Privacy Policy

When you install the App, we receive the following from Shopify and store it:

• your store’s myshopify domain and Shopify shop ID;
• an access token Shopify issues to the App. The App asks for no customer, order or product permissions;
• your plan (Free or Pro), read from Shopify’s billing;
• your banner design and text, any links you enter, and your settings;
• setup progress, for example the date you confirmed you removed Shopify’s own banner.

We don’t receive or store the names or e-mail addresses of you or your staff through the App.

Match my store (optional). If you click Match my store, or ask Design with AI to use your theme’s style, Shopify asks you to give the App read-only access to your themes. The App then reads your published theme’s settings to get its colours, fonts, corner radius and name. It reuses that result for up to one hour, and our daily clean-up then deletes it, so it is kept for about a day at most. If you revoke the permission, it is deleted immediately. The App never changes your theme.

In your browser. The App’s admin screens remember in your browser which sections you collapsed. That information never leaves your browser and isn’t used for tracking.

• The banner sends visitors’ consent choices directly to Shopify’s Customer Privacy API. Shopify stores them; we don’t.
• Decision counts. These are on by default, and you can switch them off in Settings. When they’re on, the banner sends us an anonymous message after a visitor makes a choice. The message contains the kind of choice, where it was made (banner or preferences), your store domain and a public store key. We add it to daily totals. We don’t store or log IP addresses, browser details, cookies or any other identifier of the visitor.
• The App sets no cookies on your storefront.
• Google Consent Mode bridge (Pro, optional). This runs entirely in the visitor’s browser and passes Shopify’s consent state to the Google tags on your page. It sends nothing to us.

When you use Design with AI, we send the following to our AI provider, Anthropic:

• your request and your recent messages in that conversation;
• your current banner design and banner text;
• the language you’re editing;
• if you choose, the theme style described in section 1 (colours, fonts, corner radius and the theme’s name).

We never send visitor or customer data, staff identities, or your store domain as such. Anything you type, and anything in your banner text or theme name, is sent as written, so it may include your store’s name.

We don’t store your conversations. We store a monthly count of requests and their size (tokens) so we can apply fair-use limits and manage costs.

Anthropic processes this information for us under its commercial terms. Those terms say Anthropic doesn’t train its models on content sent through its API. Anthropic’s published policy is to delete API inputs and outputs within 30 days. It may keep them longer to enforce its usage policy (up to 2 years for content flagged as a violation) or where the law requires. See Anthropic’s commercial terms and its retention policy.

• Support. If you e-mail us, we receive your e-mail address, your name if you include it, your store’s address if you give it, and whatever you write. We use this only to answer you and to fix problems, and we keep it for as long as we need it for that, up to 2 years.
• The Website. The Website sets no cookies and uses no analytics or advertising tools. Our web host processes standard server logs (such as IP address, browser type and the page requested) to deliver and protect the site, and keeps them for a short period.

We use the information above only to provide, secure, support and bill for the App and to run the Website. Under UK and EU data protection law, our legal bases are:

• contract, to provide the App you installed and the plan you chose;
• legitimate interests, to keep the App secure, prevent abuse, apply fair-use limits, answer support requests and run the Website;
• legal obligation, where the law requires us to keep or disclose information.

We don’t sell personal information, share it for cross-context behavioural advertising, or use it to build advertising profiles. We don’t use it for automated decisions that have legal or similarly significant effects on anyone.

• Shopify is the platform the App runs on. It stores your visitors’ consent choices and handles billing for the App.
• Fly.io hosts the App in its Ashburn, Virginia region in the United States.
• Neon hosts our database on Amazon Web Services in the US East (N. Virginia) region in the United States.
• Anthropic provides the AI suggestions for Design with AI (Pro). It receives data only when you use that feature (see section 3).
• Google Workspace handles support e-mail.
• Vercel hosts the Website.

The App is hosted in the United States, so the information described in this policy is stored and processed there. When we transfer personal information from the UK or the European Economic Area to the United States, we rely on the safeguards in each provider’s data processing terms, such as the EU Standard Contractual Clauses with the UK Addendum, or the provider’s certification under the EU-US Data Privacy Framework and its UK Extension. Contact us for a copy of the relevant safeguards.

• Uninstall. When you uninstall, we delete access tokens immediately. We delete all other data about your store when Shopify sends its shop deletion request (about 48 hours after uninstall), or after 30 days at the latest.
• Daily totals are deleted after 90 days.
• AI usage counts are deleted with your store’s data.
• Cached theme styles are deleted as described in section 1.
• Backups and logs. Our database host keeps point-in-time backups for a restore window of up to 7 days, so deleted data can be recovered during that window. Our hosting provider keeps server logs for up to 30 days. These logs contain store domains and request outcomes, never visitor data, prompts or designs.

The App holds no data about your customers. When Shopify sends us a customer data request or an erasure request, we acknowledge it; there is nothing to export or erase.

Depending on where you live, you may have the right to:

• access the personal information we hold about you;
• correct it;
• delete it;
• restrict or object to how we use it;
• receive it in a portable format.

To make a request, e-mail support@crunchbanners.com. We’ll reply within one month. Most merchant data can also be removed by uninstalling the App.

If you’re in the UK, you can complain to the Information Commissioner’s Office (ico.org.uk). If you’re in the EEA, you can complain to your local data protection authority. We’d appreciate the chance to resolve your concern first.

Data is encrypted in transit (HTTPS). Our database provider also encrypts it at rest (AES-256). Access tokens are stored only on our servers. Access to production systems is limited to the people who run the App.

The App and the Website are for businesses. They aren’t directed at children, and we don’t knowingly collect information from children.

We’ll update this page when the way the App or the Website handles data changes, and change the effective date at the top. If a change is significant, we’ll also tell merchants in the App or by e-mail.

If you have questions about this policy or your data, e-mail support@crunchbanners.com or write to JHW Contracting Limited, 20 Wenlock Road, London, N1 7GU, United Kingdom.