Privacy policy

Last updated: October 21, 2026

LumiOffer is a Shopify app that adds offers to online stores: volume discounts, bundles, buy X get Y rewards and popups. This policy explains what data LumiOffer processes for the stores that install it and for their shoppers.

Who we are

LumiOffer is operated by UNQ SOFTWARE. For privacy questions write to privacy@getconvexa.com. For shoppers' data the store is the controller and UNQ SOFTWARE is the processor.

Data about the store

Store domain, primary domain, currency, time zone, Shopify plan name, the admin language chosen in LumiOffer, the store owner's email address (for LumiOffer emails such as an alert when an offer stops showing), the store's offers, settings and their version history, the IDs of the Shopify discounts LumiOffer created, the store's LumiOffer plan, and Shopify access tokens (encrypted). We also record which version of these documents was accepted, when, and by which Shopify staff account ID.

Data about shoppers on the storefront

LumiOffer's widget runs in the shopper's browser and reads product and cart data from Shopify. Cart lines that LumiOffer adds carry the line property _lo (the offer ID), and reward lines _lo_reward. For popups, the browser keeps lo_pop_day and lo_pop_<offer> (when a popup was last shown, to limit how often it appears), lo_code_<offer> (the code the shopper received) and lo_cid (a random browser ID, so a returning shopper gets the same code) in local storage, or in session storage if the shopper did not allow preference storage. When a popup allows one entry per device and the shopper asks for its reward, lo_dev (a random device token signed by our server, used only to stop repeated entries) is kept in local storage and a first-party cookie. When the store runs a bundle that is picked for each shopper, and the shopper allows preference storage, the browser keeps lo_seen in session storage: the last 12 products viewed in this visit, with their tags, product type and vendor. It chooses the bundle's products on the page, is never sent to us or anyone else, and is deleted when the tab is closed. LumiOffer does not collect shoppers' names or postal addresses; a phone number only when a popup asks for one (see below).

Measurement

Only if the shopper allows analytics in the store's cookie banner (Shopify Customer Privacy API), LumiOffer stores the first-party cookie _lo_b (90 days). It records whether this browser is in the holdout group, which sees no offers and is used to measure the extra revenue offers bring, or not. The same group is added to the cart as the attribute _lo_b. Anonymous counts of offer views, clicks and adds to cart, plus one visit per session, are sent per offer and day, with no personal data; the session storage flags lo_visit and lo_tagged prevent counting twice. Without analytics permission nothing is stored or sent and every shopper sees the offers. No advertising or cross-site tracking takes place.

Popups and email sign-ups

Popups can hand out a unique, single-use discount code, created as a Shopify discount code. A popup can ask, step by step, for an email address, a mobile number, a birth date and interests. The answers are sent through Shopify to our server, which creates or updates the shopper as a customer in the merchant's Shopify store (tagged "lumioffer"; the birth date in Shopify's standard "Birth date" field, interests in the field lumioffer.interests). Each marketing permission (email, SMS, WhatsApp, phone calls) is its own checkbox and never pre-ticked; only ticked permissions are written to Shopify (WhatsApp as the tag "whatsapp_optin"). For every permission given, LumiOffer keeps a consent record: the channel, the text shown (its version and a fingerprint), the time, the offer, and keyed one-way hashes of the email address or phone number, the IP address and the browser. For permissions that are to be registered with Turkey's commercial message registry (İYS), the email address or phone number is kept encrypted until it has been sent there. Apart from that LumiOffer does not store email addresses or phone numbers: to give the same code again it keeps a keyed one-way hash of them (or of the random browser ID when nothing is asked), the code, its expiry, whether email consent was given and the language. To stop repeated entries we keep, per popup, keyed hashes of the device token, email address and phone number that claimed it. If the merchant turns on email verification, we email the shopper a 6-digit code from our address under the store's name (replies go to the store); only a keyed hash of the code is stored, and unused codes are deleted after a day. Customer records in Shopify belong to the merchant. Expired popup code discounts are deleted from Shopify 7 days after they end.

Order data

LumiOffer receives Shopify's order creation webhook to count orders per offer and group. It reads the line items' price, quantity, discounts and the _lo / _lo_b properties and the order subtotal. No customer fields are read. We store only daily totals per offer and a keyed one-way hash of the order ID (to avoid counting an order twice), which is deleted after 400 days.

Margin check

When the merchant uses the margin check, LumiOffer reads product prices and unit costs from Shopify at that moment to calculate margins. These figures are not stored.

Offer health

If an offer fails in a shopper's browser it hides itself, and the browser reports the type of failure and the page path (no personal data). These reports are kept for 90 days. LumiOffer emails the merchant if an offer stops showing.

Where data is stored

All data is stored in the European Union at Hetzner (Germany; encrypted backups in Hetzner data centres). Access tokens and Shopify webhook contents are encrypted at application level (AES-256-GCM). Backups are encrypted before they leave the server and are kept for about five weeks.

Retention

Store settings and offers: while the app is installed. Daily offer totals: 730 days. Order ID hashes: 400 days. Popup code records and consent records: while the app is installed, or until the shopper's data is deleted on request. Offer health reports: 90 days. Shopify webhook contents (which may include a shopper's email address in privacy requests): 30 days; the record that a webhook arrived: 90 days. Web server access logs, which contain IP addresses, are rotated automatically within days. When a store uninstalls LumiOffer, Shopify sends a shop deletion request 48 hours later and we delete all of the store's data; if a backup is ever restored, deletions are applied again.

Your rights

Shoppers can ask the store for access to or deletion of their data; Shopify forwards these requests to us and we answer within 30 days. LumiOffer does not store shoppers' names, and email addresses or phone numbers only encrypted while a permission waits to be registered with İYS; a customer created from a popup is part of the store's Shopify customer list and is managed there by the store. Shoppers can withdraw analytics permission at any time in the store's cookie banner and can unsubscribe from the store's marketing emails.

Sub-processors

Hetzner Online GmbH (hosting, backups). Shopify Inc. (platform, billing). Our email provider (emails to the merchant, and verification codes to shoppers when a popup asks for them). We do not share data with AI providers or advertisers. We update this list before adding a sub-processor.

Changes

We publish changes on this page, update the date above and ask merchants to accept material changes in the app.