1. Who we are and our role
Encore is operated by [Company legal name], registered at [Registered address] (“we”, “us”). You can reach us at onefoundry.labs@gmail.com.
Our role changes depending on whose data it is, and this distinction matters more than any other sentence on this page:
- For shopper data — the order references and survey answers created by people buying from a store that uses Encore — the merchant is the controller and we are a processor. We act on the merchant's instructions and do not decide what that data is used for.
- For merchant data — the account of the store that installed Encore, its plan and its billing status — we are the controller.
2. What Encore installs
Encore runs as a Shopify Checkout UI extension on two surfaces: the thank-you page and the order status page. It does not modify your theme, does not inject scripts into your storefront, and does not touch checkout.liquid.
At install, Shopify asks you to grant these access scopes and no others:
| Scope | Why Encore needs it |
|---|---|
| read_orders | To identify the order a thank-you page belongs to, and to record a conversion when a block leads to a second order. |
| read_products | To build the candidate list a recommendation block ranks: title, price, image, availability, collection. |
| read_customers | To offer a reorder of a customer's previous purchase. |
| read_discounts / write_discounts | To verify that a discount code shown in a block is a real, running discount in your admin, and to create one when you ask Encore to. |
3. Data we process for the merchant
Encore stores far less than most post-purchase apps. These are the only records it writes:
| Record | Fields stored | Contains personal data? |
|---|---|---|
| Block events | Store domain, Shopify order ID, block ID, surface, event kind (impression, click, dismiss, add-to-order), A/B branch, value, attributed order ID, timestamp. | No name, email, address or payment data. The order ID is a pseudonymous reference that the merchant — not Encore — can resolve to a person. |
| Survey answers | Store domain, order ID, order name, score, optional free-text comment, block ID, timestamp. | The free-text comment is the one field a shopper types themselves, so it can contain whatever they choose to write. |
| Block configuration | Store domain, block type, surface, position, status and the merchant's own settings. | No. |
Product and order details are read from Shopify at the moment a block renders and are used to build that response. They are not copied into a database of our own.
4. Data we hold as controller
For the merchant account itself we hold the store's myshopify domain, the plan in use, install and uninstall timestamps, and the Shopify access token needed to call the Admin API on your behalf. The token is encrypted with AES-256-GCM before it is written to the database.
Billing is handled entirely by Shopify. We never see or store card numbers, bank details or billing addresses — Shopify tells us only that a subscription became active, changed or ended.
The legal basis for this processing is performance of the contract between you and us, and our legitimate interest in operating and securing the service.
5. AI and automated processing
On paid plans, Encore can use a large language model (Google Gemini) to rank which products a recommendation block should show. This is the only place an external AI service is involved, and what reaches it is deliberately narrow.
What is sent to the model:
- The line items of the order just placed — product ID, variant ID, product title and quantity.
- A shortlist of candidate products from your own catalogue — product ID, variant ID, title, price, collection IDs, whether it is in stock and how many units have sold.
What is not sent: no customer name, no email address, no shipping or billing address, no phone number, no payment information, no order total, no free-text the customer wrote. Those fields are not part of the data structure the model receives, so there is no configuration in which they could leak into it.
No decision here produces a legal or similarly significant effect on any individual. It changes which products appear in a block, nothing more.
6. What Encore never does
Stated plainly, because "we may share data with partners" is where most privacy policies stop being useful:
- We do not sell personal data, and we do not share it for cross-context behavioural advertising.
- We do not build shopper profiles that span more than one merchant. Every record is scoped to a single store and is queried that way.
- We do not use merchant or shopper data to train AI models, our own or anyone else's.
- We do not place tracking pixels or advertising cookies on your storefront.
- We do not modify, cancel or refund your orders — we hold no permission that would allow it.
7. Sub-processors and sharing
We use a small number of sub-processors to run the service. We do not disclose personal data to anyone else, except where we are legally required to.
| Sub-processor | Purpose | Data involved |
|---|---|---|
| Shopify | The platform Encore runs inside; source of order and product data, and the billing processor. | All of it — you are already their customer. |
| [Database provider] | Hosts the MongoDB database holding events, survey answers and block configuration. | The records listed in section 3. |
| [Hosting provider] | Runs the Encore API servers. | Data in transit and in server logs. |
| Google (Gemini API) | Ranks recommendation candidates on paid plans. | Only the product fields listed in section 5. No shopper identifiers. |
| Google (Analytics 4) | Counts visits to this marketing website only — see section 12. | Page views plus coarse device and country data for site visitors. No merchant, order or shopper data. |
A Data Processing Addendum is available to merchants on request — write to onefoundry.labs@gmail.com and we will send the current version.
8. International transfers
Encore's servers run in [Hosting region] and its database in [Database region]. Where a sub-processor is located outside the EEA or the UK, the transfer is covered by the European Commission's Standard Contractual Clauses together with the transfer safeguards that provider offers.
The Gemini API call is the only routine transfer of processing outside our own infrastructure, and it carries no shopper identifiers.
9. Retention and deletion
Block events, survey answers and block configuration are kept for as long as the app is installed, because they are what your analytics and A/B results are built from. Deleting them would empty the dashboard you are paying for.
When you uninstall Encore, this happens automatically:
- Immediately — Shopify revokes the access token and we delete both the access token and the refresh token from our records. A credential we cannot use is a credential worth keeping only for someone who should not have it.
- Roughly 48 hours later, when Shopify sends
shop/redact— every event, every survey answer, every block configuration and the shop record itself are deleted. Not most of them: all of them.
Reinstalling within that window keeps your blocks, which is the reason for the delay rather than an oversight.
Server logs, which may contain store domains and IP addresses, are retained for [Log retention period].
10. Shopify data requests
Every Shopify App Store app must answer three mandatory compliance webhooks. Encore is subscribed to all three and none of them is answered with an empty acknowledgement, because Encore genuinely does hold data in scope — every event row carries an order ID.
| Webhook | What Encore does |
|---|---|
| customers/data_request | Retrieves every record held for the orders named in the request, scoped to the store that asked, so the merchant can pass it to the shopper. |
| customers/redact | Deletes every event and every survey answer belonging to the orders named. |
| shop/redact | Deletes all events, survey answers, block configuration and the shop record. |
If you are a shopper rather than a merchant, the store you bought from is your point of contact — they are the controller of your data. They can raise the request with us and we will act on it.
11. Security
- All traffic is served over HTTPS.
- Shopify access tokens are encrypted with AES-256-GCM before they reach the database. If the key is lost or rotated, an unreadable token simply reads back as “no token” and a fresh one is minted on the next app load — the failure mode is a reconnection, not exposure.
- Incoming webhooks are verified by HMAC signature against the app secret; a request that fails verification is rejected before it is parsed.
- Every query is scoped to a single store domain, so one merchant's data cannot be returned to another.
- Admin requests are authenticated with Shopify session tokens.
No system is perfectly secure. If you believe you have found a vulnerability, please write to onefoundry.labs@gmail.com before disclosing it publicly, and we will work with you on a fix.
12. Cookies on this website
This marketing website loads Google Analytics 4 (measurement ID G-85H6SSQS06) so we can count visits and see which pages actually get read. It sets Google's _ga and _ga_* cookies, which hold a randomly generated identifier and expire after two years. Google Analytics 4 does not record IP addresses — it uses them in transit to infer an approximate country, then discards them.
We set no cookies of our own, run no advertising or remarketing scripts, and do not use this data to build a profile of you. The only other third-party request the site makes is to Google Fonts for the typeface.
The Encore app inside your Shopify admin uses the session mechanism Shopify provides for embedded apps. The blocks rendered on your storefront set no cookies and store nothing in the shopper's browser.
13. Merchant responsibilities
You are the controller of your shoppers' data, which means a few things are yours to do:
- Disclose in your own privacy policy that a post-purchase app processes order references and, if you enable a survey block, survey answers.
- Word open survey questions so they do not invite personal or sensitive information.
- Forward shopper data requests to us where they concern data Encore holds.
- Make sure any discount code or offer you configure is accurate and honoured — Encore displays what you configure, it does not validate your commercial terms.
This page describes how the software behaves. It is not legal advice, and it is not a substitute for your own privacy notice.
14. Changes and contact
If we change this policy in a way that materially affects how your data is handled, we will notify installed merchants before the change takes effect.
Questions, requests and complaints: onefoundry.labs@gmail.com. If you are in the EEA or the UK and are not satisfied with our response, you have the right to complain to your local data protection authority.
Still have a question?
Data questions get answered by a person, not a form.