Privacy Policy

Effective July 11, 2026

This policy explains how Customer Luv handles personal data. We built our apps to respect shoppers — no advertising trackers, no tracking pixels, no link-rewriting — and this policy reflects that.

1. Who we are & what this covers

Customer Luv ("Customer Luv", "we", "us") is a family of Shopify applications — Surveys, Luv Reply, Luv Cart, Pop Up & Quiz, Upsell, Quiz, Subs, and Tracking — operated by Life Vitamin Co. LLC. This policy applies to our websites (customerluv.app) and our apps (together, the "Services"). Capitalized terms not defined here have the meaning given in our Terms of Service.

2. Our two roles: controller and processor

For personal data about our merchant users (account, billing, and support information), we act as a data controller. For personal data about a merchant's shoppers that we process when a merchant uses the Services (for example, survey answers, contact-form messages, and order references), the merchant is the controller and we act as a processor / service provider — processing that data only on the merchant's documented instructions and under our Data Processing Addendum.

3. Personal data we collect

• Merchant account data: your name, business name, email, shop domain, and the authentication identifiers Shopify provides at install.
• Store configuration: settings, question sets, targeting rules, templates, and any integration keys you choose to add.
• Shopper data (processed for the merchant): depending on the app — survey responses with the associated order reference and order email; contact-form submissions (name, email, message); cart and checkout interactions; subscription and shipment details; and reward-code claims. We do not require, and we ask merchants not to collect, special-category (sensitive) data.
• Usage & technical data: log data, IP address, device and browser type, timestamps, and diagnostic events used to operate, secure, and improve the Services.

We do not use third-party advertising trackers, tracking pixels, or link-rewriting redirects in buyer-facing communications — a deliberate design choice.

4. Where the data comes from

Directly from you; automatically from your use of the Services; and from Shopify and the integrations you connect (such as Klaviyo or Google Analytics) at your instruction.

5. How we use data, and our legal bases

We use personal data to provide and operate the Services (performance of contract); to provide support and maintain security and prevent fraud or abuse, and to improve the Services (legitimate interests); to send service and transactional messages (contract / legitimate interests); to comply with law (legal obligation); and, where required, with your consent (which you may withdraw). We do not sell personal data, do not "share" it for cross-context behavioral advertising, and do not use shopper data for our own advertising or across different merchants.

6. Sub-processors

We use vetted providers to run the Services, including Cloudflare (hosting, storage, and security), Resend (transactional email delivery for the platform sender), and Shopify (the commerce platform). When a merchant enables an integration (for example, Klaviyo or Google Analytics), data is transmitted to that provider at the merchant's instruction and under that provider's terms. A current list of sub-processors is available on request at hi@customerluv.app.

7. When we disclose data

We disclose personal data only to sub-processors under contract; to a merchant (for their own store's data); to comply with law or valid legal process; to protect rights, safety, and security; and in connection with a merger, acquisition, or asset sale, with notice.

8. International transfers

Data may be processed in the United States and other countries. Where we transfer personal data out of the EEA, the UK, or Switzerland, we rely on appropriate safeguards such as the Standard Contractual Clauses.

9. Retention and deletion

We keep personal data only as long as needed to provide the Services and for legitimate business or legal purposes, then delete or anonymize it. We honor Shopify's mandatory privacy webhooks: customers/data_request (we compile the data we hold), customers/redact (we delete that shopper's data), and shop/redact (we delete all of a store's data within 30 days of uninstall). Merchants can export or request deletion of their data at any time.

10. Security

Data is encrypted in transit (TLS) and at rest. Access is shop-scoped and gated by Shopify session-token authentication, so every request is restricted to the installing store. We apply least-privilege access, abuse caps on outbound email, and safeguards for platform secrets. No method of transmission or storage is perfectly secure, but we work hard to protect your data and to notify affected parties of incidents as required by law.

11. Your rights

Depending on where you live, you may have rights to access, correct, delete, port, restrict, or object to processing, and to withdraw consent. EEA and UK residents may also complain to a supervisory authority. To exercise a right, email hi@customerluv.app. If you are a shopper, contact the store you purchased from (the controller) and we will assist them.

12. California residents (CCPA / CPRA)

In the prior 12 months we collected the categories of personal information described above for the business purposes stated. We do not sell or share personal information as those terms are defined by the CPRA, and we do not use sensitive personal information for purposes that would trigger a right to limit. California residents may exercise rights to know, delete, correct, and to non-discrimination by emailing hi@customerluv.app.

13. Shoppers

If you completed a survey, sent a contact-form message, or otherwise interacted with a store using our Services, that store is the controller of your data. Our surveys and forms are optional and every survey question is skippable. Contact the store, or us, to access or delete your information.

14. Cookies

Our marketing site uses only essential cookies needed for security and basic functionality; our admin uses the cookies and session tokens required to authenticate you to Shopify. We do not use advertising or cross-site tracking cookies.

15. Children

The Services are intended for businesses and are not directed to children under 16 (or the age defined by local law). We do not knowingly collect their personal data.

16. Changes

We may update this policy. We will update the "Effective" date and, for material changes, provide additional notice. Continued use of the Services after a change means you accept the updated policy.

17. Contact

Life Vitamin Co. LLC · hi@customerluv.app