Privacy Policy

This policy applies to popupsnap.com and the apps under the PopupSnap umbrella on the site: Popups, Product Studio, Lucky Wheel, Countdown, InstaFeed, Product Badges and PopAutomate.

Data we collect

We collect specific kinds of data to provide and improve our services:

• Account data: name, email address and store name when you create your account.
• Store data: store and product information we need to show popups and badges (through the Salla or Zid API).
• Usage data: statistics such as popup views, clicks and conversion rates, to improve your campaigns.
• Visitor data: anonymous information about your store's visitors (device type, browser, pages) so popups can be targeted accurately.
• Contact data: support conversations and emails, so we can answer your questions.

How we use your data

We use the data we collect to:

• provide the PopupSnap services and run the apps in your store;
• show statistics and performance reports for your marketing campaigns;
• improve the user experience and build new features;
• send important service updates (such as changes to the terms or new features);
• provide technical support and answer your questions;
• prevent fraud and protect the security of the platform.

We do not sell your personal data to any third party. We use data only to run and improve our services.

Cookies

We use cookies and similar technologies to improve your experience:

• Essential cookies: needed for the platform to work, to sign you in and to save your settings.
• Analytics cookies: help us understand how the platform is used so we can improve it (for example Google Analytics).
• Performance cookies: used in your store to track popup displays and avoid showing the same popup repeatedly to the same visitor.

You can control cookie settings in your browser, but disabling some of them may affect how the service works.

Third-party services

We work with trusted third-party services to provide ours:

• Salla: we integrate with the Salla API to show products and badges and to process purchase notifications. The data exchanged is also subject to Salla's privacy policy.
• Zid: we integrate with the Zid API in the same way. The data exchanged is also subject to Zid's privacy policy.
• Analytics services: we use Google Analytics and similar tools to understand usage patterns and improve the service.
• Payment services: for apps installed from Salla, Zid or Shopify, payments are made directly through that platform's app store, and we do not store card data. For direct InstaFeed subscriptions (WooCommerce and websites), Paddle handles payment as described in Part B.
• Email services: we use email services to send important updates and notifications.

Data protection

We take security measures to protect your data:

• encryption of data in transit with HTTPS/SSL;
• one-way hashing of passwords (bcrypt);
• access to data limited to the staff who need it;
• continuous monitoring of our systems and detection of suspicious activity;
• regular backups to protect data from loss.

Although we take every reasonable precaution, no electronic system can be guaranteed 100% secure. We recommend strong, unique passwords.

Your rights

You have the following rights over your personal data:

• Access: you can ask for a copy of the personal data we hold about you.
• Correction: you can edit your personal data in the dashboard at any time.
• Deletion: you can ask us to delete your account and data. We delete the data within 30 days of the request.
• Unsubscribe: you can stop receiving marketing emails at any time.

To use any of these rights, contact us by email or WhatsApp. Because Grovlix Unipessoal LDA is registered in Portugal, the EU GDPR applies to the data we control (see the GDPR section in Part B). Our compliance with the Saudi Personal Data Protection Law (PDPL) is described on the data protection page (Arabic).

Data we collect from merchants

• Account data: your email address, name (if you give it or your platform shares it), and login details handled by our authentication provider. We never see passwords in clear text.
• Instagram and TikTok details: the public handles you enter (or accounts you connect), and the public posts, captions, videos, thumbnails and public counts we retrieve for them. We keep copies of public content and of the related videos and thumbnails on our own servers so your widget loads quickly.
• Widget settings, product tags, curation choices and usage of the dashboard.
• Support messages and the email or WhatsApp details you give us when you contact us.
• Technical data: IP address, browser type and request logs when you use our site or dashboard, kept for security and troubleshooting.

Data from your store platform

• Salla and Zid: when you install the app we receive your store identifier, store name and domain, the access tokens the platform issues to the app (Salla tokens are stored encrypted; all tokens are kept in an access-restricted database), your subscription status from the platform, and the product catalog we need to let you tag products.
• Shopify: your myshopify.com domain, the app access token (encrypted), the granted scope (read_products), your Shopify subscription status, and, with read_products, product names, descriptions, images and prices so you can tag products on posts. We do not read orders or customer data.
• WooCommerce and WordPress: when you install the PopupSnap plugin and connect your store we receive your store URL, a read-only WooCommerce API key and secret that you authorise (protected with encryption), and your product catalog (names, descriptions, prices, images, categories, stock status and variations). The plugin also sends technical pings: when a product is saved or removed, when the plugin is deactivated or uninstalled, and a daily check that it is still active. We do not read orders or customer accounts, and the key has read permission only.
• Websites with an embed code: the website address where the code runs and the settings you choose.

Payments and Paddle

Merchants who subscribe directly on our website pay through Paddle. Our order process is conducted by our online reseller Paddle.com. Paddle.com is the Merchant of Record for all our orders. Paddle.com is an independent controller of the payment data it collects: your name, email, billing address, tax details and payment method. We do not receive or store your full card number. We receive from Paddle your customer and subscription identifiers, plan, status, billing period dates, country and email. Paddle's use of your data is described in its privacy notice and the Buyer Terms. Merchants billed by Salla, Zid or Shopify pay that platform, not Paddle.

Your store's shoppers (widget data)

The widget runs on the merchant's storefront. It does not use cookies. To count unique visitors it stores one random identifier in the shopper's browser local storage and sends only a hash of that identifier combined with the widget key and the current date, so the value changes every day and does not identify a person. We record event types (such as views, clicks, video plays), the post concerned and the device type, and aggregate them for the merchant's analytics. Where the store platform provides it, interactions such as likes, bookmarks and comments are stored with the shopper's platform display name and identifier. Merchants are responsible for telling their shoppers about this in their own privacy notice and for any consent their local law requires.

Instagram and TikTok content providers

To show a merchant's Instagram and TikTok posts, we retrieve public content through third-party data providers, and through official platform interfaces where available. We send those providers the public username or link the merchant entered. We do not send them merchant account credentials, store customer data or payment data. We are not affiliated with Instagram, Meta or TikTok.

How we use data and our legal bases

• To provide and secure the Service, run your account and support you (performance of a contract, and our legitimate interests).
• To take payments, prevent fraud and meet tax and accounting duties (contract, legal obligation).
• To send service emails such as receipts, trial and renewal notices, security alerts and, if you enabled them, weekly analytics reports (contract, legitimate interests).
• To understand and improve how the dashboard is used (legitimate interests, or consent where the law requires it).
• To send product news or offers, only where you agreed or the law allows; you can unsubscribe at any time (consent, legitimate interests).

Who we share data with (sub-processors)

We do not sell personal data. We share it only with service providers that help us run the Service, under contracts that limit their use of it:

We may also disclose data where the law requires it or to protect our rights. If we are part of a merger or sale, data may transfer to the new owner under this policy.

International transfers

Our providers operate in several countries, so your data may be processed outside your own country. Where the law requires it, we use safeguards such as standard contractual clauses or equivalent approved mechanisms.

Cookies and local storage on our site

On instafeed.popupsnap.com we use storage that is necessary to keep you signed in and to remember your language and theme, a short attribution cookie (ps_attr) recording the page and campaign parameters you arrived from, and analytics tools (PostHog and Google Tag Manager) on our own site. You can block or delete these in your browser; some parts of the dashboard will then not work.

How long we keep data

We keep account and store data while your account is active. When you uninstall the app or delete your account we stop syncing and delete or anonymise your store data after a reasonable period, except records we must keep for tax, accounting, fraud prevention or legal claims. Aggregated analytics that no longer identify you may be kept.

Your rights

Depending on where you live (including under the GDPR, the UK GDPR and the Saudi Personal Data Protection Law), you may have the right to access, correct, delete or export your personal data, to object to or restrict some processing, to withdraw consent, and to complain to your data protection authority. Email support@popupsnap.com and we will respond within the time the law requires. For payment data held by Paddle, you can also contact Paddle.

GDPR: legal bases and your rights in the EU and EEA

Grovlix Unipessoal LDA is established in Portugal, so the EU General Data Protection Regulation (GDPR) applies to the personal data we control. The Saudi Personal Data Protection Law (PDPL) also applies to merchants and shoppers in Saudi Arabia; Your rights covers both.

We rely on these legal bases (How we use data shows which one applies to each purpose):

• Contract: to create your account and provide, bill and support the Service you asked for.
• Legal obligation: to keep accounting and tax records and answer lawful requests.
• Legitimate interests: to secure the Service, prevent fraud and abuse, and understand and improve how it is used, balanced against your rights.
• Consent: for optional things such as product news or non-essential cookies; you can withdraw it at any time without affecting what happened before.

Under the GDPR you have the right to:

• access the personal data we hold about you and get a copy;
• have inaccurate data corrected (rectification);
• have your data erased ("right to be forgotten"), unless we must keep it by law;
• receive your data in a structured, machine-readable form and have it transferred to another provider (portability);
• object to processing based on our legitimate interests, and to direct marketing at any time.

To use any of these rights, email support@popupsnap.com from the address on your account. We may ask you to confirm your identity and will answer within one month, as Article 12(3) of the GDPR requires. For complex or numerous requests the law allows us to extend that period by up to two further months; if we do, we will tell you within the first month and explain why. You also have the right to complain to the supervisory authority. In Portugal that is the Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt, or the authority in the EU country where you live or work.

Security

We use encryption in transit, encryption of Shopify, Salla and WooCommerce credentials at rest, restricted access to our database, and monitoring. No system is completely secure, so we cannot guarantee absolute security.

Children

The Service is for businesses and is not directed to people under 18. We do not knowingly collect personal data from children.

Changes to this policy

We may update this policy from time to time. We will tell you about material changes by email or with a notice in the dashboard. If you keep using the service after an update, you accept the new terms.

Contact us

If you have any question about this privacy policy:

• WhatsApp: contact us on WhatsApp
• Email: support@popupsnap.com
• Data controller: Grovlix Unipessoal LDA, a company registered in Portugal, Rua Dom Afonso Henriques, Número 132, 4950-854 Monção, Viana do Castelo, Portugal, NIPC 518316327

Our team is ready to answer your questions at any time. See also the Terms of Service and Refund Policy.