This agreement is between Grovlix LTD, a private limited company registered in England and Wales (company number 17552126), Suite 2309, 60 Tottenham Court Road, Area 1/1, Fitzrovia, London, W1T 2EW, United Kingdom ("we", "Grovlix", "PopupSnap"), and the merchant who installs Lucky Wheel on a Shopify store ("you"). It forms part of our Terms of Service (and of their Arabic version) and applies to personal data we process for you when you use Lucky Wheel on Shopify.
Roles
1.1 For the data of your store's shoppers that Lucky Wheel collects or handles for you (section 3), you are the controller and we are the processor (Terms, "Your content and your shoppers' data"; Privacy Policy, "Lucky Wheel on Shopify").
1.2 For your own account and store data (your shop domain, plan, contact email, install dates, usage counts), we are a controller and the Privacy Policy applies.
1.3 Shopify is an independent controller for the data it holds about you and your customers. This agreement does not cover Shopify's processing.
1.4 "Data protection law" means the UK GDPR and the Data Protection Act 2018, and the EU GDPR where it applies to you or your shoppers.
Our commitments as processor
We will:
- process shopper data only on your documented instructions, which are: use of the app as you set it up (including viewing, searching and exporting your leads in the app), and the requests you or Shopify send us (including Shopify's privacy webhooks). We tell you if we think an instruction breaks data protection law;
- make sure the people who can access it are bound by confidentiality;
- apply the security measures in Annex 2;
- use the sub-processors in Annex 3 and follow section 5;
- help you answer shoppers' requests (access, deletion and others) as in section 6;
- tell you about a personal data breach as in section 7;
- delete the data as in section 8;
- give you the information needed to show we follow this agreement, and allow audits as in section 9.
The processing
- Subject matter and purpose: running your lucky-wheel popup: one spin per person, drawing the prize, issuing the discount code, showing you your leads, saving the shopper as a customer in your Shopify store if customer saving is turned on for your store, and answering privacy requests.
- Duration: while the app is installed, plus the retention periods in Annex 1.
- Data subjects: your store's shoppers who use the wheel.
- Data: the email address and phone number the shopper types (only the fields you switch on), whether they ticked the email and SMS marketing boxes and when, the spin time, result, prize, code and code expiry date, Shopify's customer id (if signed in), and one-way keyed hashes of the email, phone number and a random device token. We do not store name, address or IP address with the spin or the lead. Details: Annex 1.
- Special categories: none requested.
Your responsibilities
You decide which fields the wheel asks for, you tell shoppers about the processing in your own privacy notice, and you make sure you have a lawful basis, including for the marketing consent you ask for. You are responsible for the prize rules and promotion law that apply to your wheel (Terms, "Rules for specific apps").
Sub-processors
5.1 You agree that we use the sub-processors listed in Annex 3.
5.2 We tell you at least 14 days before we add or replace a sub-processor, by email to your shop's contact email address and by updating the list in Annex 3 on this page. You may object on reasonable data protection grounds in that time; if we cannot meet the objection, you may uninstall the app.
5.3 On request we give you the current list: support@popupsnap.com.
5.4 We remain responsible for our sub-processors.
Shoppers' requests and Shopify's privacy requests
6.1 We subscribe to Shopify's customers/data_request, customers/redact and shop/redact webhooks, verify their signature, and act on them (Annex 1).
6.2 On customers/data_request we prepare an encrypted export of the shopper's wheel data for you, available in the app for 7 days. On customers/redact we delete that shopper's spins and leads on your shop's wheels. On shop/redact we delete everything held for your shop.
6.3 If a shopper contacts us directly, we pass the request to you and do not answer it ourselves except to say we have done so, unless the law requires us to. We may not find records of a shopper who used a different phone format or a guest checkout; in that case we search by the details you or they give us.
6.4 Customer records, tags and metafields we wrote into your Shopify store are in your Shopify account. We do not delete them; you do.
Personal data breach
We tell you without undue delay after we become aware of a personal data breach affecting your shoppers' data, and in any case within 48 hours, and give you what we know: what happened, the data and number of records involved, likely effects, what we have done and what we suggest you do. We also notify Shopify within 24 hours, as Shopify's API terms require. We follow a written incident response procedure. You decide whether to report to your regulator and to shoppers; we help.
Deletion and return
8.1 During use: spins and leads are deleted 24 months after each one was created, by a daily job.
8.2 After uninstall: your shop's data is deleted 48 hours after you uninstall (or when Shopify's shop/redact request arrives, whichever is first), unless you reinstall in that time.
8.3 Backups: copies in our backups are replaced as new backups are made. We keep 7 daily copies, so a deleted record can remain in a backup for about 7 days. Backup copies made before 4 November 2026 are being deleted; until then a deleted record can remain in them.
8.4 We keep nothing after that unless the law requires it. In every case this is within the 30 days that Shopify's API terms allow.
8.5 Data in your Shopify store stays there (6.4).
Information and audits
We answer reasonable written questions about our processing and give you our current security and sub-processor information. We do not allow on-site audits, except where the law or a regulator requires one; then it takes place with reasonable notice, in business hours, at your cost and under confidentiality. We do not hold a third-party security certification.
International transfers
Our servers are in France (EU). Some sub-processors work in other countries, including the United States (Annex 3). For transfers we rely on the adequacy arrangements between the UK and the EU, the EU-US Data Privacy Framework where the provider is certified, and otherwise standard contractual clauses. The Privacy Policy, "International transfers", says the same in general terms.
Liability, term and governing law
The limitation of liability in the Terms applies to this agreement. The agreement lasts as long as we process shopper data for you. It is governed by the law of England and Wales (Terms, "Governing law").
Language
This agreement is written in English and translated into Arabic. If the two versions differ, the English version governs.
Annex 1: Description of the processing
| Item | What the app does |
|---|---|
| Fields collected | Email and phone number: each one required, optional or off, per wheel, as you set it. Both marketing boxes start unticked. |
| Stored encrypted | Email and phone number (AES-256-CBC, with a key used only for Lucky Wheel). Shopify's access tokens, queued privacy-webhook bodies and data-request exports are encrypted with a separate key. |
| Stored as a keyed hash | Email, phone number and device token (HMAC-SHA256), to allow one spin per person and device and to find a shopper's records for a privacy request. |
| Shown to you | The Leads page in the app lists your shop's leads, searches them by a whole email address or phone number, and exports them as a CSV file that is streamed to your browser and not kept on our servers. |
| Sent to Shopify | Only if customer saving is turned on for your store: email, phone number, marketing consent, the winner tag and the prize metafields. The wheel in the shopper's browser may also pass the email or phone number to Shopify's Visitors API when the shopper's cookie choice in your store allows analytics. |
| Not stored | Name, postal address and IP address. |
| Retention | Spins and leads: 24 months after each one was created. Your shop's data: 48 hours after uninstall. Data-request export: 7 days. Records of privacy requests (no shopper details): 90 days. Application logs: 14 days. Backups: 7 daily copies. |
| Privacy webhooks | customers/data_request, customers/redact and shop/redact, each verified with Shopify's HMAC signature before we act on it. |
Annex 2: Security measures
- Encryption in transit: popupsnap.com, including the wheel's requests that Shopify forwards from your store's /apps/luckywheel address, is served over HTTPS only. Plain HTTP is redirected to HTTPS, and browsers are told to use HTTPS for a year (HSTS).
- Encryption at rest: shoppers' email and phone number are encrypted field by field (AES-256-CBC) with a key used only for Lucky Wheel, not the key used elsewhere in PopupSnap. The keys are not stored in the database. Shopify's access tokens, queued privacy-webhook bodies and data-request exports are encrypted with a separate key.
- No unencrypted fallback: if the encryption keys are missing, the app refuses the spin instead of storing the data unencrypted.
- Each shop sees only its own data: every request from the app in your Shopify admin is tied to the shop in the session token that Shopify signs; storefront requests are accepted only with a valid Shopify app proxy signature; privacy webhooks are accepted only with a valid Shopify HMAC signature.
- Access log: every time you view, search or export your leads, and every time our staff read shopper data with our staff tool, an entry (who, when, shop, action or reason, number of records) is written to an access log before any data is decrypted. The log holds no shopper data. Our staff have no screen that shows shoppers' email addresses or phone numbers.
- Server access: our servers accept SSH logins with keys only; password and root logins are turned off. The application runs under its own system account.
- Staff accounts: two-factor authentication is on for our staff accounts at Shopify Partners, GitHub, Cloudflare and Google.
- Logs: the app's log entries record ids, shop domains and error types, not shoppers' email addresses or phone numbers. Log files are deleted after 14 days.
- Error monitoring: before an error report leaves our server, shoppers' email address, phone number, device token, Shopify customer id and the request signature are removed from it, and reports from the wheel and from the app in your Shopify admin carry no IP address.
- Backups: The database is backed up every day. Since 4 November 2026 each backup file is encrypted on our server before it is uploaded to Google Drive, and the decryption key is not kept on that server. We keep the last 7 daily copies; older ones are deleted. Inside the copies, shoppers' email and phone stay encrypted as in the live database.
- Incidents: we follow a written incident response procedure (section 7).
Annex 3: Sub-processors
These are the outside companies that receive or store your shoppers' data when you use Lucky Wheel on Shopify.
| Sub-processor | What for | Shopper data it handles | Where |
|---|---|---|---|
| Contabo GmbH | Hosting: the servers that run the app, its database, queue and logs | All of it (email and phone number encrypted, hashes, spins) | France (EU) |
| Cloudflare, Inc. | DNS, content delivery, firewall and HTTPS in front of popupsnap.com | Every request passes through it, including the email and phone number in a spin request | Global network, including the United States |
| Google LLC (Google Drive) | Off-server copies of the database (7 daily copies) | Database copies: email and phone number encrypted, hashes, spins | Google's data centres, which may be outside the UK and EU |
| SmartBear Software (Bugsnag) | Error monitoring | Error reports with email, phone number, device token, Shopify customer id and IP address removed; they can include your shop's domain | The provider's data centres, which may be outside the UK and EU |
| Discord Inc. | Internal alerts about errors to our team | The first 240 characters of an error message and the page address; not meant to contain shopper data | The provider's data centres, which may be outside the UK and EU |
Shopify is not a sub-processor: it is an independent controller. It receives the shopper's email and phone number when customer saving is on, and through its Visitors API as described in Annex 1.
Lucky Wheel on Shopify sends your shoppers' data to no analytics, advertising, email-marketing, payment or AI provider. For your own account data, where we are the controller (1.2), we also use Resend, an email delivery provider, to send the plan-limit emails to your shop's contact email address; it receives no shopper data.