Privacy Policy

Loyalty Runner · Provided by Meg Interactive ("we", "us")

Effective date: August 11, 2026

Overview

Loyalty Runner (the "App") is a loyalty and rewards program that Shopify merchants install on their store. It awards points to the merchant's customers and lets those customers redeem rewards. This policy explains what data the App accesses, why, and how it is handled.

Information we access and store

When a merchant installs the App, we access — through Shopify's APIs and only to the extent the merchant has approved — the following:

Store data: orders, products, discounts, store credit accounts and theme data, used to award points, create redemption discounts, and display the on-site widget.
Customer data (protected customer data): customer identifiers, name, email and — where a customer provides it for birthday rewards — date of birth. We use this solely to identify a customer's loyalty account, calculate their points balance and tier, and apply their rewards.

We store the minimum needed to run the program: a customer identifier, the customer's points ledger (points earned and spent), tier, and reward redemptions. We do not sell customer data or use it for advertising.

How we use the data

To calculate and display points balances and VIP tiers.
To create and apply redemption discounts and store credit.
To award points for qualifying events (orders, signups, birthdays, newsletter subscriptions, social follows, reviews) as configured by the merchant.
To respond to the merchant's and Shopify's compliance requests.

Data sharing

We do not share customer data with third parties except:

Shopify, as required to operate the App on the merchant's store.
Infrastructure providers that host the App on our behalf, bound by confidentiality and used only to run the service.
Where required by law.

Data retention and deletion

We honour Shopify's mandatory compliance webhooks:

customers/data_request — we compile the loyalty data we hold for a customer so the merchant can fulfil an access request.
customers/redact — we delete the loyalty data we hold for that customer.
shop/redact — 48 hours after a merchant uninstalls, we delete the store's data.

Data security

Access to the App's backend is authenticated (Shopify session tokens / signed requests). Data is transmitted over HTTPS. Store-credit conversions and point debits are recorded in an append-only ledger for integrity.

Changes to this policy

We may update this policy; material changes will be reflected by a new effective date at the top of this page.

Contact

Questions about this policy or your data: edward@meginteractive.com.