Privacy policy
Last updated October 22, 2026
Repeat Loyalty (“the app”, “we”) is a points and rewards app for Shopify stores, made by Octidev. This policy explains what the app collects when a merchant installs it, why, how long it is kept, and who else receives it. It applies to merchants who install the app and to their customers whose points the app records. Questions: support@octidev.com.
Who is responsible
For customers’ data, the merchant is in charge (the controller) and we process it on the merchant’s behalf, only to run their points program. Customers should contact the store they shop with about their data; the store can reach us, and Shopify passes us any request the store receives.
What we collect from Shopify
When a merchant installs the app, Shopify gives it access to:
- the store’s details: its domain, name, currency, time zone and contact email;
- orders and refunds: totals, currency, the order’s channel and its customer, so points can be added when an order is paid and taken back when it is refunded or cancelled;
- customers: their Shopify id, tags and the app’s own fields on the customer (points balance, tier, whether they’re excluded), and their name and email address;
- the store’s live theme, only to see whether the app’s embed and blocks are on.
What we keep
| Data | Why | How long |
|---|---|---|
| Points history and balances, by Shopify customer id | To run the program: what each customer earned, spent and holds | While the app is installed |
| VIP tier memberships, by customer id | To give each customer their tier’s rate | While the app is installed |
| Order amounts and order numbers inside the points history | To work out points and the program’s reports | As the points history |
| The program’s settings, and the name of staff who adjust points by hand | To run the program and show who made each manual change | While the app is installed |
| The merchant’s alert email and a record of alerts sent | To tell the merchant when something needs attention | While the app is installed |
| A Klaviyo private key, if the merchant connects Klaviyo | To update the merchant’s own Klaviyo account | Until disconnected; stored encrypted |
| Privacy requests received from Shopify | To answer them and show they were handled | Data exports are available for 30 days |
We don’t store customers’ names, email addresses, phone numbers or postal addresses. The app reads a customer’s name and email from Shopify when a merchant opens a page that shows them, and when it sends an update to the merchant’s Klaviyo account, and doesn’t keep them. We don’t sell data, use it for advertising, or combine it across stores.
Who else receives data
- Shopify, where the app runs: points balances and tiers are saved on the store’s own customer records so the storefront and checkout can use them.
- Klaviyo, only if the merchant connects their own Klaviyo account: each customer’s email, points balance, its value and tier, and points events.
- Resend, which delivers the app’s emails to merchants. These never carry customer data.
- Sentry, which records errors in the app, with personal data removed.
- Our hosting provider, which runs the app’s servers and database on our behalf.
How we protect it
Everything travels over HTTPS. Credentials such as a Klaviyo key are encrypted in the database. Logs hold store domains and numeric ids only. Access to production systems is limited to named accounts with two-factor sign-in.
Deletion and requests
- When a customer asks the store for their data, Shopify tells us; the merchant can download what we hold for that customer from the app for 30 days.
- When a store asks for a customer’s data to be erased, we delete that customer’s points history, balance and tier, and keep only a one-way fingerprint of the request.
- When a merchant uninstalls the app, Shopify tells us 48 hours later, and we delete everything we hold for the store.
Changes
If this policy changes, we update the date at the top. Material changes are announced in the app before they take effect.
Contact
Write to support@octidev.com with any question about this policy or your data.