Double Up Privacy Policy

Double Up: Unbeatable Upsell is a Shopify app provided by Blox Labs, Inc. and its affiliates (“Double Up”, “we”, “our”, or “us”). Double Up lets merchants using Shopify (“Merchants”) offer their shoppers one more unit of an item already in the cart, at a discount, in checkout (the “Service”). This Privacy Policy describes the information we collect when a Merchant installs and uses the Service and when anyone visits this website (the “Site”), how we use it, with whom we share it, and the choices available to you.

Information We Collect

From Merchants

When you install Double Up, Shopify gives us access to certain information about your store:

• Store information, such as your store domain, Shopify plan, currency, time zone and subscription status;
• Account information Shopify provides when you or your staff open the app, which may include a staff member’s name, email address and locale;
• Product information, such as product titles, variants, prices, compare-at prices, unit costs, tags, types, vendors and collections, used to decide which items can be offered and at what price;
• The settings you choose in the app, such as discounts, overrides, exclusions, checkout placement and offer text; and
• Any other information you choose to send us, for example when you email us for support.

The Service requests these Shopify permissions: write discounts (to create and maintain the Double Up discount), read products and read inventory (to price offers and apply a margin floor using unit cost), and read orders (to record which orders included an accepted offer).

About Shoppers, on Behalf of Merchants

When a shopper reaches checkout in a Merchant’s store, the Double Up checkout extension asks our servers for an offer. To show offers and report results to the Merchant, we process:

• The checkout identifier Shopify assigns to that checkout;
• Which item was offered, its price and discount, and whether the offer was shown, accepted or undone, with the time of each event; and
• For orders that include an accepted offer: the order identifier, currency, line items and discounts applied.

We do not request or store shopper names, email addresses, phone numbers, postal addresses or payment details. The order information we receive from Shopify is limited to the fields listed above.

For this information the Merchant is the controller (or business), and Double Up acts as a processor (or service provider), processing it only to provide the Service to that Merchant and on that Merchant’s instructions.

From Site Visitors

This Site is a static website hosted on GitHub Pages. GitHub may log technical information, such as IP addresses, when pages are requested. The Site loads fonts from Google Fonts, which receives your IP address and browser information when it serves them.

We use Google Analytics to understand how visitors use the Site. Google Analytics uses cookies and similar technologies to collect information such as pages viewed, links clicked, referring pages, approximate location, device and browser type, and the dates and times of visits. Google may combine this with information it has collected elsewhere. For more information, see how Google uses information from sites that use its services. You can opt out with the Google Analytics opt-out browser add-on or by blocking cookies in your browser. The Site does not use advertising trackers, and the Double Up app does not use Google Analytics.

Cookies and Your Choices

The first time you visit, the Site asks whether you accept analytics cookies. If you are in the European Economic Area, the United Kingdom or Switzerland, Google Analytics does not set cookies unless you accept. Elsewhere, analytics cookies are used unless you decline. You can change your choice at any time with the “Cookie settings” link at the bottom of every page. Your choice is saved in your browser’s local storage.

How We Use Information

We use the information described above to:

• Provide and operate the Service, including selecting, pricing and signing offers;
• Show Merchants how their offers perform, such as how often offers are shown and accepted and the revenue from accepted offers;
• Process billing through Shopify;
• Provide customer and technical support;
• Understand how visitors use the Site and improve it;
• Secure the Service, including detecting reused or altered offers and preventing misuse; and
• Comply with legal obligations, enforce our agreements and protect the rights, property or safety of Double Up, our Merchants or others.

We do not use shopper information for advertising or to build profiles of shoppers.

Legal Bases for Processing (EEA, United Kingdom, and Switzerland)

Where data protection laws in the European Economic Area, the United Kingdom or Switzerland apply, we process Merchant information because it is necessary to perform our contract with you, for our legitimate interests in operating, securing and improving the Service (where those interests are not overridden by your rights), and to comply with legal obligations. We process shopper information on the Merchant’s behalf and on the legal basis the Merchant relies on.

Information We Share

We do not sell personal information. We share it only as follows:

• Shopify: the Service runs on Shopify, and information passes between Shopify and us to provide it;
• Service providers: vendors that host and operate the Service for us, such as our application hosting, database and website analytics providers, under obligations to protect the information;
• Legal and safety: where required by law or legal process, or to protect the rights, property or safety of Double Up, our Merchants or others; and
• Business transfers: in connection with a merger, acquisition, financing or sale of all or part of our business, subject to this Privacy Policy.

Data Transfers

Double Up is headquartered in the United States, and our service providers may process information in other countries. Where required, we use Standard Contractual Clauses or other appropriate safeguards for transferred data.

How We Protect Information

We maintain administrative, technical and physical safeguards designed to protect information against accidental, unlawful or unauthorized destruction, loss, alteration, access, disclosure or use. For example, the keys used to sign offers are encrypted at rest, and access to our systems is restricted.

Retention

We keep offer and order records for up to 13 months, then delete them. When a Merchant uninstalls Double Up, we delete that store’s information after Shopify sends the shop deletion request, which it does 48 hours after uninstall. We respond to Shopify’s customer data and deletion requests for shoppers. We may keep information longer where the law requires.

Your Rights and Choices

Depending on where you live, you may have rights to access, correct, delete, restrict or port your personal information, or to object to certain processing. Merchants can contact us at privacy@getdoubleup.com. Shoppers should contact the store they purchased from, since the store controls their information; we will help that store respond. We may verify your identity before responding, and will respond within the timeframes the law requires.

California residents may have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act. We do not sell or share personal information for cross-context behavioral advertising, and we will not discriminate against you for exercising your rights. Where the GDPR or UK GDPR applies, you may also lodge a complaint with a supervisory authority.

Children’s Privacy

The Service and the Site are intended for businesses and are not directed at children under 16. We do not knowingly collect personal information from children under 16.

Updates to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the revised version on this page and update the date above. If we make material changes, we will provide additional notice as required by law.

How to Contact Us

If you have questions about this Privacy Policy or our privacy practices, or want to exercise your rights, contact us at:

Email: privacy@getdoubleup.com