Privacy policy

At a glance

In short: These summaries are here to help you. They are not a complete statement of how we handle data. If a summary and the full text differ, the full text applies.

• Commit & Push makes Shopify apps. Our first app is Discount Magic.
• We never sell personal data and we don’t use it for advertising.
• For your store’s customers, we only process their data to run the app for you, on your instructions.
• We only send you marketing emails if you ask for them, and you can unsubscribe at any time.
• When you uninstall one of our apps, we delete your store’s data within 30 days of Shopify’s erasure request, and the last copies in logs, error reports and backups within 90 days. We keep a few records for longer, such as billing records (Uninstalling and deletion lists them).
• Our apps store data in the United States. Where your data is lists each location. Where data leaves the UK or EU, we use approved legal safeguards.
• You can contact us about your data at privacy@commitandpush.io.

Which part applies to you

This policy covers our websites (commitandpush.io and discountmagic.app), our Shopify apps, and how we deal with you through the Shopify App Store. Part A applies to everyone. The other parts add detail for particular situations.

Each app has its own page, which applies in addition to this policy:

• Discount Magic

Part A: Everyone

Who we are

In short: Commit & Push is a small UK company. You can reach us by email or post.

Commit & Push is Commit & Push Ltd, a company registered in England and Wales (company number 17515624) with its registered office at 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom. In this policy, “we”, “us” and “our” mean Commit & Push.

• Email: privacy@commitandpush.io
• Post: 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom
• UK Information Commissioner’s Office registration: ZC272983
• Our representative in the European Union: Prighter EU Rep GmbH, Schellinggasse 3/10, 1010 Vienna, Austria

We have not appointed a data protection officer, because the law does not require one for a business like ours. The contact details above reach the person responsible for privacy at Commit & Push.

Representative

We value your privacy and your rights as a data subject and have therefore appointed Prighter Group with its local partners as our privacy representative and your point of contact for the following regions:

• European Union (EU)

Prighter gives you an easy way to exercise your privacy-related rights (e.g. requests to access or erase personal data). If you want to contact us via our representative, Prighter or make use of your data subject rights, please visit the following website: https://app.prighter.com/portal/commit-and-push-ltd

Our two roles

In short: For your own account and our websites, we decide how data is used. For your customers’ data, we only follow your instructions.

Data protection law gives different responsibilities depending on who decides how personal data is used.

• We are the controller when we decide why and how data is used. That covers visitors to our websites, merchants, their staff and the agencies and freelancers who work on their stores and use our apps, people who contact us, and people who sign up for our news.
• We are a processor (a “service provider” under some US laws) when we handle personal data about a merchant’s own customers so that our app can work for that merchant. The merchant is the controller of that data and decides what happens to it. Our Data Processing Addendum sets out our commitments to merchants for this data.

We receive personal data in these ways:

What we use data for, and our legal bases

In short: We use data to run our apps and websites, support you, keep things secure, improve our products and, only if you agree, send you marketing.

UK and EU data protection law, and similar laws elsewhere such as Brazil’s, require a legal basis for each use of personal data. Here are ours. Laws in other places, such as the United States and Canada, work differently; see Regional information for what they require.

Where we rely on legitimate interests, we have weighed them against your rights and kept the data to what we need. You can object at any time (see Your rights).

To use our apps, we need your store details and the details Shopify gives us about you and your staff, and each app needs the store data described on its page; without them the app can’t work. Everything else is optional: onboarding questions, marketing emails and website analytics. If you don’t give us optional information, you can still use our apps in full.

Sharing and suppliers

In short: We use trusted suppliers to host and run our services. We don’t sell your data or share it for advertising.

We share personal data only in these cases:

• Suppliers who work for us, such as hosting, database, email and error-monitoring providers. They may only use the data to provide their service to us, under written contracts that protect it. Our full list, with what each one does and where, is on our sub-processor page.
• Shopify, which runs the platform our apps integrate with. Shopify is responsible for its own use of data under its own privacy policy.
• Integrations you choose, such as connecting your own Klaviyo account to Discount Magic. We send data there because you asked us to, and your agreement with that provider governs it.
• Professional advisers, such as accountants or lawyers, where they need it to advise us.
• Authorities, when the law requires it. Unless the law prevents us, we tell affected merchants before we disclose their data, and we push back on requests that aren’t valid.
• A new owner of our business, if Commit & Push or one of its apps is sold or transferred. See Changes to who we are.

We have never sold personal data, and we have never shared it for targeted or cross-context behavioural advertising.

Marketing and our other apps

In short: Marketing emails are opt-in. Our apps installed in the same store can share the store data they get from Shopify, within each app’s permissions.

We send two kinds of email:

• Service messages about your account, billing, security, important changes to an app or to our terms, and replies to your support requests. These are part of the service, so you can’t opt out of them while you use our apps. They never contain marketing.
• Marketing emails, only if you ask for them. When you use one of our apps, you can choose either or both of these, and each stays off until you tick it:
  • App updates: news, new features and tips for the app you use.
  • Commit & Push news: news about our other apps and occasional offers.

For marketing emails we only use your name, email address and store name. We never use your customers’ data, or data we read from your store through Shopify, in our marketing.

Our terms let us name your business as a customer, and show your logo, on our websites and in our marketing without asking first. If you’d rather we didn’t, email privacy@commitandpush.io at any time, including before we ever use it, and we’ll stop and remove it within 30 days.

We may also quote reviews you publish on the Shopify App Store, attributed to your store name as shown there. If you’d rather we didn’t quote your review, email us and we’ll remove it within 30 days. We only publish case studies about you, or use the name or photo of anyone at your business, with your specific permission. Every marketing email has an unsubscribe link, and you can also change your choices in the app or by emailing us. We keep a record of when and how you opted in or out, so we can prove it and respect your choice.

Our apps share one store database. When you install another of our apps and approve the permissions it asks for in Shopify, that app can use store data another of our apps has already received from Shopify, such as products, collections, customers and customer segments, instead of fetching the same data again. Each app only uses data you have given that app permission to read, and only to provide that app to you.

Where your data is

In short: Our apps keep your data in the United States. Support chats, and the account details our support tool uses, are kept in the EU, and emails in Google’s data centres. We look after it from the UK.

Our apps and their short-term cache run on Google Cloud, with our database on PlanetScale, all in the United States. This table shows where each kind of data is kept and for how long. Our sub-processor page gives the same detail for every supplier.

Who can access it. Access to our production systems is limited to the people who need it to run our services. They work from the United Kingdom, sign in with their own accounts and multi-factor authentication, and are bound by confidentiality terms. The AI tools we use to build and run our software have read-only access to our application logs, which are designed to exclude personal data (see AI and automated decisions). Our suppliers’ staff can only access data where they need to in order to provide their service, under their agreements with us.

No copies elsewhere. We don’t copy app data outside the United States, and our backups stay there too. The exceptions, shown in the table, are support chats and the account details our support tool uses (your name, email, role and store details), kept in the EU, and emails.

No choice of region. We keep app data in one country, the United States, because it is close to Shopify’s own platform and to most of our merchants. That keeps the app fast and avoids extra copies of your data. We don’t currently offer a choice of region.

International transfers

In short: Our apps store data in the US. When data leaves the UK or EU, we use legal safeguards approved for that purpose.

We are based in the UK, and our own staff access data from the UK. Our apps store data in the United States. Some suppliers process data in the European Union and, for services delivered through a global network, in other countries. Where your data is lists each location.

When we transfer personal data from the UK, the European Economic Area or Switzerland to a country that those places have not recognised as giving adequate protection, we use one of these safeguards:

• the EU-US Data Privacy Framework, its UK Extension and the Swiss-US Data Privacy Framework, where the supplier is certified; or
• the European Commission’s Standard Contractual Clauses, with the UK International Data Transfer Addendum where UK data is involved.

Where a supplier is certified under the Data Privacy Framework, our agreement with them also includes the Standard Contractual Clauses, so the data stays protected if the Framework stops applying. You can ask us for a copy of these clauses. The safeguard for each supplier is on our sub-processor page.

How long we keep data

In short: We keep data only while we need it. After an uninstall, app data goes within 30 days of Shopify’s erasure request, and the last copies in logs, error reports and backups within 90 days. A few records, listed below, are kept for longer.

We keep personal data only for as long as we need it for the purposes in this policy:

• App data while the app is installed. When you uninstall, we delete it within 30 days of Shopify’s notice, as described in Uninstalling and deletion.
• Support conversations for 2 years after the last message.
• Marketing consent records and unsubscribe records for as long as we send you marketing, and a minimal record of unsubscribes indefinitely so we never email you again by mistake.
• Business and tax records for 6 years after the end of the tax year they relate to, as UK law requires.
• A record that our terms were accepted for your store (which store, which staff account and its role, that they confirmed they could accept on the store’s behalf, which versions, the wording they agreed to, and when), and a record of when each staff member was shown this policy, for 6 years after you stop using all our apps, so we can show what was agreed if there is ever a dispute. Six years is how long a claim about a contract can usually be brought in England and Wales. Because a claim can reach us up to 4 months after it is started at court, and we delete these records in batches, we delete them within 6 months after the 6 years end. If a claim or dispute has started, or we reasonably expect one, we keep the records it needs until it is resolved.
• Website analytics for up to 12 months.
• Analytics on our App Store listings for up to 14 months.
• Statistics that don’t identify any person, store or merchant, such as error rates, may be kept after you uninstall. They contain no names, email addresses, store details or order details.
• Application logs for 30 days, and database backups for 30 days.
• Error reports, and notifications from Shopify that failed to process, for up to 90 days.
• Background job history for 7 days.
• Admin audit logs, which record what our administrators did and contain no customer data, for 1 year.

Each app page sets out that app’s retention periods in detail.

Security

In short: We protect data with encryption, access controls and careful engineering. No system is perfect, and we’ll tell you if something goes wrong.

We protect personal data with measures that fit the risk, including:

• encryption in transit (TLS) and at rest, and extra encryption for access tokens;
• access limited to the people and systems that need it, with multi-factor authentication;
• separate environments, so test systems never use real customer data;
• personal data kept out of logs and analytics wherever we can;
• monitoring, backups and a plan for responding to incidents.

If a breach affects your personal data, we will tell you, and the regulators and Shopify where the law or our agreements require it, without undue delay.

Your rights

In short: You can ask to see, correct, delete or move your data, and object to how we use it. It’s free, and we reply within a month, or tell you if we need longer.

Depending on where you live, you may have the right to:

• get a copy of your personal data;
• correct data that is wrong;
• have your data deleted;
• limit how we use your data;
• receive your data in a portable format;
• object to our use of your data, including an absolute right to object to direct marketing;
• withdraw consent at any time, without affecting what we did before you withdrew it;
• not be subject to decisions made only by automated means that have legal or similarly significant effects (we don’t make any).

To use your rights, email privacy@commitandpush.io. We may ask you to confirm your identity. We reply within one month, or tell you within that month if we need up to two more months for a complex request. There is no charge. You can use an authorised agent where your local law allows it.

If you are a shopper at a store that uses our apps, please contact the store first. See If you shop at a store that uses our apps.

Complaints

In short: Tell us first and we’ll try to put it right. You can also complain to a data protection regulator.

If you are unhappy with how we have handled your personal data, please email privacy@commitandpush.io with “Complaint” in the subject. We acknowledge complaints within 30 days, look into them properly and tell you the outcome without undue delay.

You also have the right to complain to a data protection regulator. In the UK, that is the Information Commissioner’s Office (ico.org.uk). Elsewhere, see Regional information.

Children

Our apps and websites are for businesses and are not directed at children. We don’t knowingly collect personal data from anyone under 16. If you think we have, contact us and we will delete it.

AI and automated decisions

In short: We never use your data or your customers’ data to train AI, and we don’t make decisions with significant effects about you by automated means alone.

• We don’t use merchant data or your customers’ data to train, fine-tune or improve artificial intelligence or machine-learning models, ours or anyone else’s.
• If we add AI-powered features to an app, such as an assistant, we may send the data needed to answer your request to an AI provider. It may only use that data to provide the feature, and may not keep it or use it for training. We will add the provider to our sub-processor list and tell you at least 14 days before it starts.
• We don’t make decisions about people based only on automated processing that have legal or similarly significant effects.
• We use AI tools to help us write, review and run our software. They have read-only access to our application logs, which are designed to exclude personal data. They don’t have access to our database or to your customers’ data.
• Some of our suppliers use AI in their own services, for example to suggest answers in our support tool. They may only process data to provide their service to us, and their use is covered on our sub-processor page.

Changes to this policy

In short: We’ll tell you about important changes at least 14 days before they apply, unless a change is urgent.

We review this policy at least once a year and whenever our services change. The date at the top shows when it was last updated and last reviewed. Every change is listed in our changelog.

If we make a material change, such as using data for a new purpose or adding a supplier that processes your customers’ data, we will tell merchants by email or in the app at least 14 days before it applies. If a change is urgent, for example to keep your data secure or our service running, we will tell you as soon as we reasonably can.

Changes to who we are

If we sell or transfer Commit & Push or one of its apps, the new owner will take over our responsibilities under this policy and will use your data in the same way. We will tell you before this happens, and your rights under this policy will not change. Marketing preferences will move to the new owner only if the law allows it; otherwise we will ask you again.

Part B: Our websites

In short: Our websites work without cookies. Analytics only run if you accept them, and we don’t track you across other sites.

This part covers commitandpush.io and discountmagic.app.

What we collect on our websites

• Page request statistics. When a page loads, we record the page path, the request method, the response status and your browser’s user agent. Each record gets a random identifier that is not linked to you. We don’t include your IP address, the query string, cookies or anything you type. We skip these statistics if you have rejected analytics, or if your browser sends a Global Privacy Control or Do Not Track signal. The first page you load may be counted before you have made a choice.
• Analytics, only if you accept them. We use PostHog to see which pages people visit and on what kinds of device. We record the page, a browser identifier stored in a cookie, your browser and operating system, screen and window sizes, and the website that referred you (just its domain). PostHog discards your IP address, we turn off location lookups, and we don’t create profiles of individual visitors.
• Session recordings, only if you accept analytics. We may record how visitors move around our pages, such as scrolling and clicks, to find and fix problems. Anything you type into forms is hidden, so we don’t see it. Recordings are kept for no more than 30 days.
• Emails you send us. If you email us, we keep your message and contact details to reply and for our records.

PostHog and our hosting provider necessarily see your IP address when your browser connects to them, to deliver and secure their services.

Cookies

We use one cookie that is strictly necessary to remember your choice, and one analytics cookie only if you accept it.

You can change your choice at any time with “Privacy choices” in the footer of each website. If you withdraw consent, we stop collecting analytics and delete the analytics cookie. Analytics already collected is not deleted automatically, but you can ask us to delete it.

We honour Global Privacy Control and Do Not Track signals: if your browser sends one, we don’t run analytics even if you accepted them.

Hosting

Our websites are hosted by Cloudflare, which delivers them from data centres around the world and protects them from attacks. Cloudflare processes connection details, including IP addresses, to do this.

Part C: Our Shopify apps

In short: For your own account we’re the controller. For your customers’ data we’re your processor and only follow your instructions. Uninstalling deletes your data within 30 days of Shopify’s erasure request, and the last copies within 90 days, apart from a few records described below.

How our apps work with Shopify

When you install one of our apps, you give it permission to access certain data in your Shopify store. Shopify shows these permissions before you install. Each app only asks for what it needs, and each app’s page explains what it accesses and why:

• Discount Magic

For your store and the staff and collaborators (such as agencies and freelancers) who use the app, we are the controller. For your customers and their orders, we act as your processor, under our Data Processing Addendum. We never contact your customers, and we never use your customers’ data for our own purposes. The only exception is statistics that don’t identify any person, store or merchant, such as error rates and performance figures, which we use only to run, secure and fix the app you installed. We never sell or share them, publish them, use them for another app or use them to train AI.

Uninstalling and deletion

In short: When you uninstall, the app loses access straight away. Shopify asks us to erase your data 48 hours later. We delete it within 30 days of that request, and the last copies in logs, error reports and backups within 90 days.

When you uninstall one of our apps:

1. Shopify tells us straight away that you have uninstalled, and ends the app’s access to your store. We delete the app’s access tokens and disconnect any integrations you set up.
2. About 48 hours later, Shopify sends us a request to erase your store’s data. The delay lets you reinstall without losing your settings.
3. Within 30 days of that request, we delete the data the app holds about your store, your staff and your customers, including in our analytics tools and the details the app shares with our support tool. Error reports, and notifications from Shopify that failed to process, roll off within 90 days.
4. Database backups and application logs roll off within a further 30 days.

We keep only:

• records we must keep by law, such as billing and tax records;
• the record that our terms were accepted for your store, and of when each staff member was shown this policy, for 6 years after you stop using all our apps (deleted within 6 months after that), or longer while a claim or dispute needs it, so we can show what was agreed;
• support conversations you have had with us, for 2 years after the last message;
• if you opted in to marketing, your name, email and consent record, so we can keep sending what you asked for (you can unsubscribe at any time); and
• a minimal record of unsubscribes, so we don’t email you again by mistake; and
• statistics that don’t identify any person, store or merchant, such as error rates.

If you use more than one of our apps in the same store, we keep the data that the other apps still need.

Support and access to your store

In short: If you ask for help, we may look at your store, but only with your permission and only the parts you allow.

To fix a problem with one of our apps, we sometimes need to see it in your store. We only do this with your permission, through Shopify’s collaborator access:

1. We send a request from our Shopify Partner account. You may need to give us your store’s collaborator request code first.
2. Before you approve it, you choose which parts of your store we can see. We ask only for what the problem needs.
3. We use the access only to deal with your request, and we may see your customers’ or orders’ details if the problem involves them. We don’t copy your store’s data into our own systems beyond what’s needed in the support conversation.
4. When the issue is resolved, we’ll tell you, so you can remove our access in Settings > Users. You can remove it at any time, and Shopify ends it automatically if we haven’t signed in for 90 days. What we do while signed in shows in your store’s activity log.

For your customers’ data, this is part of what we do for you under our Data Processing Addendum. The same applies if you include your customers’ details in a support message: we use them only to help you, so please share only what’s needed.

If you shop at a store that uses our apps

If you are a customer of a store that uses one of our apps, that store decides how your data is used, and its privacy policy applies. Please contact the store to use your privacy rights. If you contact us, we will pass your request to the store and help it respond.

Shopify lets stores and customers request access to or erasure of a customer’s data. When Shopify sends us an erasure request, we act on it automatically, normally straight away. It can take up to 30 days to reach every system, backup copies roll off within a further 30 days, and error reports and failed Shopify notifications, which can occasionally contain it, within 90 days of being created. When a store asks for a customer’s data, we provide it to the store.

Data Processing Addendum

Our Data Processing Addendum forms part of our terms for every app. It sets out how we process your customers’ personal data for you, including security measures, our suppliers, international transfers, and helping you meet your own obligations. You don’t need to sign anything; it applies automatically when you use our apps. If you’d like a signed copy for your records, download the signable PDF, fill in your details and email it to privacy@commitandpush.io, and we’ll countersign it and send it back.

Part D: The Shopify App Store

The Shopify App Store

When you look at, install, review or pay for one of our apps through the Shopify App Store, Shopify handles that data as its own controller, under Shopify’s privacy policy.

Shopify shares some of this with us through the Shopify Partner Dashboard: your store name and domain, when you installed or uninstalled our app, your plan and charges, and any review you write, including the name shown on it. We use this to run our business, support you and understand how our apps are doing. Our replies to reviews are public.

Analytics on our App Store listings

In short: We use Google Analytics to see how people find and install our apps on the Shopify App Store, including what they searched for. When a store installs an app, Shopify tells Google Analytics which store it was.

Shopify lets app developers measure visits to their App Store listings with Google Analytics. We use it to understand how merchants find our apps and which listings and searches lead to installs. Through it we receive:

• visits to our listing pages and clicks on the install button, with browser and device details and your approximate location (country or region), which Google works out from your IP address without storing it;
• where the visit came from, such as an App Store search, category, ad or another page, and the search terms used;
• when a store installs one of our apps, the store’s Shopify ID, name and web address, which Shopify sends to Google Analytics directly.

Shopify runs the App Store and its cookie controls, so Shopify’s cookie settings decide whether the analytics tags load in your browser. We don’t use Google Analytics for advertising, we turn off Google signals and data sharing with Google, and we keep this data for no more than 14 months. Google Analytics processes it for us as a supplier (see our sub-processor page). Our legal basis is our legitimate interest in understanding how merchants find our apps, and you can object by contacting us.

Billing through Shopify

Shopify bills you for our apps and pays us. We never see your card or bank details. We receive the plan you chose, charge amounts and dates, and keep them as business records.

Other channels

If you contact us through another channel, such as social media or a partner directory, that platform’s own privacy policy also applies. We only use what you send us to reply to you.

Part E: Regional information

In short: Everyone gets the rights in this policy. These notes add what particular laws require.

United Kingdom

We are a UK business and follow the UK GDPR, the Data Protection Act 2018, the Data (Use and Access) Act 2025 and the Privacy and Electronic Communications Regulations. You can complain to us first as described in Complaints, and then to the Information Commissioner’s Office.

European Economic Area and Switzerland

The EU GDPR and the Swiss Federal Act on Data Protection apply to our processing of data about people in the EEA and Switzerland. The UK is recognised by the EU as providing adequate protection. You can complain to the data protection authority in the country where you live or work, or where you think the problem happened.

United States

We have never sold personal data, shared it for cross-context behavioural advertising, or used sensitive personal data to infer characteristics about you. We don’t use personal data for profiling that produces legal or similarly significant effects.

Depending on your state (including California, Virginia, Colorado, Connecticut, Utah, Texas and Oregon), you may have the right to know what personal data we collect and how we use it, to access, correct and delete it, to get a copy, and to opt out of sale, targeted advertising and profiling. We will not treat you differently for using these rights.

In the last 12 months we have collected these categories of personal information, for the purposes in What we use data for: identifiers (such as name, email and store domain); commercial information (such as your plan and charges); internet activity (such as pages visited and app usage); and professional information (such as your role, if you tell us). We disclosed them only to the recipients described in Sharing and suppliers.

To make a request, email privacy@commitandpush.io. If we decline your request, you can appeal by replying to our decision. If you are not satisfied with the outcome of your appeal, you can contact your state Attorney General.

Canada

We follow the Personal Information Protection and Electronic Documents Act and, for people in Québec, Law 25. Your data may be stored and processed outside Canada, including in the United States, where it may be accessible to courts and authorities under local law. The person in charge of protecting personal information at Commit & Push can be reached at privacy@commitandpush.io. You can complain to the Office of the Privacy Commissioner of Canada or, in Québec, the Commission d’accès à l’information.

Australia and New Zealand

We handle personal information consistently with the Australian Privacy Principles and the New Zealand Privacy Act 2020. Your information may be disclosed to recipients in the United States, the United Kingdom and the European Union, as described in International transfers. You can complain to the Office of the Australian Information Commissioner or the New Zealand Privacy Commissioner.

Other countries

If you live elsewhere, including Brazil, India, Japan or Singapore, you have the rights your local law gives you, and you can use them by emailing privacy@commitandpush.io. You can also complain to your local data protection authority.