Privacy Policy
Last Updated: October 1, 2026
This Privacy Policy describes how Yeshan Loyalty & Rewards ("we", "us", or "our app") collects, uses, processes, and protects personal data when merchants install or use our application in connection with their Shopify-supported storefront.
Key Commitment: We process the minimum personal data strictly necessary to calculate customer loyalty points, manage VIP tiers, and apply instant cart discounts. We do not sell, rent, or monetize personal data under any circumstances.
1. Information We Collect
When you install and use Yeshan Loyalty & Rewards, our application automatically accesses specific types of information via Shopify's standard APIs:
- Merchant Information: Store name, myshopify domain, primary custom domain, base store currency, and access tokens generated via Shopify OAuth.
- Customer Information: Shopify Customer ID, customer first and last name, email address, and order purchase history (order IDs, order dates, subtotal price, and discount allocations).
- Technical & Session Data: Timestamps of point actions, HMAC signature verification hashes for secure checkout holds, and server logs strictly for service uptime and fraud prevention.
2. How We Use Collected Information
All collected data is processed strictly for the following operational purposes:
- Calculating and maintaining real-time loyalty point balances and audit ledgers.
- Determining customer VIP tier progression and applying tier points multipliers.
- Applying customer-selected instant cash discounts to checkout carts without coupon codes.
- Displaying account history and available rewards on the customer's account portal.
- Fulfilling merchant-configured loyalty rules (e.g. signup bonuses, birthday points).
3. Data Sharing and Third-Party Disclosures
We do not share, sell, disclose, or transfer personal data to any third-party advertisers, data brokers, or marketing networks. Information is shared strictly with:
- Shopify APIs: For secure OAuth authentication, discount generation, and order webhook synchronization.
- Hosting Infrastructure: Secure cloud infrastructure (Render) adhering to industry standards for high availability and physical server security.
4. Data Storage, Security & Encryption
We implement robust technical and organizational security controls:
- In-Transit Encryption: All data transmitted between Shopify, merchant storefronts, customer browsers, and our servers is strictly encrypted using TLS 1.3 / HTTPS.
- At-Rest Protection: Databases and data stores are hosted on encrypted cloud volumes with strict firewall controls and private networking.
- Tamper-Proof Holds: Point redemption requests use cryptographically signed HMAC tokens to eliminate checkout manipulation.
5. Data Retention & Mandatory GDPR Erasure
We adhere to the data minimization and storage limitation principles:
- Personal data is retained only for as long as the merchant maintains the application installed on their Shopify store or as needed to maintain valid loyalty balances.
- Shop Redaction: When a merchant uninstalls the app, all corresponding store records, settings, and customer ledgers are purged in compliance with Shopify's 48-hour mandatory webhook.
- Customer Erasure: When a customer requests data deletion under GDPR, CCPA, or applicable privacy laws, we process the request within 30 days via Shopify's mandatory GDPR compliance webhooks.
6. Shopify Mandatory Compliance Webhooks
Our app fully implements and actively listens to Shopify's three mandatory privacy webhooks:
customers/data_request: Provides merchants and customers with an export of all recorded points activities.customers/redact: Automatically deletes customer profile and point records from our database upon request.shop/redact: Automatically purges all store settings and associated data 48 hours after app uninstallation.
7. Customer Rights & Opt-Out
Customers have the right to request access to their loyalty data, demand correction of inaccurate records, or request complete deletion of their loyalty profile. Customers may exercise these rights directly by contacting the merchant store or emailing our support team.
8. Contact Information & Data Protection Inquiries
If you have any questions about this Privacy Policy, our data practices, or wish to submit a data protection inquiry, please contact our Data Protection Team at: