Privacy policy

Who we are

CosmoBoost (“we”, “us”) builds apps for Shopify merchants and runs cosmoboost.io. For anything in this policy, email contact@cosmoboost.io.

When a merchant installs one of our apps, the merchant controls their store's customer data and we process it on their behalf to provide the app. Shoppers with questions about their own data should contact the store they bought from first; we'll help the store answer.

This website

cosmoboost.io is a static website. It doesn't use cookies, analytics or advertising trackers, and it has no sign-up forms.

• Hosting. The site is served by Cloudflare, which processes standard request data such as IP address and browser type to deliver pages and protect against abuse.
• Email. If you email us, we receive your name, email address and whatever you write, and use it only to reply.
• Booking a call. Calls are booked through Cal.com, which collects the details you enter under its own privacy policy.

Giftcrate

Giftcrate lets a merchant's shoppers build gift boxes and send them to one or more recipients. It is installed and used through Shopify, so most order data stays in Shopify and is read only when the app needs it.

Merchant and store data

• Store details from Shopify: shop domain, currency, Shopify plan and when you installed the app. Your store name and contact email are read when you install, for our install notification, but aren't stored in Giftcrate.
• The access token Shopify issues so the app can work with your store.
• Your Giftcrate setup: boxes, box rules, discounts, gift settings, dashboard language and the products and collections you choose.
• Gift box orders, which Giftcrate reads from Shopify to run its features and box sales reports.
• Recipient names and addresses for gifts sent to several people, used to create each recipient's order in your store. Addresses are deleted once those orders exist, within 30 days at most.

How we use data

• To run our apps and the features merchants turn on.
• To answer support requests and fix problems.
• To know when a store installs or uninstalls an app, so we can offer help and improve our apps.
• To keep our services secure and prevent abuse.

We don't sell personal data, use it for advertising or share it with data brokers.

Who we share data with

We use a small number of service providers, each only for the job described:

• Shopify: the platform our apps run on.
• Intercom: we use it to communicate with merchants.

We may also disclose data if the law requires it, or to protect our rights or the safety of others.

Uninstalling and deletion

• When a merchant uninstalls an app, we delete the store's access token straight away.
• Shopify asks us to erase a store's data 48 hours after uninstall, and we then delete all of it: settings, boxes, recipient lists and report rows.
• When Shopify sends a customer erasure request for a store, we delete any recipient details linked to that customer's orders.

Security

Data is sent over HTTPS, every request from Shopify is verified before we act on it, and access to production systems is limited to the people who run them. No system is perfectly secure, but we keep the data we hold small to limit what could ever be exposed.

Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal data, or to object to how it's used. Email contact@cosmoboost.io and we'll respond within 30 days. If your data came from a Shopify store, we may refer you to that store, since it controls the data.

International transfers

Our service providers may process data in countries other than yours. Where that happens, we rely on their standard safeguards for international transfers.

Changes to this policy

We'll update this page when our apps or practices change, and change the date at the top. For significant changes we'll let merchants know in the app or by email.