Zoomifi - Sales Popups Privacy policy

Last updated: October 12, 2026

Zoomifi - Sales Popups (“the App”) provides sales notification and social-proof popups (“the Service”) on your Shopify storefront. This Privacy Policy describes how personal information is collected, used, and shared when you install or use the App in connection with your Shopify-supported store.

Personal information the app collects

When you install the app, it asks Shopify for read access to your orders and products. We use your orders to build sales popups, and your products to show product names, images and links. You add the popups to your storefront by turning on the Sales Popups app embed in your theme editor. Stores that installed an older version may still load our script through a script tag until they switch to the app embed.

About you: your store name and domain, and the name and email of the store owner or staff member who installs the app, as provided by Shopify. We also keep your plan and billing status, and any messages you send us.

About your customers, from your orders: order number, city, region, country, products and order totals. We keep the customer's first name only if your popups show buyer first names (Hide buyer first names is off). We don't request or keep your customers' email addresses or phone numbers, and we don't keep their last names or street addresses. We delete this order data 60 days after the order date.

Popups show other shoppers the customer's city, region and country, the product and when it was bought. They show the customer's first name only if Hide buyer first names is off; otherwise they say "Someone" or your own wording. The setting is on for new installs. We delete popup data after 60 days.

About storefront visitors, only when Shopify's Customer Privacy API reports that the visitor allows analytics:

• We use the visitor's IP address to give them a random visitor code. The link between the IP address and the code is deleted within about two days.
• We keep the visitor code, not the IP address, with records of popup clicks, so we can match a click to a later add-to-cart. We keep these click records until you uninstall the app. Some older click records also hold the buyer's first name, city and country from the order; we clear those 60 days after the record was made.
• For add-to-cart popups we use an approximate city, region and country for the visitor, which our network provider, Cloudflare, works out from the IP address.
• We also keep daily totals of popup impressions, clicks and closes, and the storefront activity counts described below.

Cookies and logs

After a visitor allows analytics, the Sales Popups script sets these on your store's domain: a cookie holding the visitor code (1 day), a count of popups seen (up to 7 days), and a "popup hidden" flag (7 days). It also keeps the visitor code in the browser's local storage. The script loads jQuery from code.jquery.com.

Our servers keep standard technical logs of requests, including the IP address, for security and troubleshooting.

If our servers can't finish a task, such as processing a new order, we keep a record of the failed task so we can fix the problem. The record holds only the data the task needed, such as the order details listed above. We delete these records every day once they are 7 days old.

Storefront activity counts

When Product views popups are enabled and a visitor allows analytics, we count views of a product page. We exclude identifiable crawlers and merchant previews. We show a count only after at least five measured views within the last 24 hours, and say “views”, never “people” or “viewing now”. A one-way code made from the request's network address (an IPv4 address or IPv6 /48) prevents repeated requests for the same product from counting again for 24 hours; it is held only in the cache, never with the counts. The counts hold the product and time, with no visitor identifier. We delete view counts older than 48 hours. If a store uninstalls Sales Popups, its remaining counts are deleted when Shopify asks us to erase that store's data, normally 48 hours after uninstall.

The Activity card in the app shows you three daily totals for your store: popups shown, clicks on popups, and products added to cart after a popup click. The Sales Popups script on your storefront counts these events in the shopper's browser and sends us only the totals. On the Standard plan the app also shows the value of items added to cart after a popup click: with that count, the script sends the cart price of those products, taken from your store's own cart response, and the cart's currency.

We also use these events for our own analysis of how often popups should appear and whether they help. This isn't shown in the app. It has two parts: a summary of each visit (how many pages and popups the shopper saw, and how many popups they clicked or closed and products they added to cart), and orders that include a product the shopper clicked in a popup, matched using a one-way code.

• We count only when Shopify's Customer Privacy API reports that the shopper allows analytics. Shopify decides this from the shopper's cookie banner choice and your store's privacy settings for their region. If analytics isn't allowed, nothing is counted or sent. If the shopper withdraws consent before pending counts are sent, those counts are discarded.
• We store the counts and values only as totals per store per day (values per currency). We don't store the shopper's IP address, browser or device details, cookies, the products or cart lines, or any identifier for the shopper with these totals.
• To tell whether an add-to-cart followed a popup click, the shopper's browser keeps the IDs of up to 10 products they clicked in a popup, for 30 minutes, in that tab's session storage. These product IDs are sent to us only with a cart code, as described below, and the browser clears them when the tab is closed.
• For the visit summary, the browser keeps a random visit code and the visit's counts in that tab's session storage, never in a cookie, and sends them as the shopper moves between pages, with whether the screen is phone-sized. It also notes whether a clicked popup showed the product being viewed, whether the viewed product was added to cart, how soon the first popup appeared, whether the shopper left soon after a popup, and your store's popup timing settings. A visit ends after 30 minutes without a page view. We keep each visit's summary for a few hours, then only as totals per store per day.
• For orders after a popup click: when the shopper adds a product they clicked in a popup to the cart, the browser sends us a one-way code made from the cart's identifier, never the identifier itself, with the clicked product IDs and how long ago they were clicked. When your store receives an order from that cart, we record only the order date, currency and subtotal, the subtotal of the clicked products, and the time from the click to the order. We don't keep the order number, the customer or their address with it. Codes that match no order are deleted after 7 days.
• The requests carry no cookies. Like any web request, they reach our servers with the shopper's IP address. We use a shortened one-way hash of it for about a minute to limit abuse, and we don't record these requests in our web server logs.
• We delete the counts and values, visit summaries, cart codes and matched orders when you uninstall the app or when Shopify asks us to erase your store's data, and we delete those older than 400 days.
• The counts show activity. They don't measure sales caused by popups, and the app doesn't show purchases. The value is the cart price of products added to cart, not revenue.

How we use your personal information

We use this information to provide and improve the app and to contact you about it. We don't sell personal information, and we don't use your customers' information for advertising.

Sharing your personal information

We share information only with service providers that help us run the app: Shopify, Amazon Web Services (hosting and email) and Cloudflare (network, content delivery, and approximate visitor location). We also share it when the law requires.

We share your store's lifecycle details (install, uninstall, plan and billing status) and contact details (store name, owner name, and your email address if you agreed to receive email from us) with Zoomifi's merchant portal, which we use for account and support communications.

Where your data is stored

We host the app and store its data with Amazon Web Services in the us-east-1 region, in the United States.

Finally, we may also share your personal information to comply with applicable laws and regulations, to respond to a subpoena, search warrant or other lawful request for information we receive, or to otherwise protect our rights.

Shopify privacy requests and uninstalling

When Shopify sends us a customer data request while the app is installed, we email your store's contact address the data we hold for that customer's orders, or a short note that we hold none. We delete order data after 60 days anyway. When Shopify asks us to erase a customer's data, we clear their name and location from our order, popup and click records, and delete any failed task records for their orders. When you uninstall, we delete your store's popup data, order data, click records and activity counts. When Shopify sends its store erasure request, 48 hours after you uninstall, we delete the remaining data for your store except the minimal record described below.

If your store receives free access to paid features, we keep a one-way keyed code of its Shopify domain and the access policy after erasure to prevent repeated free access. This record contains no store domain, store ID, dates, settings or customer information.

Your rights

If you are a European resident, you have the right to access personal information we hold about you and to ask that your personal information be corrected, updated, or deleted. If you would like to exercise this right, please contact us through the contact information below.

Additionally, if you are a European resident we note that we are processing your information in order to fulfill contracts we might have with you (for example if you make an order through the Site), or otherwise to pursue our legitimate business interests listed above. Additionally, please note that your information will be transferred outside of Europe, to the United States, where our servers are hosted (Amazon Web Services, us-east-1 region).

Changes

We may update this privacy policy from time to time in order to reflect, for example, changes to our practices or for other operational, legal or regulatory reasons.

Contact us

For more information about our privacy practices, if you have questions, or if you would like to make a complaint, please contact us by email at [email protected].