Privacy Policy

1. Who we are

Habit (“Habit”, “we”, “us”) provides a loyalty and rewards application for Shopify stores. This Privacy Policy explains what information we collect when a merchant installs and uses Habit, how we use it, and the choices available to merchants and their customers. It applies to the Habit app, our website at gethabitloyalty.com, and our documentation site.

For merchant account data we act as a data controller. For customer data processed on behalf of a store, the merchant is the controller and Habit acts as a processor, handling data only on the merchant’s documented instructions.

2. Information we collect

• Merchant account information: store name, myshopify domain, contact email, Shopify shop and user identifiers, plan and billing status.
• Store and customer data: via the Shopify API scopes you approve at install, we access customer names, email addresses, customer identifiers, order totals, order and refund events, and discount codes. This is used to calculate points, tiers, referrals, and refund clawbacks.
• Storefront data: when a customer interacts with the Habit widget, we process their Shopify customer ID, points balance, and referral code.
• Usage and technical data: app interactions, IP address, browser and device type, timestamps, and error logs used for security, abuse and fraud prevention, and service reliability.

We do not collect payment card numbers. Billing is handled by Shopify through the Shopify Billing API.

3. How we use information

We use information to:

• operate the loyalty program, points ledger, VIP tiers, and referrals;
• reverse points automatically when an order is refunded or cancelled;
• detect and prevent referral fraud and abuse of reward codes;
• send program-related emails to customers on the merchant’s behalf;
• provide support, maintain security, and improve the service;
• meet legal, tax, and accounting obligations.

We never sell or share personal information for cross-context behavioural advertising, and we do not use merchant customer data to train third-party AI models.

4. Legal bases (EEA/UK)

Where the GDPR or UK GDPR applies, we rely on: performance of a contract (providing the app to merchants), legitimate interests (security, fraud prevention, service improvement), compliance with legal obligations, and consent where required, for example for optional marketing communications. Consent can be withdrawn at any time.

5. Sharing and sub-processors

We share data only with providers that help us run Habit, each bound by written data protection terms:

• Shopify Inc. — platform, authentication, and billing
• Cloud hosting and managed database providers — application hosting and data storage
• Klaviyo — the merchant's email service provider (ESP) for program and support emails
• Error monitoring and analytics providers — reliability and diagnostics

A current list of sub-processors is available on request at support@gethabitloyalty.com. We may also disclose information where required by law, to enforce our terms, or in connection with a merger or acquisition, in which case we will notify affected merchants.

6. International transfers

Habit is operated from and hosted in data centres that may be located outside your country, including the United States. Where personal data is transferred out of the EEA, UK, or Switzerland, we rely on the European Commission’s Standard Contractual Clauses (and the UK Addendum where applicable) together with appropriate technical and organisational safeguards.

7. Retention and deletion

We retain merchant and customer data for as long as the Habit app is installed. When the app is uninstalled, we retain data for up to 48 hours to allow reinstallation without loss, after which store and customer data is deleted or anonymised within 30 days, except where retention is required for legal, tax, or dispute resolution purposes. We honour Shopify’s mandatory compliance webhooks — customers/data_request, customers/redact, and shop/redact — and respond to them within the timeframes Shopify requires.

8. Cookies and similar technologies

The Habit admin app and storefront widget use strictly necessary cookies and local storage to authenticate sessions, remember a customer’s loyalty state, and attribute referral links. We do not use advertising or cross-site tracking cookies. Blocking essential cookies may prevent the widget from working.

9. Security

We use administrative, technical, and physical safeguards including encryption in transit (TLS) and at rest, least privilege access controls, scoped Shopify API tokens, audit logging, and regular dependency patching. No method of transmission or storage is completely secure. If a personal data breach affects merchant or customer data, we will notify affected merchants without undue delay and, where required, within 72 hours of becoming aware.

10. Your rights

Depending on where you live, you may have the right to access, correct, delete, or port your personal information, to object to or restrict processing, to opt out of the sale or sharing of personal information (we do neither), and to lodge a complaint with your supervisory authority. We do not discriminate against anyone for exercising these rights.

Shoppers should contact the store they purchased from first, since that merchant controls the data. Merchants and shoppers can also email support@gethabitloyalty.com and we will respond within 30 days.

11. Children

Habit is a business tool and is not directed to children. We do not knowingly collect personal information from anyone under 16. If we learn we have done so, we will delete it.

12. Merchant responsibilities

Merchants are responsible for having a lawful basis to share customer data with Habit, for disclosing the use of a loyalty program in their own privacy policy, and for obtaining any consents required in their jurisdiction.

13. Changes to this policy

We may update this Privacy Policy from time to time. The “last updated” date above reflects the latest revision, and we will notify merchants of material changes by email or in the app before they take effect.

14. Contact

Questions, requests, or complaints about privacy can be sent to support@gethabitloyalty.com.