Phyn Privacy Policy

Effective date: September 6, 2026

Phyn provides Shopify merchants with discount, bundle, synchronization, upsell, migration, and analytics functionality. This policy describes the information Phyn processes when merchants install and use the Phyn Commerce Engine application.

Information Phyn processes

Phyn processes merchant store configuration, Shopify resource identifiers, promotion and bundle configuration, synchronization metadata, and limited commerce information needed to provide merchant analytics and offer attribution. Phyn is designed to avoid persisting customer names, email addresses, phone numbers, physical addresses, or complete Shopify customer profiles for analytics.

Specific Customers targeting. When a merchant configures a discount for specific customers, Phyn may retrieve customer names and Shopify customer identifiers from Shopify so the merchant can identify and select eligible customers. Customer names are used to render the merchant-facing selector and are not persisted by Phyn for this purpose. Phyn stores the selected Shopify customer identifiers in the promotion configuration so the requested eligibility can be published and enforced. Phyn does not require customer phone numbers or physical addresses for this feature.

For storefront analytics, Phyn may process anonymous browser-session identifiers and events such as offer viewed, started, completed, added to cart, unlocked, or dismissed. These identifiers are used to calculate aggregate funnels and performance and are not intended to identify a shopper.

Purposes

Phyn uses information only to operate the services requested by merchants, including configuring and publishing discounts and bundles, enforcing merchant-selected eligibility, presenting eligible storefront upsells, calculating merchant-facing analytics, diagnosing synchronization failures, securing the service, and complying with legal or Shopify platform requirements.

Data minimization and retention

Phyn requests and retains only the data needed for enabled product functionality. Raw storefront analytics events are retained for up to 14 days by default and then deleted after processing. Processed Shopify webhook records are retained for a limited operational period (30 days by default). Order-level analytics facts, when enabled, are retained for up to 400 days by default. Protected-customer-data access audit records are retained for up to 400 days by default and contain no customer names, email addresses, phone numbers, addresses, or customer IDs. Aggregate non-identifying performance metrics may be retained according to the merchant's analytics entitlement.

Customer privacy choices

Phyn storefront behavioral analytics respects Shopify Customer Privacy API analytics-processing decisions. When Shopify indicates that analytics processing is not allowed, Phyn does not emit behavioral analytics events for that visitor. Phyn does not sell personal data or use customer data for targeted advertising.

Security

Phyn uses encrypted transport for production network traffic and requires production deployments to use encrypted storage and encrypted backups for systems containing merchant or protected customer data. Shopify access and refresh tokens are encrypted by the application before database storage. Production and development/test data are separated, production access is restricted to authorized personnel, and access to Shopify protected customer directory data used by Specific Customers targeting is recorded in a PII-free audit trail.

Privacy requests and deletion

Phyn implements Shopify's mandatory privacy webhooks and applies retention and deletion controls to data held by the service. Customer redaction workflows remove matching Phyn-held commerce facts and correlated behavioral records where applicable. Shopify shop-redaction requests delete the merchant tenant and associated application data subject to limited compliance records that must be retained for legal or security purposes.

Service providers

Phyn may use infrastructure providers to host the application, database, encrypted backups, logging, and related operational services. Providers are limited to processing information necessary to deliver Phyn and are required to provide appropriate security protections for the services they supply.

Merchant agreements

Use of Phyn is governed by the Phyn Terms of Service and the Phyn Data Processing Addendum, which describe the parties' responsibilities for processing merchant and customer personal data.

Changes and contact

Phyn may update this policy as the product evolves. Material changes will be reflected by updating the effective date. Privacy or data-protection requests can be sent to privacy@phynapps.com.