Privacy notice

Effective 18 October 2026. BeautyBOGOs provides promotion management and free-gift functionality for Shopify merchants. Contact the service operator at support@salonkart.com.

Information and purposes

We process the merchant’s shop domain, app authentication sessions, campaign settings and product/variant references to configure and deliver promotions. Promotion analytics use campaign references, event times, checkout identifiers, order identifiers and order names, monetary totals, currency, gift quantities and paid/cancelled timestamps. Minimal customer IDs and order-to-checkout links allow us to respond to privacy requests and prevent erased data from being restored by delayed events.

The app does not request customer names, email addresses, telephone numbers or postal addresses for promotion attribution. Verified order webhooks may contain such fields in transit; the app does not persist their raw bodies or those contact fields. Shopify authentication sessions may contain the merchant user’s account name and email supplied by Shopify.

Customer choices

Optional storefront and checkout analytics follow Shopify’s customer privacy choices. Declining or withdrawing analytics permission suppresses collection. Events suppressed during that period are not replayed when analytics permission is later granted. Essential promotion delivery and verified paid/cancelled order processing support app functionality and are separate from optional browser analytics.

We do not sell customer data or use it for unrelated advertising. The app does not make automated decisions with legal or similarly significant effects on individuals. Merchants remain responsible for their storefront privacy disclosures and lawful use of promotions.

Retention and deletion

Promotion events, order attribution records and their privacy links expire after 90 days from collection, through scheduled, bounded deletion batches. A mapping may remain while a related record is still within its 90-day window. Data needed for an unfinished access, deletion or compliance request is held until that request is resolved; it is then eligible for the next sweep.

Completed privacy request records expire after 365 days from completion. Direct customer/order references are scrubbed upon fulfillment. Minimal keyed, non-reversible replay guards and completion receipts remain for replay prevention; they contain no customer contacts or raw order/customer identifiers. Merchant campaigns and installation/session settings remain while needed to provide the installed service. Shopify’s verified uninstall and shop-redaction workflow removes the shop’s app data, with active reinstallation conflicts held for investigation.

Our backup policy uses daily recovery snapshots with a six-day rolling retention, without weekly/monthly or indefinitely locked snapshots. Deleted information may remain in those inaccessible recovery copies until they expire. Before any restored database serves traffic, operators must reconcile completed erasures and reapply retention using the current time. Backups are used for recovery, not normal analytics.

Providers and security

The service integrates with Shopify and uses Railway for application/database hosting. Provider processing can take place outside your country. We use HTTPS for public requests, private database networking, Shopify SDK authentication, tenant isolation and restricted worker credentials. Access is limited to service operation, support, security and compliance. We disclose data only to service providers for those purposes, at the merchant’s direction, or when required by law.

Rights and contact

Customers should contact the merchant from whom they purchased, or email support@salonkart.com for help routing a request. Merchants can use the authenticated Privacy screen to process requests, download a customer-specific export and acknowledge secure delivery. Downloading an export alone does not mark it delivered. We may need to verify authority before disclosing information.

Material changes will be published here with a new effective date. Questions and incident reports can be sent to the support address.