happywards — Privacy Policy
1. Who this covers, and who is responsible for what
happywards is a loyalty-points and product-reviews app that a merchant installs on their Shopify store. There are two relationships here and they carry different obligations.
- If you are a shopper, the merchant whose store you bought from is the data controller. happywards is their processor: we hold your data on their instructions and for no purpose of our own. Exercise your rights against the merchant. If you contact us we will help, but we will route the request to them, because they are the ones who owe you the answer.
- If you are a merchant, you are the controller and we are your processor. Our data-processing addendum governs that relationship.
- For our own business records — your merchant account, billing, support correspondence — we are the controller.
happywards is operated by a single founder-operator. Contact details are in §10.
2. What we collect, and where it comes from
This is the complete list. If a field is not named here, we do not hold it.
About shoppers, received from Shopify
- Email address — the loyalty member’s primary key. Without it there is no programme.
- First name and last name, where the shopper gave them to the store. Both optional.
- The Shopify customer id — a stable identity that survives an email change.
- Order facts needed to calculate points: order id, subtotal, currency, financial status and refund amounts. Not order line items, not what was bought.
About shoppers, generated by happywards
- Points balance, lifetime points, tier, and every entry in the points ledger — a signed number, a reason, a timestamp, and who recorded it.
- Reward redemptions: points spent, the discount code issued, and its state.
- If the merchant enables email: the emails we generated for that shopper (recipient address, subject, rendered message) and any unsubscribe record.
About shoppers, given to us directly by them
- Product reviews: rating, title, body, the author name and email typed into the review form, and any photo or video URLs attached.
What we deliberately do not collect
- No phone numbers. No postal addresses. No dates of birth. None of these fields exist in our database.
- No payment data, ever. Shopify handles payment. We never see a card number.
- No stored IP addresses. Rate limiting counts requests in memory and never writes an address to the database.
- No browsing or behavioural tracking. happywards sets no cookies, writes nothing to
localStorage, and loads no third-party analytics or advertising pixel on any storefront or admin page. There is no consent banner because there is nothing to consent to. - No profiling with legal or similarly significant effects. Tier assignment is automated, but it changes only which discount a shopper is eligible for in one store.
3. Why we process it, and the legal basis
We process shopper data only on the merchant’s instructions. The merchant is responsible for having a lawful basis; these are the bases that ordinarily apply.
- Running the loyalty programme — awarding, holding, clawing back and redeeming points. Ordinarily contract (Art. 6(1)(b)) or legitimate interests (Art. 6(1)(f)).
- Publishing and moderating reviews — the shopper submits knowingly and it is published under their name. Ordinarily legitimate interests, and in some markets consent at the point of submission.
- Transactional email (points earned, points expiring, tier reached) — legitimate interests or contract. The transactional/marketing line moves between jurisdictions and the merchant decides for their market.
- Marketing email (review requests, birthday messages) — consent only. Our consent check is fail-closed: a message classified as marketing is not sent unless an explicit consent flag is present. An unknown consent state blocks the send.
- Billing and account administration (merchant data) — contract and legal obligation.
We do not sell personal information and we do not share it for cross-context behavioural advertising, as those terms are used in the CCPA/CPRA and comparable US state laws. There is nothing to opt out of because there is no such sharing.
4. Who we share it with
- DigitalOcean, LLC — hosting. A single server in the sfo2 region (San Francisco, United States), with the database on the same machine. All shopper data lives there.
- Shopify Inc. — the platform the data comes from. We write a shopper’s redeemable balance and eligibility back to Shopify as customer metafields so the discount can be applied at checkout.
- Klaviyo, Inc. — optional, off by default, and not enabled today. Were a merchant to turn it on, we would send email address, optional name, points balance, lifetime points and tier, and this policy would be updated first.
- An email delivery provider — optional and off by default. Transactional and marketing mail is not enabled today.
We disclose data to no one else. We would disclose it if compelled by law, and we would tell the affected merchant unless legally prohibited from doing so.
5. Where it is processed, and international transfers
All processing happens in the United States, in DigitalOcean’s sfo2 region (San Francisco). There is no second region and no processing anywhere else.
For merchants and shoppers in the EEA, the UK or Switzerland this is a transfer out of your jurisdiction. Transfers are made under the European Commission’s Standard Contractual Clauses together with the UK International Data Transfer Addendum. A copy is available on request from privacy@happywards.com.
6. How long we keep it
- While the merchant’s store has happywards installed, a member’s record and points ledger are kept for the life of the install. A member who returns after five years still expects their points, and the ledger is the merchant’s financial record of the programme.
- When a merchant uninstalls, Shopify sends a shop-redaction instruction 48 hours later and we delete the shop and everything belonging to it — members, ledger, reviews, redemptions.
- Unsubscribe records outlive erasure, deliberately. When a shopper is erased we keep the unsubscribe as a keyed pseudonym rather than deleting it, because deleting it would let a later import silently re-subscribe somebody who explicitly opted out.
- Erasure on request is immediate. A deletion request, or Shopify’s
customers/redactwebhook, erases the row when it arrives rather than waiting for a scheduled sweep.
7. Your rights
In the EEA or the UK you have the right to access your data, to have it corrected or erased, to restrict or object to processing, to data portability, and to complain to your supervisory authority. In California and comparable US states you have the right to know, to delete, to correct, to opt out of sale or sharing (there is none), and not to be discriminated against for exercising any of them.
Shoppers: ask the merchant whose store you bought from. They are the controller and they hold the deadline. Shopify relays the request to us automatically and we produce the merchant a complete export of everything we hold about you — member record, every ledger entry, every redemption, every review, every email we generated, and any unsubscribe record — plus a plain-language summary they can forward.
Retrieval of that export is a manual step for our operator today. A merchant who has received a subject-access request should email us and we will send them the artifact. We are stating the friction rather than hiding it: it is the honest description of a one-person operation, and automating it is on the roadmap.
Erasure is handled the same way: Shopify relays it, and we anonymise the member — email replaced, names removed, the Shopify customer id dropped, review author details redacted, and any queued email deleted. The points ledger survives in anonymised form because it contains no personal data (a signed number and a reason) and is the merchant’s financial record.
8. Security
Traffic is encrypted in transit. Every Shopify webhook is signature-verified before it is parsed. The public reviews API returns an allow-list of fields and never an author email or a member id. No personal data appears in a URL or query string. Secrets come from the environment and none is committed to source control. Access to production is held by one person with two-factor authentication everywhere.
What we do not have, stated here rather than buried: no SOC 2, no ISO 27001, no third-party penetration test, a single region with no failover, and no access log recording staff reads of member records.
9. Children
happywards is not directed at children and we do not knowingly process the data of anyone under 16. A shopper’s age is not something we hold or can check — the merchant controls who can join their programme. If you believe a child’s data is in the system, contact us and we will work with the merchant to remove it.
10. Contact
- Privacy and data protection: privacy@happywards.com
- Support: support@happywards.com, or the support page
- Security reports: security@happywards.com
We have not appointed a Data Protection Officer, because Art. 37 does not require one here: we carry out no large-scale systematic monitoring and process no special-category data. Data protection questions go to privacy@happywards.com.
11. Changes to this policy
We will post the new version here with a new date and, for any change that materially affects what we do with personal data, notify merchants by email at least 30 days before it takes effect.