PromoProof — Privacy Policy

Last updated: October 8, 2026

PromoProof ("the App", "we", "us") is a Shopify app that verifies a merchant's discounts are applying correctly and alerts the merchant when one breaks or over-discounts. This policy explains what data the App accesses, stores, and why. It is provided by Ecosphere Innovations LLC ("the Developer").

1. What data we access

When you install PromoProof on your Shopify store, it accesses, via Shopify's Admin and Storefront APIs and only with the scopes you grant:

• Discounts (read_discounts) — your discount configurations, used to verify them.
• Products (read_products) — product and variant data, used to build a qualifying test cart.
• Storefront cart evaluation (unauthenticated_read_product_listings, unauthenticated_write_checkouts) — to create ephemeral test carts that read how Shopify applies a discount. These carts place no orders and consume no inventory or discount usage.
• Store profile — your store domain and contact email, used to identify your account and send alerts.

2. What we store

• Your store domain, plan, and an offline API access token (to run checks on your behalf).
• Your discount configurations and the results of each verification check.
• The email address you choose to receive alerts (this is your notification address, which you control in the app).

We do not collect, store, or process your customers' personal information. PromoProof never reads customer names, addresses, orders, or payment data.

3. Why we process this data

Solely to provide the App's function: to verify your discounts, detect when one is broken or misconfigured, and notify you. We do not sell your data or use it for advertising.

4. Sub-processors

We use the following service providers to run the App:

• Google Cloud Platform — application hosting and compute.
• Neon — database storage.
• Resend — sending alert emails.

5. Data retention and deletion

• When you uninstall the App, your access token is immediately revoked.
• Verification results are deleted automatically after 90 days.
• We honor Shopify's mandatory compliance webhooks: shop/redact (sent ~48 hours after uninstall) permanently deletes all data associated with your store.
• Because we store no customer personal data, customers/data_request and customers/redact requests return no customer information (there is none to return or erase).

6. Security

Data is transmitted over TLS and stored with our sub-processors under their security controls. Access tokens are stored using managed secret storage and are used only to perform the checks you enable.

7. Your rights

Depending on your jurisdiction (including under GDPR and CCPA), you may have rights to access, correct, or delete your data. Uninstalling the App triggers deletion as described above. For any request, contact us at the address below.

8. Changes to this policy

We may update this policy; material changes will be reflected by the "Last updated" date. Use of the App is also governed by our Terms of Service.

9. Contact

Questions or requests: support@ecosphereinnovation.com
Ecosphere Innovations LLC, United States