Privacy Policy

for the AS Upsell & Cross Sell app by Augmentum Studios Ltd, available on Shopify App store

Last updated: 9 February 2026

1. Who we are

This Privacy Policy explains how Augmentum Studios Ltd (“Augmentum Studios”, “we”, “us”, or “our”) processes personal data in connection with our Shopify app, a Cart Page Upsell Widget (the “App”).

  • Company: Augmentum Studios Ltd
  • Email: support@augmentumstudios.com
  • Postal address: Augmentum Studios Ltd, International House, 101 King’s Cross Road, London, United Kingdom WC1X 9LP
  • Jurisdiction: United Kingdom

Augmentum Studios Ltd is the controller of personal data about merchants using the App. For personal data of customers of Shopify stores, we generally act as a processor on behalf of the relevant merchant (the “Controller Merchant”).

Our App is distributed through the Shopify App Store, and we comply with Shopify’s data and user privacy requirements for apps.

2. Scope of this Privacy Policy

This Privacy Policy applies to:

  • Merchants and their staff who install or use the App; and
  • The processing of data from the merchant’s Shopify store that occurs through the App.

This Privacy Policy does not apply to:

  • The merchant’s own Shopify store privacy practices; or
  • Shopify’s own processing of personal data.

For those, please refer to the merchant’s store privacy policy and Shopify’s own privacy policy.

3. How the App works (high-level summary)

  • The App is a Cart (Drawer & Page) Upsells & Cross-sells Widget that merchants configure via the App’s Admin UI in their Shopify dashboard.
  • The App is embedded in the Cart Page and Product Page as either an App Block or an App Embed, or an App Embed only on Cart Drawer.
  • The App may display upsell offers based on the products in the cart or the main product page item at the merchant’s configuration.
  • The App records aggregated analytics (e.g., impressions, add-to-carts, and attributed purchases and revenue) for upsell/cross-sell offers.
  • The App uses the Shopify Admin API with the following scopes: read_orders, read_products, write_products, read_themes.
  • The App is built with Remix/React, hosted on Vercel, and uses NeonDB (PostgreSQL) for session and configuration storage.

We only request and use Shopify scopes that are necessary for the App to function, in line with Shopify’s app requirements. We do not store any personal identifiable information of stores’ customers, or merchants themselves, other that what’s outlined below for shop identification purposes.

4. Personal data we process

4.1 Data about merchants and their store

We may process the following information about merchants and their store:

  • Shop identification data
    • Shopify shop domain (e.g., example-store.myshopify.com)
    • Shopify shop ID
  • App account / configuration data
    • Offers widgets configuration (e.g., products and variants selected, custom links added to offers, labels, pricing/discount logic, translations, custom styling)
    • Theme installation status for the App Blocks or App Embeds on respective surfaces (Cart Page, Cart Drawer, Product Page) (from read_themes)
  • Technical & usage data (merchant-side)
    • Admin UI usage events (e.g., creation or update of offers)
    • Error logs, performance metrics, and server logs generated by our infrastructure (which may include IP address, browser/user agent, and timestamps, depending on our hosting providers’ default logging).

We do not intentionally store the merchant’s personal name, personal email, or address unless they are part of the Shopify shop account information provided to us by Shopify or are voluntarily provided via support communications.

4.2 Data about shoppers (customers of merchants)

The App does not store any directly identifying customer personal data (e.g., customer name, email address, phone number, or shipping address) in our database.

However, to function, the App may access order information via the Shopify read_orders scope. This may technically include customer personal data at the API level, but we do not persist or use those identifiers, and we have no control on what Shopify sends with their order data, and order data is necessary to provide the App’s functionality & enable the app’s billing. We only process order information to:

  • Detect orders that contain line items originating from the App’s upsell widgets;
  • Attribute aggregated revenue to:
    • specific offers;

We therefore store only aggregated analytics, such as:

  • Number of offer views;
  • Number of offer add-to-carts;
  • Number of purchases attributed to the offer widget;
  • Aggregated revenue attributed to an offer.

We do not store individual order events with customer identifiers; we aggregate data so that it cannot reasonably be linked back to an identifiable customer.

We do not store any order identifying data used in customer/merchant communication (e.g. Order ID used in customer/merchant communication emails), but we do store API level order ID (Shopify’s internal Order ID) to ensure revenue attribution accuracy and idempotency (i.e. so we do not process the same order twice and inadvertently over-attribute revenue).

4.3 Data processed in the cart and product pages

To distinguish items added by the app’s offers from items added elsewhere (i.e. other apps’ offers or products added directly by the merchant), we use line item properties, for example:

  • An internal offer identifier
  • An internal product identifier

These properties are also crucial to attribute revenue to the correct offer, as well as enable the optional nested line items functionality on Product Page offers (i.e. when a product from the offer is added as an add-on of another product in the Product Page, being nested under that product - see nested line items in Shopify for more info).

5. How and why we use personal data (purposes & legal bases)

We process personal data for the following purposes and on the following legal bases:

  1. To provide and operate the App
    • Setting up and maintaining the merchant’s app configuration
    • Rendering the upsell widget on the supported surfaces (Cart Page, Cart Drawer, Product Page)
    • Tracking eligibility and status of the App Blocks and App Embeds in the theme
      Legal basis: Performance of a contract (or steps prior to entering into a contract) with the merchant.
  2. To provide analytics and reporting to merchants
    • Aggregating views, add-to-carts, purchases, and attributed revenue for offers configured with this app
      Legal basis: Performance of a contract; and/or our legitimate interests in improving and reporting on our services.
  3. To maintain security, prevent abuse, and fix issues
    • Monitoring logs and system metrics
    • Protecting the App from misuse, fraud, and security incidents
      Legal basis: Legitimate interests (security and fraud prevention) and, where applicable, legal obligations.
  4. To manage billing and subscriptions
    • Processing Shopify app charges (e.g., billing tiers, free trial) via Shopify Billing API with usage based pricing and potentially other billing models
    • Normalizing attributed revenue to USD to support usage-based pricing and revenue attribution reporting. Shopify orders typically include the shop’s currency (the store’s default currency) and the presentment currency (the currency the shopper paid in), but do not provide all exchange rates needed to normalize revenue to a single currency.
    • To perform this normalization, we retrieve USD exchange rates from Open Exchange Rates (https://openexchangerates.org/) and refresh them hourly. We use the latest available exchange rate we have available in our database records at the time of attribution.
    • We do not guarantee that exchange rates will be refreshed without interruption at all times. If rate refresh fails, we reserve the right to use the last available exchange rate we have stored, and we will use reasonable efforts to detect issues and restore hourly refresh so that the latest rates are used.
    • Tracking subscription status and renewal Legal basis: Performance of a contract; legitimate interests in being paid for our services.
  5. To comply with Shopify and legal requirements
    • Responding to mandatory privacy law compliance webhooks:
      • customers/data_request
      • customers/redact
      • shop/redact
    • Complying with applicable data protection laws (e.g., GDPR/UK GDPR).
      Legal basis: Compliance with legal obligations.

We do not:

  • Sell personal data to third parties;
  • Use merchant or customer data for independent marketing to customers;
  • Build separate profiles of customers outside the aggregated analytics described.

6. Shopify API scopes and how we use them

We use the following Shopify scopes only for the purposes described below:

  1. read_orders
    • To access orders created in the merchant’s store;
    • To check if orders contain upsell items originating from the App;
    • To calculate and store aggregated analytics such as attributed revenue per offer, which is necessary for revenue usage based billing.
    • We do not store customer identifiers such as names, emails, addresses, or phone numbers from these orders.
  2. read_products & write_products
    • To allow merchants to configure upsell offers by selecting products and variants in the App Admin UI;
    • To add line item properties to cart items to distinguish upsell-originated items and support the offers’ functionality;
    • We do not modify product details beyond what is necessary for the upsell configuration and identification logic.
  3. read_themes
    • To read theme information so we can provide feedback in the App Admin UI about whether the App Block is installed and active in the theme.

These uses are intended to be consistent with Shopify’s guidance on limited permissions and protected customer data.

7. Cookies and similar technologies

  • On the storefront (cart page), the App is embedded as an App Block and generally relies on Shopify’s existing cookies and session mechanisms. We do not add any additional tracking cookies for third-party marketing.
  • In the App Admin UI, we may use functional cookies or similar technologies where necessary for:
    • Authentication and security;
    • Session management;
    • Remembering simple UI preferences.

Any such use is limited to what is necessary to operate the App. Merchants should also refer to Shopify’s own policies regarding cookies and tracking technologies.

8. Sub-processors and data sharing

We may share data with the following categories of service providers (“sub-processors”) to operate the App:

  • Hosting and infrastructure providers (e.g., Vercel) to host the App and serve the widget;
  • Database and storage providers (e.g., NeonDB (PostgreSQL)) to store configuration and aggregated analytics;
  • Error monitoring, logging, and performance analytics tools, if implemented;
  • Mantle for billing and subscription management (https://www.heymantle.com);
  • Open Exchange Rates (https://openexchangerates.org/) to retrieve currency exchange rates used to normalize revenue attribution and usage-based billing calculations to USD;
  • Professional advisors (e.g. legal, accounting) where necessary.

These service providers may process data only on our behalf, in accordance with our instructions, and under appropriate contractual safeguards, including data protection and confidentiality obligations.

We may also disclose information:

  • Where required by law, regulation, or legal process;
  • In connection with a merger, acquisition, or sale of our business (in which case data protection obligations will be maintained).

We do not sell personal data to third parties.

9. International data transfers

Our infrastructure and sub-processors may be located in the United Kingdom, the European Economic Area (EEA), or other countries, including the United States.

Where we transfer personal data from the UK or EEA to countries that do not provide an equivalent level of data protection, we rely on appropriate safeguards, such as:

  • Standard Contractual Clauses approved by the European Commission or the UK ICO; and/or
  • Other lawful transfer mechanisms, as applicable.

10. Data retention

We retain data only for as long as necessary for the purposes set out in this Privacy Policy, including:

  • While the App is installed and actively used by the merchant; and
  • For a limited period thereafter where required for:
    • billing and accounting;
    • security and fraud prevention;
    • legal obligations or dispute resolution.

When Shopify sends us a shop/redact webhook, we will delete or anonymize personal data related to that store within 30 days, unless we are legally required to retain certain information.

For customer data redaction and data requests:

  • We have implemented the mandatory Shopify privacy law compliance webhooks:
    • customers/data_request,
    • customers/redact,
    • shop/redact.
  • Since we do not store identifiable customer data in our own database, such requests will normally result in a no-op (no further data to delete or export), which we handle and log accordingly.

Aggregated analytics that no longer contain personal data may be retained for longer for statistical and product improvement purposes.

11. Security

We take reasonable technical and organizational measures to protect personal data, including:

  • Use of industry-standard encryption in transit (e.g., HTTPS/TLS) as provided by our hosting providers;
  • Restricting access to production systems and databases to authorized personnel;
  • Using API keys and access tokens securely;
  • Regularly updating dependencies and infrastructure where practicable;
  • Following Shopify’s security and privacy best practices when integrating with Shopify APIs.

However, no method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.

12. Your rights (merchants and staff)

Depending on your location (for example, under the UK GDPR or EU GDPR), you may have the following rights in relation to personal data we hold about you:

  • Right to access your personal data;
  • Right to rectification (correction) of inaccurate or incomplete data;
  • Right to erasure (in certain circumstances);
  • Right to restriction of processing (in certain circumstances);
  • Right to data portability (in certain circumstances);
  • Right to object to certain processing (including where based on legitimate interests);
  • Right to lodge a complaint with a data protection authority.

If you are a merchant or member of a merchant’s staff, you can exercise these rights by contacting us at:

  • Email: support@augmentumstudios.com
  • Postal: Augmentum Studios Ltd, International House, 101 King’s Cross Road, London, United Kingdom WC1X 9LP

We may need to verify your identity before fulfilling your request.

13. Rights of customers of merchants (data we process as a processor)

If you are a customer of a Shopify store that uses our App:

  • The Controller of your personal data is the merchant (store owner), not Augmentum Studios Ltd.
  • You should contact the relevant store directly to exercise your data protection rights.

We will assist the merchant in fulfilling data requests by:

  • Responding to Shopify’s customers/data_request and customers/redact webhooks; and
  • Deleting or exporting any customer data we may hold (noting that we do not store identifiable customer data as part of normal operations).

14. Children

The App is intended for business users only (Shopify merchants and their staff) and is not directed at children. We do not knowingly collect personal data from children.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in:

  • Our App or business practices;
  • Shopify requirements; or
  • Applicable laws and regulations.

We will indicate the “Last updated” date at the top of this document and, where appropriate, provide additional notice (for example, via the App Admin UI or email).

16. Contact us

If you have any questions about this Privacy Policy or our data practices, please contact:

  • Augmentum Studios Ltd
  • Email: support@augmentumstudios.com
  • Postal address: Augmentum Studios Ltd, International House, 101 King’s Cross Road, London, United Kingdom WC1X 9LP