Privacy & Cookie Policy

PointerUp ("PointerUp", "we", "us" or "our") provides the PointerUp Auth & Review app (the "App") to merchants who use Shopify to run their stores. The App lets a merchant's customers sign in to the store, and lets the merchant collect, manage and display product reviews.

This Privacy Policy describes how we collect, use, share, store and delete personal information when a merchant installs the App, and when that merchant's customers use features powered by the App. It applies to the App only. Use of our marketing website is covered by our website Privacy Policy.

For personal information about a merchant's customers, the merchant is the data controller and PointerUp acts as a data processor on the merchant's behalf.

When a merchant installs the App, we access the following information from the merchant's Shopify store, only to the extent of the permissions the merchant approves at installation:

1. Store information: store name, domain, contact email, currency and settings.
2. Products and collections: product titles, descriptions, variants, prices, images, collections and inventory levels.
3. Customers: customer name, email address, phone number, and shipping and billing addresses.
4. Orders and returns: order details, line items, order status, fulfilment and return information. We use these to confirm verified purchases and to request reviews after delivery.

We also keep the API access tokens Shopify issues to the App. They are stored in encrypted form.

1. Account details: name, email address, phone number and password (stored as a secure hash).
2. Business details provided during setup, such as business name, address and tax details.
3. App settings, email templates and review display preferences.
4. Messages and support requests you send to us.

1. Sign-in: email address or mobile number, one-time passcodes (OTPs) sent to verify them, and, where the customer creates one, a password (stored as a secure hash).
2. Reviews: star rating, review text, photos the customer chooses to upload, product questions and answers, and the order and product the review relates to.
3. Email preferences: whether the customer has unsubscribed from review request emails.
4. Technical data: IP address, device and browser information, which we use for security, fraud prevention and rate limiting.

We use the information only to provide and support the App, including to:

1. sign customers in to the merchant's store and verify their email address or phone number;
2. send review request emails after an order, on the merchant's behalf;
3. collect, moderate and display reviews, and mark reviews from verified buyers;
4. keep the App's copy of products, orders and customers in sync with the Shopify store;
5. provide customer support, keep the App secure, and prevent fraud and abuse;
6. meet our legal obligations.

We do not sell personal information, and we do not use merchant or customer data for advertising, for profiling, or for any purpose other than providing the App's services.

We share information only with the service providers we need to run the App. Each provider processes the data on our instructions:

1. Shopify: the platform the App connects to.
2. Railway: application hosting and database (Singapore).
3. Amazon Web Services: file and image storage (Mumbai, India).
4. ZeptoMail (Zoho): delivery of review request and sign-in emails.
5. SMS Gateway Hub: delivery of one-time passcodes by SMS.
6. Google Firebase: delivery of notifications.
7. OpenAI: used only if a merchant chooses to use the optional AI assistant in the dashboard, to answer the merchant's own questions about their store.

We may also disclose information when required by law, to protect our rights or users' safety, or as part of a merger or acquisition. If that happens, this policy will continue to apply to the data.

PointerUp is established in India. We are not established in Europe. Data is stored and processed in Singapore and India, so information about merchants and customers in the European Economic Area, the United Kingdom or other regions is transferred outside those regions.

Where the law requires it, we rely on appropriate safeguards for these transfers, such as the European Commission's Standard Contractual Clauses.

1. We keep data only while a merchant has the App installed, or as long as needed to provide the App.
2. When a merchant uninstalls the App, we immediately stop accessing their Shopify store and remove the App's webhooks.
3. 48 hours after an uninstall, Shopify sends us a shop data deletion request. We then remove the store's data from the App and permanently erase it within 30 days.
4. When Shopify sends us a customer data deletion request, we delete or anonymise that customer's personal information, including their addresses and reviews linked to their identity.
5. We may keep limited records for longer where the law requires it, for example invoices and tax records.

Depending on where you live, you may have the right to access, correct, delete or export your personal information, to restrict or object to how it is processed, and to withdraw consent.

1. Merchants can exercise these rights by emailing contact@pointerup.com.
2. Customers of a store should contact the store's merchant first. Requests the merchant makes through Shopify reach us automatically through Shopify's privacy compliance webhooks (customer data request, customer redact and shop redact), and we act on them.
3. Customers can also email contact@pointerup.com directly. We will respond within 30 days, and we may need to verify your identity first.
4. Customers can stop review request emails at any time using the unsubscribe link in each email.

You may also complain to your local data protection authority.

We protect data with industry-standard measures. All data in transit is encrypted with HTTPS/TLS, Shopify access tokens are encrypted at rest, passwords are hashed, every Shopify webhook is verified by its HMAC signature, and access to production systems is limited to authorised staff. No system is completely secure, but we work to protect your information and will notify affected merchants of any data breach as the law requires.

The App uses only the cookies and browser storage needed to keep merchants and customers signed in and to keep the App secure. The App does not use advertising cookies. Cookies used on our marketing website are described in our website Privacy Policy.

The App is not directed at children under 16, and we do not knowingly collect their personal information. If you believe a child has provided us with personal information, please contact us and we will delete it.

We may update this policy from time to time. When we make material changes, we will update the date at the top of this page and notify merchants by email or in the App.

If you have questions about this policy or how we handle data, email contact@pointerup.com or write to us at:

PointerUp
No. 40, Kundrathur Main Road, Moulivakkam,
Chennai, Tamil Nadu 600125, India