Otherwise: Privacy Policy

Effective 10 October 2026

Otherwise ("the app") is a Shopify app made by SpicyDesign ("we", "us"). It lets a merchant build discounts and checkout rules that run inside Shopify. This policy says what the app collects when a merchant installs it, what it does not collect, and how to reach us.

The short version

• The app stores information about the store and the rules its staff build. It does not store information about the store's customers.
• The rules run inside Shopify at checkout. What they look at there (a cart, a customer's tags, a delivery address) never reaches our servers.
• We do not sell data, and we do not use it for advertising.

What we collect from a store that installs the app

• Store details: the store's myshopify.com address, name, currency, time zone, Shopify's ID for the store, and whether it is a Shopify Plus or a development store. We read these from Shopify so the app can show prices and schedules correctly.
• Access to the store: the access token Shopify issues when the app is installed, limited to the permissions shown at install (products, discounts, checkout validations, delivery and payment customizations, and cart transforms).
• What is built in the app: the rules a merchant creates, their settings and saved versions, the names and IDs of the products and collections a rule refers to, and the discount codes the app generates when asked to.
• Plan: which of the app's plans the store is on. Billing itself is handled by Shopify; we never see card or bank details.
• Agent connections: if a merchant connects an AI agent or creates an access token, we store the name given to it, what it is allowed to do, when it was made and last used, and a one-way hash of the token. When an agent changes a rule, the agent's name is kept with that change.
• Technical logs: our hosting provider records requests to the app (the store's address, the page, timings, errors) so we can keep it working. These logs are kept for a short time and then deleted.

What we do not collect

• No names, emails, addresses, phone numbers or order histories of a store's customers.
• No names or emails of a store's staff.
• No payment details.

The app's rules run as Shopify Functions, inside Shopify's own systems. At checkout a rule may look at what is in the cart, whether the buyer is signed in, their customer tags and order count, and the delivery address, in order to decide whether a discount or a rule applies. That happens within Shopify. None of it is sent to us or stored by us.

The app's optional storefront blocks show a live offer on product and cart pages from information the app has saved in the store itself. They make no requests to our servers and set no cookies.

Cookies

The app works inside the Shopify admin and uses Shopify's own session. It sets one short-lived cookie of its own, only while a merchant is approving an AI agent's sign-in, to make sure the browser that started the sign-in is the one that finishes it. It is not used for tracking.

How we use what we collect

Only to provide the app: to show and run the rules a merchant builds, to create the matching discounts and customizations in Shopify, to enforce the limits of the store's plan, to let the agents a merchant has approved do what they were allowed to do, and to find and fix faults.

Who else handles the data

• Shopify, which the app runs on and through which it is installed and billed.
• Cloudflare, which hosts the app, its database and its logs. Data may be processed in the countries where Cloudflare operates.
• An AI agent a merchant chooses to connect. The agent receives what the merchant has allowed: the store's rules and, when it searches for them, the names of products and collections. What the agent's provider does with that is governed by the merchant's agreement with that provider.

We share data with no one else, unless the law requires it.

How long we keep it

• While the app is installed, for as long as the merchant keeps their rules.
• When the app is uninstalled, the store's access token, its agent tokens and its agent connections are deleted at once, and every rule is switched off.
• Forty-eight hours after an uninstall, Shopify asks us to erase the store's data, and we erase everything we hold for it.

Your rights and requests

A merchant can see, change, export or delete their rules in the app at any time, and can remove any agent's access on the app's Agents page. To ask what we hold for a store, or to have it deleted sooner, write to us at the address below.

Because the app stores nothing about a store's customers, there is nothing for us to give or erase when a customer makes a request to a merchant. We still receive and answer the data requests Shopify sends on a merchant's behalf.

Changes to this policy

If the app starts to collect something new, we will update this page and change the date at the top before it does.

Contact

SpicyDesign
apps@spicydesign.ca