Withly Cart Rules Privacy Policy

1. Introduction

Withly Cart Rules lets a merchant set a minimum order quantity, a case-pack multiple, and optional percentage discounts for a product or a variant. Checkout enforcement runs inside Shopify. This policy explains the data the app stores and how deletion requests are handled.

The provider is Nguyễn Hoàng Nhân, Vietnam. Contact support@withly.org. This page states the same data practices as the privacy policy served by the app.

2. Information We Process

The app stores the merchant configuration and the Shopify session used to publish that configuration. It does not store buyer names, email addresses, phone numbers, shipping or billing addresses, payment details, or order contents.

• Shop domain, used to keep each merchant separate.
• Session credentials Shopify issues to the app, including the access token and any refresh token, plus optional staff fields Shopify includes in the session (staff id, name, email, locale, and account flags).
• Rules: title, status, product or variant id, parent product id for a variant rule, minimum quantity, case-pack multiple, and discount tiers.
• The Shopify Function owner ids for checkout validation and the automatic discount.
• Onboarding state, such as whether the setup guide was dismissed and which rule was marked as tested.

3. How We Use Information

We use this information to publish quantity rules and optional tier discounts to Shopify checkout, to operate and secure the app, to respond to support requests, and to meet Shopify privacy obligations. We do not sell personal information or use it for advertising.

4. Checkout

Quantity is checked on each cart line by a Shopify Function. The app does not add quantities across lines and does not segment buyers. The app server is not called during checkout.

5. Service Providers

These providers process data only to run and support the app.

• Shopify provides OAuth, the Admin API, and checkout function execution.
• Cloudflare provides DNS and TLS.
• Dokku is the self-hosted server that runs the app. The app database is PostgreSQL on that server.
• Crisp provides the support chat in the embedded admin. The chat session is sent the shop domain and the app name, plus whatever the merchant types.
• Telegram delivers internal install and uninstall notifications to the operator. Each notification contains only the shop domain, the shop name, and the Shopify plan. No buyer data is ever sent to Telegram.

6. Retention and Deletion

Configuration and sessions are kept while the app is installed. The app/uninstalled webhook deletes that shop's sessions, rules, function bindings, and onboarding state. A delayed uninstall webhook does not delete a newer install.

About 48 hours after uninstall, Shopify sends shop/redact, which deletes any remaining shop data unless the merchant has reinstalled. customers/data_request and customers/redact are acknowledged. There is no buyer profile to return or delete for those topics.

Database backups, if the operator enables them, follow the retention period configured on the production database.

7. Your Choices

Merchants may request access, correction, or deletion by contacting support@withly.org. Shopify buyers should contact the merchant first.

8. Security and Changes

Queries for merchant data include the shop domain from the authenticated session. Logs redact access tokens and secrets before they are written. We use access controls and encryption in transit. No internet service can guarantee absolute security.

The date above identifies the current version of this policy.