Privacy Policy

1. Who we are

Give It and Pick It Up are apps for Shopify merchants made by Apps by Onyx ("we", "us", "our"). This policy explains what information the apps and this website handle, why, and what choices you have. You can reach us at .

2. Our role

When a merchant installs one of our apps, the merchant decides how its customers' information is used. For that information we act as a service provider (a "processor" under the GDPR) and handle it only to run the app for that merchant. For information about merchants themselves, such as the store's contact email and plan, we decide how it is used and act as the controller.

3. What we collect

From every store that installs an app

• Store details from Shopify: store name, store domain, contact email, timezone, currency and the plan you are on.
• App settings you choose, such as hours, rules, message wording and branding.
• Billing status from Shopify. Payments are handled by Shopify; we never see or store card details.
• Staff sign in through Shopify. We do not create or store passwords.

Give It

Shopify permissions: read orders, read customers, read and write products.

• Order details for orders placed during a giveaway: order number, totals, discounts, items, refund and cancellation status, the customer's name and email, and the billing state or province (used to check eligibility).
• Entry form details from people who enter: name, email address, phone number, state, acceptance of the official rules, and optional consent to receive text messages.
• Mail-in entries the merchant records: name, email, phone, state, date of birth, and the date and reference of the envelope.
• Referral activity: each entrant's referral code, clicks on referral links, and which entrants were referred by whom.
• Fraud prevention data: a one-way hash of the entrant's IP address (we do not store the address itself) and a bot check result from Cloudflare Turnstile.
• Product settings: the number of entries a product earns is saved on the product in Shopify so it can be shown in the store and at checkout.

Pick It Up

Shopify permissions: read and write orders and merchant-managed fulfillment orders, read locations, read and write products, write delivery customizations, read customers.

• Pickup order details: order number, items, totals, pickup location, the chosen pickup window, and the customer's name, email and phone number.
• Details the customer gives at checkout or on the I'm-here page: curbside choice, a vehicle description, a parking spot and any note.
• Handoff details: status changes, who collected the order when an ID check is required, and a timeline of actions on each order.
• Team members the merchant adds for alerts: name, email, phone number, and any Slack, Microsoft Teams or Google Chat webhook address.
• Message records: whether each email or text was delivered.

This website

This website has no sign-up forms, no advertising trackers and no analytics cookies. Our hosting provider keeps standard server logs, such as IP address and pages requested, for security and reliability.

4. How we use it

• To provide each app's features for the merchant who installed it: counting entries, running draws, showing pickup windows, sending notices and alerts, and updating orders in Shopify.
• To prevent fraud and abuse, such as bots, duplicate entries and self-referrals.
• To answer support requests, fix problems and keep the apps secure.
• To meet legal obligations and enforce our terms.

We do not sell or rent personal information. We do not use a merchant's customer data for our own marketing, and we do not build advertising profiles.

5. Who we share it with

We use these service providers to run the apps. Each one receives only what it needs to do its job.

If a merchant connects another tool, such as a Slack, Microsoft Teams or Google Chat channel, we send the information the merchant has chosen to that tool on the merchant's behalf. We may also disclose information when the law requires it, to protect people's safety or our rights, or as part of a merger or sale of our business, in which case this policy continues to apply.

6. Keeping and deleting data

• We keep a store's data while an app is installed.
• When a store uninstalls an app, Shopify notifies us, and we delete that store's data when Shopify sends its deletion request, normally 48 hours after uninstall.
• When a store's customer asks the store to delete their data, Shopify forwards the request and we erase that customer's personal details. Where a giveaway record must stay intact to keep a draw verifiable, we remove the personal details and keep only an anonymous entry.
• When a customer asks a store for a copy of their data, Shopify forwards the request and we provide what we hold to the store.
• Backups held by our providers expire on their normal schedules.

7. Security

All data is encrypted in transit. Access to production systems is limited to the people who run the apps. Every request from Shopify is checked against Shopify's signature before we act on it, and we store hashes rather than IP addresses. No system is perfectly secure. If a breach affects your information, we will tell the affected merchants without undue delay and as the law requires.

8. Your rights

If you shopped at or entered a giveaway with a store that uses our apps, please contact that store first, because it controls your information. We will help the store respond.

If you are a merchant, or if you contact us directly, you can ask to access, correct, delete or receive a copy of your information, or object to how we use it. Depending on where you live, laws such as the GDPR, the UK GDPR and the California Consumer Privacy Act give you these rights. We will not treat you differently for using them. You may also complain to your local data protection authority.

9. Where data is processed

We and our providers process data in the United States. Where the law requires it for transfers from the EU, UK or other regions, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

10. Children

Our apps are made for businesses and are not directed at children. Give It checks the minimum entry age for each giveaway, and we do not knowingly collect information from children under 13.

11. Cookies

This website does not set tracking cookies. Give It sets one cookie on a store's site when someone follows a referral link, so the right entrant gets credit for the referral. It lasts 30 days. Pick It Up does not set cookies on a store's site.

12. Changes to this policy

If we make a material change, we will update the date at the top of this page and tell merchants inside the apps or by email before the change takes effect.

13. Contact us

Apps by Onyx
Email: