DiscountFix Privacy Policy

Last updated: 29 October 2026

This policy explains what data the DiscountFix Shopify app ("DiscountFix", "the app", formerly "Bulk Discount Code") collects, why, where it is stored and how long it is kept. DiscountFix is operated by Entafix, Türkiye ("Entafix", "we", "us"). Contact: [email protected].

1. Our role

For data about a store and its customers, the merchant who installs the app is the data controller and Entafix acts as a data processor / service provider that processes the data only to provide the app. For the merchant's own account, billing and support contact data, Entafix is the controller.

2. Data we collect

2.1 Store and account data

• Store name, domain, contact email, currency, time zone and Shopify plan, read from the Shopify API.
• The app subscription plan and its status. Payments are handled by Shopify; we never see card or bank details.
• Messages you send us through the contact form, the support chat or email.

2.2 Data needed to run discounts

• The discount settings you create, the generated discount codes and their status.
• IDs and names of the products, variants, collections and customer segments you choose for a discount.
• For orders that used one of the app's codes or discounts: the Shopify order ID, order date, order total and the code used.
• The numeric Shopify customer ID of the customer who received a code (for example through Shopify Flow) or redeemed a code. This is used for usage reports, per-customer limits and leak alerts.
• If you turn on per-customer usage limits, the app stores a usage counter on the customer record in your Shopify store (an app-owned metafield).
• If you connect Klaviyo, your Klaviyo private API key (stored encrypted) and which codes were sent to Klaviyo.
• Technical logs: app events, background job results, Shopify Flow and Sidekick events. Email addresses in these logs are masked.

2.3 Data we do not collect

DiscountFix does not store customer names, email addresses, postal addresses, phone numbers or payment details. Customer tags and order history that discount rules check at checkout are evaluated inside Shopify (Shopify Functions) and are not sent to our servers.

3. How we use data

• To create, update and remove discounts and codes in your store, and to report how they are used.
• To run the automations you set up (Shopify Flow actions and triggers, Klaviyo sync, cleanup jobs).
• To provide support, handle billing and inform you about important changes to the app.
• To keep the service secure and working (monitoring, troubleshooting, preventing abuse).

We do not sell data, do not use it for advertising and do not share it with third parties for their own purposes.

4. Service providers (sub-processors)

Each provider only receives the data it needs for its task. Where data is transferred outside the EEA, Türkiye or the merchant's country, it is protected by the provider's data processing terms, including the EU Standard Contractual Clauses where applicable. We may also disclose data if required by law or a valid legal request.

5. Security

• All traffic is encrypted with TLS (HTTPS only).
• Requests between the app servers and the backend are signed (HMAC-SHA256); unsigned requests are rejected.
• Shopify access tokens are short-lived, rotate automatically and are never placed in URLs or sent to the browser. Third-party API keys are encrypted at rest (AES-GCM).
• Servers accept administration only with SSH keys, are protected by a firewall that only accepts web traffic through Cloudflare, and receive security updates automatically.
• Access to the app is only possible through the Shopify Admin, for staff the store owner has given permission to.
• The database is backed up daily.

6. Retention and deletion

• Data is kept while the app is installed. Event logs are deleted automatically after 180 days.
• When a customer asks the store to erase their data, Shopify sends us a customers/redact request and we delete that customer's ID from all our records.
• 48 hours after the app is uninstalled, Shopify sends us a shop/redact request. We then delete the store's account data, settings, integration keys and logs, and delete all customer IDs of that store. Daily backups are overwritten in the normal backup cycle.
• You can ask us to delete your data at any time by emailing [email protected].

7. Your rights

Depending on where you live (for example under the GDPR, the Turkish KVKK or the CCPA), you may have the right to access, correct, delete, restrict or object to the processing of your personal data, to data portability and to withdraw consent. Merchants can export their codes from the app. Shoppers should contact the store they bought from, since the store is the controller of their data; we support stores in answering these requests through Shopify's customers/data_request and customers/redact requests. We reply to requests sent to us within 30 days. You may also lodge a complaint with your local data protection authority.

8. Cookies and storefront features

Inside the Shopify Admin, the app uses Shopify's session tokens and does not set its own tracking cookies. The support chat (Crisp) uses cookies to keep the conversation. If you turn on the optional campaign link embed in your theme, it copies the campaign name from the link into the cart attributes; it does not identify the shopper.

9. Children

DiscountFix is a business tool for merchants and is not directed to children. We do not knowingly collect personal data from children.

10. Changes

We may update this policy when the app or the law changes. The date at the top shows the latest version.

11. Contact

Entafix, Türkiye. Email: [email protected]