
When Shopify asks us to erase a specific customer, we delete any masked record matching that
address. Requests can also be made directly to support@eversogoodapps.com.
Security
Access tokens are encrypted at rest, so a database dump alone cannot act on a store. Every
request from Shopify is signature-verified before it is read. Every read and write is scoped to
a single store by construction.
