Privacy Policy

Gemora: Loyalty & Rewards for Shopify · Last updated 2026-09-14

Gemora ("the App") is a loyalty and rewards program for Shopify stores, developed and operated by Secretix ("we", "us"). This policy explains what information the App receives when a merchant installs it, how that information is used, and the choices merchants and their customers have. By installing the App you agree to this policy.

For personal data about a store's customers, the merchant is the controller and we act as a processor on the merchant's behalf: we process that data only to run the merchant's loyalty program and according to the merchant's instructions.

1. Information we collect from merchants

When you install the App we receive, through Shopify's APIs and with your authorisation, the information needed to run the service:

• Store information: your myshopify.com domain, store name, store owner name and email, country, currency, timezone, locale and Shopify plan.
• API access credentials: the tokens Shopify issues so the App can act on your store within the permissions you granted. They are never returned by our APIs and are discarded when you uninstall.
• Program configuration you create: ways to earn points, rewards, VIP tiers, widget appearance and texts, and onboarding progress.
• Product and collection data: read only when you limit a reward to specific products or collections; the App stores the identifiers you selected, not your catalogue.
• Theme access: the App reads your theme settings only to check whether the Gemora app embed is enabled. It does not modify theme files.

2. Information about your customers

To award and redeem points, the App processes data about the customers of your store. It receives this from Shopify (via the Admin API and order, customer and refund webhooks) and from the loyalty widget on your storefront.

• Customer profile: Shopify customer ID, first and last name, email address, phone number, country, locale and account state.
• Birthday: only if the customer enters it in the loyalty widget, to award birthday points.
• Orders and refunds: order ID and number, subtotal, tax and total, currency, payment and fulfilment status, discount codes used, whether the order was placed at a point of sale, and refund details, used to calculate and reverse points.
• Loyalty data: points balance, VIP tier, the history of points earned, redeemed, expired or adjusted, the rewards and discount codes issued to the customer, and the referring customer where applicable.
• Social actions: when a customer claims points for following or sharing on Facebook, Instagram, X or YouTube, the App records that the action was claimed. It does not connect to or read the customer's social media accounts.

The storefront widget identifies a logged-in customer through Shopify's signed app proxy requests. The App does not collect payment card details, passwords or browsing history, does not set advertising or tracking cookies, and does not use customer data for profiling or advertising.

3. How we use information

• to run your loyalty program: award, redeem, expire and reverse points, assign VIP tiers, and create the discount codes customers redeem;
• to show your loyalty widget on your storefront and let you manage members and program settings in the App;
• to provide support, respond to your requests and notify you of important service changes;
• to operate, secure and improve the App (error monitoring, abuse prevention).

We do not sell, rent or share merchant or customer data with advertisers, and we do not use it for purposes unrelated to the App.

4. Sharing and sub-processors

We share data only with service providers that host or support the App, under contractual confidentiality: cloud hosting and database providers, error monitoring (Sentry), and transactional email (Google) for messages to store owners. Discount codes and widget settings are written to your own Shopify store. Shopify itself processes data under its own Privacy Policy. We may disclose information if required by law.

5. Data retention and deletion

• Store data, program configuration and customer loyalty data are kept while the App is installed.
• When you uninstall, your API access credentials are discarded immediately and your program configuration is removed.
• Shopify sends a store data erasure request 48 hours after uninstall; we then delete the remaining store and customer data within 30 days. Only billing records (your app subscription history) are kept, for as long as accounting law requires.
• You may request earlier deletion at any time via the contact below.

6. Your rights and Shopify's privacy webhooks

The App subscribes to Shopify's mandatory privacy webhooks. Requests received through them are honoured within 30 days:

• Customer data request (customers/data_request): we email the store owner the data we hold about that customer.
• Customer erasure (customers/redact): we delete that customer's profile, points history, rewards, orders and refunds.
• Store erasure (shop/redact): we delete the store's data as described in section 5.

Customers who want to access, correct or delete their data should contact the store they shop with; merchants can contact us directly. If you are in the EEA, UK or another jurisdiction with data-protection rights, you may also lodge a complaint with your local supervisory authority.

7. Security

Data is transmitted over TLS and stored in access-controlled infrastructure. Storefront requests are verified with Shopify's signatures and webhooks with Shopify's HMAC. Access is limited to personnel who need it to operate the App.

8. International transfers

Secretix is based in Ho Chi Minh City, Vietnam; hosting providers may process data in other regions. Where required, transfers rely on appropriate safeguards such as standard contractual clauses.

9. Children

The App is a business tool for merchants and is not directed at children under 16. We do not knowingly collect their data; merchants are responsible for their store's own age requirements.

10. Changes to this policy

We may update this policy as the App evolves. Material changes are announced in the App or by email to the store owner. The "last updated" date above always reflects the current version.

11. Contact

Secretix · Ho Chi Minh City, Vietnam
Email: [email protected]