Privacy Policy: SalePeek

Last updated: 27 September 2026

This Privacy Policy describes how Whizsetup ("we," "us," "our") collects, uses, shares, and protects information when a Shopify merchant ("Merchant," "you") installs and uses the SalePeek: Price After Discount app (the "App") on their Shopify store.

This Policy also applies to the shoppers who visit those Shopify stores and interact with our widget.

By installing the App, you consent to the practices described in this Policy.

1. Who we are

Whizsetup is the developer and operator of the SalePeek: Price After Discount Shopify app.

• Developer: Whizsetup

• Website: https://whizsetup.com

• Support email: support@whizsetup.com

For questions about this Policy or your data, contact us at support@whizsetup.com.

2. Information we collect

We collect only the information required to make the App work. We do not sell, rent, or trade your data.

2.1. Information about the Merchant (you, the store owner)

When you install the App, we receive the following from Shopify:

• Your shop domain (e.g., yourstore.myshopify.com)

• Your shop name, primary email, country, and currency

• Your Shopify plan tier (for billing eligibility)

• The OAuth access token that lets our App call Shopify APIs on your behalf

2.2. Information you enter into the App

While using the App, you provide:

• Discount configurations — payment method discounts, minimum order amounts, applicable products/collections, expiry dates, discount codes, and other settings you create

• Widget customization settings — colors, styles, headings, display preferences, checkout provider selection

• Onboarding preferences — the checkout provider you use, payment gateways enabled on your store

• Notification preferences — email settings for discount-expiry alerts

2.3. Information we read from your Shopify store

To calculate discounts and display them correctly, the App reads (but does not store beyond active processing):

• Products, variants, and their prices (via read_products scope)

• Collections your products belong to (via read_products scope)

• Shopify-native discount rules and codes (via read_discounts and read_price_rules scopes)

• Order data (via read_orders scope) — used only to attribute orders to widget clicks for your analytics dashboard

• Theme information (via read_themes scope) — used only to open the theme editor from within our App

2.4. Information about your shoppers (indirect, aggregated)

When a shopper visits a product page where your widget is installed, our App generates anonymous event data:

• Widget impression events — recorded when the widget becomes visible on a shopper's screen

• Discount click / copy events — recorded when a shopper interacts with a displayed offer

• Session identifier — a random anonymous string stored in the shopper's browser to prevent double-counting the same visit

We do NOT collect from shoppers:

• Names, email addresses, phone numbers, or postal addresses

• Payment card details or any financial data

• Login credentials

• IP addresses (in a form that could identify individuals)

• Cross-site browsing behavior

• Precise geographic location

The App is designed to require zero shopper personal data.

2.5. Cookies and local storage

The App uses:

• One anonymous session identifier stored in the shopper's browser (localStorage), used only to distinguish repeat visits from unique visits in your analytics. This identifier is not linked to any personal information and does not follow the shopper across other websites.

• One admin session cookie (managed by Shopify) that authenticates you inside the Shopify Admin.

We do not use third-party advertising cookies, retargeting pixels, or cross-site tracking tools.

3. How we use the information

We use collected information solely to:

• Operate the App — calculate the correct discount stack for each product, render the widget, and process merchant configuration

• Provide analytics — show you how many impressions, clicks, and attributed orders your widget generated

• Handle billing — via Shopify's Billing API, based on your chosen plan

• Send transactional notifications — such as discount-expiry alerts you opted into

• Provide support — respond to your questions sent to our support inbox

• Improve the App — identify bugs and performance issues using aggregated, anonymized data

• Comply with legal obligations — respond to lawful requests from authorities

We do not use your data for advertising, marketing to your customers, or resale.

4. How we share information

We do not sell your data. We share it only with:

4.1. Shopify

Shopify is the platform on which your store runs and on which our App is hosted. Shopify may see the same data we do because their platform routes our API calls. Shopify's own privacy policy governs their handling: https://www.shopify.com/legal/privacy

4.2. Our hosting and infrastructure providers

• Application hosting: Fly.io Inc. (a US-registered infrastructure provider), Singapore region — hosts our application containers and persistent storage volume. Fly.io's Data Processing Addendum is available at https://fly.io/legal/data-processing-addendum/.

• Database: SQLite on a Fly.io persistent volume — stores merchant configurations, discount definitions, widget settings, and aggregated analytics events. The database is accessible only to the running application and to authorised Whizsetup engineering personnel.

These providers process data only under our instructions and are contractually required to maintain confidentiality and security.

4.3. Legal disclosures

We will disclose information if required by valid legal process (subpoena, court order) or when necessary to protect our rights, users' safety, or investigate suspected fraud.

4.4. Business transfers

If Whizsetup is acquired or merged, information may be transferred as part of that transaction, subject to the same privacy commitments in this Policy.

5. Data retention

We keep data only as long as it serves the purposes described above.

• Merchant configuration — retained while your App is installed and for up to 30 days after uninstall (to allow reinstallation without losing settings)

• Analytics events (widget impressions, click events, order conversions) — retained for the lifetime of the App installation, so you can view historical performance, year-over-year comparisons, and export CSVs across multi-year date ranges. All analytics data is deleted when you uninstall the App, per the process described below.

• Support communications — retained for up to 3 years for reference and legal record-keeping

• Anonymous shopper session identifiers — deleted from the shopper's browser when browser storage is cleared; no server-side identifier persists after the associated analytics event is aggregated

When you uninstall the App, Shopify sends us a shop/redact webhook 48 hours after the uninstall. Upon receiving this webhook, we permanently delete all data associated with your shop within 30 days, in accordance with Shopify's data protection requirements. Merchants and shoppers may also exercise their rights under GDPR Articles 15 and 17 via Shopify's customers/data_request and customers/redact webhooks, which we honour within 30 days of receipt.

6. Your rights

Depending on where you or your shoppers are located, applicable privacy laws (GDPR in the EU/UK, CCPA in California, DPDP Act 2023 in India, and similar frameworks) give the following rights:

• Access — request a copy of personal information we hold about you

• Correction — request correction of inaccurate information

• Deletion — request that we delete your personal information

• Portability — receive your data in a structured, machine-readable format

• Objection — object to certain processing of your personal information

• Withdraw consent — where processing is based on consent, withdraw it at any time

• Complaint — file a complaint with a supervisory authority in your jurisdiction

To exercise any of these rights, email support@whizsetup.com. We respond within 30 days.

Because our App does not collect personal data from shoppers, shopper-directed requests should be handled through the Merchant's own store privacy processes. However, if a shopper contacts us directly, we will assist them and coordinate with the Merchant.

7. Data security

We use industry-standard measures to protect data:

• Encryption in transit — all data flows over HTTPS/TLS

• Encryption at rest — database and backups encrypted at our hosting provider

• Storage isolation — our database volume is provisioned as a dedicated persistent volume on Fly.io, not shared with other tenants, and encrypted at the disk level by our hosting provider.

• Access controls — only authorized Whizsetup personnel can access production systems, on a need-to-know basis

• Authentication — merchant sessions use Shopify's session-token OAuth flow

• Regular security reviews — of our code, dependencies, and infrastructure

Despite our efforts, no online service is 100% secure. If we become aware of a data breach affecting your data, we will notify you and applicable authorities as required by law.

8. International data transfers

Whizsetup is based in India, with a registered office at T-8, Noida, Uttar Pradesh, India (201301). Merchant and shop data is stored on Fly.io infrastructure in Singapore. If you or your shoppers are located outside India or Singapore, your data will be transferred to and processed in these jurisdictions.

For merchants and shoppers in the EU/EEA, transfers are governed by Standard Contractual Clauses under Fly.io's Data Processing Addendum, ensuring an adequate level of protection under the GDPR. For merchants and shoppers in other jurisdictions, we apply equivalent contractual safeguards where required by applicable law.

9. Children's data

The App is not directed at children under 13 (or under 16 in the EU). We do not knowingly collect personal information from children. If you believe a child has provided personal information to us through the App, contact us at support@whizsetup.com and we will delete it.

10. Third-party services

Our App integrates with third-party services chosen by you, the Merchant. These include:

• Shopify — the platform we run on

• Razorpay Magic Checkout, Cashfree One-Click, GoKwik, Shopflo, Fastrr, Simpl, and other third-party checkouts — if you select one of these as your checkout provider in the App, our App will display discount data compatible with that checkout's rules, but we do not directly share your data with those providers. The provider only receives data through their own installed integrations on your store.

We are not responsible for the privacy practices of third-party services you enable on your store. Please review their respective privacy policies.

11. Changes to this Policy

We may update this Policy from time to time to reflect changes in our practices, technology, legal requirements, or the App's features. When we do:

• We will update the "Last updated" date at the top of this Policy

• For material changes, we will notify Merchants via in-app notice or email

• Continued use of the App after changes constitutes acceptance of the updated Policy

12. Contact us

For any privacy-related questions, requests, or complaints:

• Email: support@whizsetup.com

• Website: https://whizsetup.com

• Postal address: T-8, Noida, Uttar Pradesh, India (201301)

Effective date: 27 September 2026

© Whizsetup. All rights reserved.