Privacy Policy

Last updated: 2026-09-01

What this app does

Promo Announcement Bar is a Shopify app that lets merchants design and publish announcement bars on their storefront, and tracks aggregate views and CTA clicks for analytics. Merchants can also configure a bar to collect email addresses from storefront visitors.

Data we store about the shop

• The shop’s domain and Shopify-issued session/access tokens
• Bar configurations and message content created by the merchant
• Daily aggregate view and CTA click counts per bar
• Subscription plan, current cycle’s view total, and quota state

Data we store about storefront visitors

If — and only if — the merchant enables an email-capture bar, we store what a visitor voluntarily submits through that form:

• The email address the visitor typed into the bar
• A two-letter country code, derived from the visitor’s IP at submission time (see sub-processors below). The IP itself is never stored.
• A coarse device type (desktop, tablet, or mobile)
• The submission timestamp and the bar it came from
• A record of the marketing consent given: the moment the visitor ticked the box, and a copy of the exact wording they agreed to. We keep the wording as it stood at that moment so a later edit by the merchant can’t change what an earlier subscriber consented to.

The consent box is mandatory. An address can’t be submitted without it, and the app refuses any submission that arrives without a recorded opt-in.

We collect this on behalf of the merchant, who is the data controller for it; we act as their processor. It exists so the merchant can reach the people who signed up on their own store. We never sell it, share it with other merchants, or use it to contact visitors ourselves. Merchants can download it at any time from Analytics (CSV, per bar) or Privacy & data → Download data export (JSON, all bars).

A visitor who wants their address removed should contact the store they submitted it to. Shopify’s customers/redact webhook also deletes every matching signup on that shop automatically, and merchants can delete all of it themselves from the in-app Privacy & data page.

Data we do not store

Beyond the email-capture data described above, we hold nothing that identifies a storefront visitor. In particular, the analytics tracker that records views and CTA clicks:

• Does not write or read cookies
• Does not store visitor IP addresses
• Does not generate or persist session identifiers
• Does not associate views or clicks with customer accounts
• Does not link views or clicks to email signups
• Stores only a randomly-generated visitor-local identifier in the visitor’s own localStorage, used solely for consistent A/B variant assignment. This identifier never leaves the visitor’s device.

The app requests no access to protected customer data through Shopify’s APIs. It never reads the shop’s customers, orders, or checkout data.

How long we keep data

Bar configurations, aggregate metrics, and email signups are retained while the app is installed. When the merchant uninstalls, Shopify sends us a shop/redact webhook 48 hours later; on receipt we delete the shop row and everything cascading from it — bars, messages, daily metrics, email signups, and sessions. Merchants can also self-serve delete all of it via Privacy & data inside the app.

Individual email signups are deleted sooner on request: a customers/redact webhook from Shopify removes every signup matching that customer’s email on that shop, and a customers/data_request webhook returns the signups we hold for them.

Sub-processors

We rely on the following third-party services to operate the app:

• Shopify — hosts the merchant’s shop data we read/write via the Admin API.
• Cloudflare — terminates TLS for the app server.
• api.country.is — IP-to-country lookup, used for the country-targeting feature and to label email signups with a country. The lookup is made from the visitor’s browser, so their IP reaches this service; we never receive or store the IP itself, only the two-letter country code it returns.

Your rights

Under GDPR / CCPA / equivalent laws, you can request access to, correction of, or deletion of any data we hold about your shop. The in-app Privacy & data page provides one-click export and deletion. For anything else, contact us at the email below.

Contact

Questions about this policy or your data: support@meta-mind-lab.com