Privacy Policy
Last updated: October 28, 2026
1. Overview
OfferEngine ("the App") is a Shopify application developed by Vasta Inc. This Privacy Policy describes how we collect, use, and protect information when you install and use OfferEngine on your Shopify store.
2. Information We Collect
When you install OfferEngine, we access the following data through Shopify's API: • Store information: shop domain, currency, and timezone. • Order data: product IDs, order totals, and checkout reference tokens used to match post-purchase sessions to their originating orders and to add identification tags to those orders. • Session data: authentication tokens stored securely in our database to maintain your login session. • Analytics events: anonymized records of offer views, acceptances, and declines linked to checkout reference IDs, with no connection to individual customer identities. • Storefront cart offers: when a merchant turns on the OfferEngine theme embed, the storefront sends us the cart's token, the IDs of the products in the cart, and the buyer's country and currency, so we can choose and price offers. We store the cart token with the offers shown, added, and bought; the country and currency are used for that request only. The embed keeps short-lived state in the browser's session storage and sets no cookies. • Thank You page offers: the order ID the widget was shown on, with the offers shown, clicked, and bought from it.
3. How We Use Your Information
We use the collected data solely to: • Display relevant post-purchase upsell offers to your customers. • Display offers in the cart, before checkout, and on the Thank You page, and apply the discount the merchant set for them. • Add the tag "OfferEngine - Post Purchase" to orders where a customer accepted an upsell, and "OfferEngine - Pre Purchase" to orders that bought an offer from the cart, so merchants can easily identify and filter those orders in the Shopify admin. • Track funnel performance and provide analytics in your dashboard. • Maintain authenticated sessions for app administrators. We do not sell, rent, or share your data with third parties for marketing purposes.
4. Data Storage & Security
All data is stored in a PostgreSQL database hosted on Supabase. All data is encrypted at rest and all connections are encrypted in transit using TLS. We retain analytics data for as long as your store has the app installed. When the app is uninstalled, the store's sessions, analytics events, and funnel configurations are deleted at once, and the rest of its data within 30 days through Shopify's shop/redact compliance webhook. We keep one record of the store's plan and its status, with nothing else in it, as billing history.
5. Customer Data (GDPR Compliance)
OfferEngine supports Shopify's mandatory privacy webhooks: • customers/data_request: we store no customer identifiers (no name, email, address, or phone). What we hold for an order is which offer was shown, whether it was accepted, and for how much. We log each request and answer it to the merchant with those records. • customers/redact: for each order named, we delete the stored cart contents and unlink its analytics events from the order, including the Thank You page and cart offer records of that order and its cart: the order, checkout and cart identifiers are replaced with a random value, so the offer statistics remain but can no longer be traced to the customer. • shop/redact: we delete the store's data within 30 days of app uninstallation, except the record of its plan and status kept as billing history. Merchants are responsible for informing their own customers about data processing in accordance with applicable laws (GDPR, CCPA, etc.).
6. Third-Party Services
OfferEngine uses the following third-party infrastructure: • Shopify API: reads products and processes upsell orders. • Supabase: database hosting. • DigitalOcean: server hosting. • Resend: sends sign-in codes to Vasta staff for our internal admin. It receives only those staff email addresses, never a merchant's or a customer's. These providers have their own privacy policies and security certifications.
7. Your Rights
As a merchant, you may request access to, correction of, or deletion of your store's data at any time by contacting us at info@vasta.me. We will respond within 30 days.
8. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes via the app dashboard or email. Continued use of the app after changes constitutes acceptance of the updated policy.
9. Contact
If you have questions or concerns about this Privacy Policy, please contact us: Vasta Inc. info@vasta.me