1. Who We Are

Randio Commerce LLC (New Jersey, USA) operates Randio and is the controller of merchant account data. For the store and customer data you connect to the Service, you are the controller and we act as your processor, handling that data on your instructions to provide the Service. For three things we decide ourselves rather than on your instructions, we are the controller: the platform-wide email suppression list, the global email deliverability records described under Retention, and the de-identified aggregate statistics we publish. Contact us at support@randioapp.com.

2. Data We Collect

We collect the following data. Store data comes from Shopify, as allowed by the scopes you grant; storefront activity is collected directly from your shoppers' browsers:

  • Store info, products, collections, orders, and customer data
  • Merchant account info (name, email, store information)
  • Email engagement events (delivery, open, click, bounce, complaint, unsubscribe) for messages we send on your behalf
  • Storefront activity — offer, product and collection views, clicks, add-to-cart, checkout starts, and cart contents — recorded when an offer page or offer block loads and refreshed while the tab stays open
  • IP address and browser user-agent. For storefront visitors these are stored only as one-way hashes. For people using the Randio admin they are recorded in plain form in our audit log of administrative actions, and for accounts created outside Shopify the signup IP address is kept in plain form
  • Usage data including log data and device/browser metadata

We do not knowingly collect data from anyone under 16, and the Service is not directed to children.

3. How We Use Data

We use the data for the following:

  • To provide and operate the app
  • Provide analytics on performance, activity, and usage
  • Calculate plan usage and billing
  • Create and send personalized campaigns to your customers using your collections and products
  • Authenticate accounts
  • Maintain reliability and security, including maintaining a global email suppression list to prevent delivery to invalid addresses
  • Publish de-identified aggregate statistics — such as total merchants, catalogs generated, and attributed revenue — on our public website; these carry no merchant, store, or customer dimension
  • Send you operational email about your account, and marketing email about the Service that you can opt out of at any time
  • Provide support
  • Comply with platform requirements

We do not sell merchant or customer data, and we do not share it for cross-context behavioral advertising. We do not use your data to train general-purpose AI models.

4. Email Deliverability & Suppression

To protect email deliverability across our platform, we maintain a global email suppression list. When an email address produces a hard bounce (permanent delivery failure) or a spam complaint, we record the address and the minimum needed to apply it, such as why and when it was added, to prevent future delivery attempts to that address from any store using our Service. An unsubscribe is recorded against that store's own customer record.

  • This list is used to make delivery decisions and protect deliverability, not for marketing or advertising
  • We do not attach merchant details such as store name, order history, or campaign details to suppression records
  • Merchants are not given the suppression list; they may see that a customer cannot be emailed
  • Hard bounces and spam complaints are retained indefinitely, since retaining the address is what keeps the suppression in effect; soft bounces (temporary delivery failures) are suppressed only for a limited period
  • An erasure request does not add the address to this list

5. Data Sharing & Sub-Processors

We share data with service providers to operate the Service, under terms that require them to protect it. Current categories of sub-processor:

  • Cloud hosting, storage, and databases
  • Email delivery
  • Your commerce platform, for authentication and billing
  • Logging, monitoring, and error reporting

We may change sub-processors as the Service evolves; the current list is available on request at support@randioapp.com. We may also disclose data where required by law or to protect our rights, and to a successor in a merger or acquisition, subject to this policy.

6. Retention

We keep store and customer data for as long as your account is active and for a reasonable period afterward, then delete it — except suppression records (see section 4), records we keep for tax, accounting, or legal reasons or to resolve disputes, prevent fraud and abuse, and enforce our agreements, and de-identified aggregate statistics that cannot be tied back to you or your customers. Two further exceptions: raw delivery notifications from our email provider, which contain recipient addresses, are archived for troubleshooting for a limited period; and a deliverability verdict for an email address, keyed by a one-way hash of that address, is kept on our legitimate interest in not re-checking and re-mailing a known-bad address, and is not removed by an erasure request. Copies of deleted data can also remain in encrypted backups until those backups are rotated out.

7. Your Rights

Depending on where you or your customers live, you may have the right to access, correct, delete, port, or restrict processing of personal data, to object to processing, and to withdraw consent. To exercise a right over your own merchant account data, contact support@randioapp.com.

For your customers' data you are the controller: send us the request and we will act on it as your processor. On Shopify, customer data requests and erasure requests routed through the platform's mandatory webhooks are handled automatically.

8. Cookies & Similar Technologies

The admin app uses cookies strictly necessary for authentication and session security, and keeps your interface preferences in your browser's local storage. On your storefront we set no cookie and store no identifier: a returning visitor is recognized from a one-way hash of their IP address and browser user-agent, so the same discount catalog is shown to them and a view is counted once per device. Our cart integration holds a short-lived session token in the browser tab's session storage while the tab is open. Storefront offer pages, offer blocks, and the emails we send load web fonts from Google Fonts, which receives the visitor's IP address and browser user-agent as part of that request. Marketing emails we send on your behalf carry an open-tracking pixel and click-tracked links routed through our email provider. We do not use advertising or cross-site tracking cookies.

9. Security

We use safeguards designed to protect the data we hold. They currently include the following, and may change over time:

  • Verified Shopify requests. Every webhook Shopify sends us, including the mandatory privacy webhooks, is checked against its HMAC signature before we act on it. A storefront request is treated as coming from a logged-in customer only when Shopify's signature on it verifies.
  • Shopify sign-in. The admin is reached through Shopify OAuth and Shopify session tokens, and the access tokens Shopify issues to us are stored encrypted (AES-256-GCM).
  • Tamper-proof discounts. Each discount token is encrypted and authenticated (AES-256-GCM) and checked again at checkout; a token that has been altered, has expired, or belongs to another cart grants no discount.
  • Encryption. Data is encrypted in transit (TLS 1.2 or higher) and at rest in our databases, cache, file storage, and backups.
  • Network isolation. Databases and cache run in a private network and cannot be reached from the internet.
  • Secrets management. Credentials and encryption keys are held in a managed secret store, not in source code.
  • Minimized identifiers. Storefront visitors' IP addresses and browser user-agents are stored only as keyed one-way hashes.
  • Monitoring and access control. Public endpoints are rate-limited, administrative actions are recorded in a tamper-evident audit log, and our internal support tools are restricted to approved networks.

No system is completely secure, and we cannot guarantee that data will never be accessed without authorization.

10. Data Deletion

Upon uninstall, platform-required data deletion is followed within a reasonable timeframe. The exceptions in section 6 (Retention) still apply, and copies can remain in encrypted backups until those are rotated out.

11. Shopify Data Access & Compliance

When installed on Shopify, we collect and process data as allowed by the OAuth scopes you grant:

  • Store info — to identify your account and configure the app
  • Products & collections — to build personalized discount catalogs
  • Customers — to target campaigns and send personalized emails
  • Orders — to track campaign performance and analytics
  • Cart & checkout activity — to know which offers reached a cart or a checkout and to attribute the resulting orders
  • Theme & online-store content — the app writes its own page templates into your live theme so offer pages can render
  • Merchant account info — name, email, and store details for authentication and support
  • Our data access is designed to follow Shopify's protected customer data requirements.
  • We process Shopify's mandatory privacy webhooks automatically. customers/data_request: when a customer asks your store for their data, we compile what Randio holds about them and email it to your store's account email so you can respond. customers/redact: when erasure is requested, we remove that customer's personal data. shop/redact: after you uninstall, we delete your store's data, subject to the exceptions under Retention.

12. Changes to This Policy

We may update this policy. Material changes are announced by email to your account address and/or by a notice in the app. The current version and effective date appear at the top.

13. Contact

For questions, contact Randio Commerce LLC at support@randioapp.com.