Privacy Policy

• Merchant data. For information about merchants and their stores (for example the store name and contact email), AttriBolt is the controller.
• Customer data. For information about a store's customers that AttriBolt processes on the merchant's behalf (for example a shipping address a customer changes), the merchant is the controller and AttriBolt is a processor. If you are a customer of a store, please contact that store about your data. We will help the store respond.
• Website visitors. For information you send us through attribolt.com, AttriBolt is the controller.

When a merchant installs AttriBolt, Shopify gives us access to store information through its APIs. We store:

• Store details: store name, myshopify domain, store contact email, store owner name, Shopify plan, country, currency and time zone.
• App configuration: settings, offers, attribute definitions and presets the merchant creates.
• Subscription status: the AttriBolt plan, trial and billing period, as reported by Shopify. Billing itself is handled by Shopify; we never see card details.
• Usage counts: the number of orders per billing period, used to show plan limits.
• Communication: emails we send to the merchant (setup tips and operational alerts) and the merchant's replies.

AttriBolt features run on the pages customers see after checkout (the post-purchase offer page, the Thank you page and the Order status page) and in the merchant's Shopify admin.

Processed in real time, not stored by us. To show an order and apply the changes a customer asks for, we read and update, through Shopify's Admin API: the customer's name, shipping address, email and phone on that order; the order's items, prices, discounts, payment and fulfillment status; and Shopify's fraud analysis for the order. These changes are saved in Shopify, not in AttriBolt's database. We never receive payment card details: payments, payment links and refunds are handled by Shopify.

Stored by us, to show the merchant what happened and to protect the store:

• An activity log per order: order identifier and number, what was offered, accepted, declined or changed (for example product and variant names, quantities, amounts and currency), and when.
• The customer's email address only as a one-way hash, so repeat events can be matched without storing the address.
• For address changes, only the city, region and country before and after the change (no street, name or phone).
• Short-lived technical records: the editing window of each order and locks that prevent two changes at the same time.

Why. To provide the features the merchant turned on: let customers edit their order within the time the merchant allows, show post-purchase offers, collect price differences through Shopify, hold unpaid or risky changes, and show the merchant analytics and alerts. We do not use customer data for advertising, we do not build profiles, and we do not sell or share it.

• Contact form. Your name, email, store URL (optional), topic and message are emailed to our support inbox so we can reply, together with the page you sent it from, your browser's user agent and the time. They are not stored in a database on the website.
• Technical logs. Our hosting provider processes IP addresses and request details to deliver and secure the site (for example to block abuse), and keeps them for a short time.
• Spam protection. The contact form uses Cloudflare Turnstile, which processes signals from your browser to tell people from bots.
• Cookies. attribolt.com does not use advertising or tracking cookies.

We process merchant data to perform our contract with the merchant (the app's terms) and for our legitimate interests in running, securing and improving the service. We process customer data on the merchant's instructions. We process website contact data to answer your request (legitimate interest or steps before a contract). Under Brazil's LGPD these correspond to contract execution, legitimate interest and the controller's instructions.

We use these providers to run AttriBolt. Each processes data only to provide its service to us:

These providers may process data in the United States, Canada, the European Union and other countries. Where required, transfers rely on appropriate safeguards such as standard contractual clauses.

• Order activity log: 13 months, then deleted automatically.
• Editing windows: deleted 7 days after the window closes. Locks: deleted when they expire.
• Order usage counts: 24 months.
• When a merchant uninstalls AttriBolt, Shopify asks us to delete the store's data (48 hours after uninstall). We then delete the store's settings, offers, attribute definitions and presets, activity log and usage counts. The store details listed in section 2 are kept so AttriBolt works again if the store reinstalls it; write to support@attribolt.com to have them deleted.
• When Shopify sends a customer redaction request, we delete that customer's records.
• Support emails: kept while needed to help you and for up to 24 months after the conversation ends.

Data is encrypted in transit (HTTPS/TLS) and at rest by our hosting providers. Access is limited to the people who run AttriBolt, with strong passwords and two-factor authentication. We store as little customer data as possible and hash customer emails. If we become aware of a breach affecting personal data, we will notify affected merchants without undue delay and, where required, within 72 hours, and help them meet their own obligations. More in our Data Protection & Security page.

Depending on where you live (for example the GDPR, the UK GDPR, Brazil's LGPD or California's CCPA/CPRA), you may have the right to access, correct, delete or port your data, to object to or restrict processing, and to withdraw consent. To exercise them, write to support@attribolt.com. Customers of a store should contact the store first; we will assist it. We do not sell or share personal information for cross-context behavioural advertising. You may also complain to your data protection authority (in Brazil, the ANPD).

AttriBolt is a service for businesses and is not directed to children.

We will post any changes on this page and update the date above. For material changes, we will notify merchants by email or in the app.

Bruno Gomes de Azevedo · Vitória, Brazil · support@attribolt.com