Privacy policy
What the All Discounts & Promotions Shopify app collects, why, and how to have it deleted.
Last updated 7 November 2026
Who we are
All Discounts & Promotions (also known as Behaviour Discounts) is a Shopify app run by EC Web, based in the United Kingdom. In this policy, “we” means EC Web.
When a store installs the app, the store owner (“the merchant”) is responsible for their shoppers’ data, and we process it on the merchant’s behalf to run their discounts. For data about merchants themselves, we are responsible.
Data about merchants
When you install the app, Shopify gives us:
- your store’s address, currency, time zone and plan, so we can show prices and schedule campaigns correctly;
- an access token that lets the app make the changes you ask for, such as creating discounts or updating prices.
We also keep your campaign settings, and a record of when your store installed and uninstalled the app and which setup steps were completed. We use that record to improve setup and to understand why stores leave.
Billing is handled by Shopify. We never see your payment details.
Data about shoppers
The app processes shopper data only to run the merchant’s discounts and to show the merchant how their campaigns perform.
| What | Why |
|---|---|
| Orders that used one of the app’s discounts: order number, totals, discount amounts, products bought and the Shopify customer ID | To show the merchant how much each campaign sold |
| Checkout progress: subtotal, discount codes, and an identifier made from the shopper’s email using a one-way hash, or a Shopify browser cookie ID | To offer a discount to shoppers who abandon checkout, and to show the merchant checkout funnel figures |
| Email addresses entered in a sign-up popup | To add the shopper to the merchant’s Shopify customer list with email marketing consent, and to make sure each email address gets the sign-up reward only once |
| Campaign events such as “popup shown” or “offer accepted”, with no shopper identifier | To show the merchant campaign statistics |
We don’t store shoppers’ IP addresses, and we don’t sell or rent any personal data or use it for advertising.
Cookies and browser storage
The app’s storefront script stores small items in the shopper’s browser on the merchant’s store:
- cookies that remember which magic link, QR code or behaviour trigger discount applies, for up to 7 days;
- local storage that counts visits, so returning-visitor offers work, and remembers when a popup was last shown, so it isn’t shown too often;
- session storage, cleared when the browser tab closes, that holds the shopper’s progress towards trigger rules and cached campaign settings. This includes a temporary session ID built from the browser’s screen size, language, time zone and a random number.
It also reads Shopify’s own visitor cookie to link checkout progress to a visit. Merchants who show a cookie banner should list these as necessary for the store’s discounts to work.
Who processes the data
- Shopify: hosts the store and sends us the data above.
- Fly.io: runs the app on servers in London, UK.
- DigitalOcean: hosts the app’s database in London, UK.
We don’t use any other service providers to process personal data.
How long we keep it
- Checkout progress records are deleted after about 7 days.
- Campaign settings, order statistics and sign-up emails are kept while the app is installed.
- When a store uninstalls the app, its access token is deleted straight away. Shopify then asks us to delete the store’s data about 48 hours later, and we delete it, except for the record of when the store installed and uninstalled the app.
- When Shopify tells us a shopper has asked for their data to be deleted, we delete their sign-up email and checkout records, and remove their customer ID from order statistics.
Your rights
You can ask us for a copy of the personal data we hold about you, or ask us to correct or delete it. Shoppers should contact the store first, because the store decides what happens to their data; stores can pass requests on to us, and Shopify sends us some of these requests automatically.
If you’re in the UK or EU and unhappy with how we’ve handled your data, you can complain to the Information Commissioner’s Office (ico.org.uk) or your local data protection authority.
Security
All data is sent over encrypted connections. Access to the app’s servers and database is limited to the people who run the app.
Contact
Email hello@behaviour-discounts.co.uk with any privacy question or request. Include your store address so we can find your data.