Privacy

Rulestage stores your Shopify rules, published versions and decision records with hashed customer identifiers. You can export or delete shop records.

1. What never happens

• We never request or store customer names, email addresses, phone numbers or postal addresses.
• We send no customer data to third-party services. We do no advertising, profiling or enrichment and sell no data.
• The website never handles store data. Checkout decisions run without network access, and decision records exclude raw customer identifiers.
• We send no shopper email, SMS or notifications.

2. Information we handle

2.1 Rules and customer limits

We use rule drafts, published versions, scenarios, settings and activation state to simulate and enforce your rules under our contract. Shopify receives published validation rules. Our hosting providers keep shop records until Settings deletion or Shopify redaction after uninstall.

We read customer identifiers, product identifiers and quantities from order webhooks solely to apply your per-customer limits as your processor. Per-product totals stay on customer records in Shopify until customer redaction. We discard the order payload and keep only a webhook identifier to prevent duplicate processing.

2.2 Decision records and shopper messages

We store decisions, winning rules and versions, reasons, run provenance and hashed customer identifiers to reproduce blocks and resolve support requests. Our hosting providers keep them for your selected window, 90 days by default, then purge them. You can export shop records as JSON. Shoppers see only your blocking message and the numeric threshold, limit, quantity or country it names.

2.3 Website delivery

Our hosting providers receive your IP address to deliver pages. This site sends no usage analytics and sets no analytics cookies.

2.4 Advertising attribution

We collect Google, Microsoft, Meta or TikTok click identifiers on ad landings, based on our legitimate interest in measuring campaign results. Our conversion relay receives them. We can report ad-attributed purchases to the originating ad platform. We delete raw relay identifiers after 90 days. Your browser stores identifiers and a reference until you close the session. You can request deletion of sent records.

2.5 Shopify access and storage

You sign in through Shopify, not a separate Rulestage account. Shopify handles subscription billing; we never see card numbers. Our hosting providers store shop data nearest where your store first uses the app, which can be outside your country or the United States. Requests use TLS. We encrypt access tokens with a key held outside the database and verify Shopify webhook signatures. The hosting provider's transfer terms cover EU, UK and Swiss data with standard contractual clauses or the EU-U.S. Data Privacy Framework. Database recovery history keeps deleted data for 30 more days.

Shopify redaction deletes shop rows about 48 hours after uninstall. We encrypt access tokens, staff names and emails from Shopify sessions, saved test carts and decision records before storage. Export or delete records from Settings. Customer redaction deletes hashed decision records and app-owned purchase-history totals.

2.6 Support email

We use your email and message to answer requests, under our legitimate interest. We keep them for 12 months after the thread closes.

3. Providers and locations

We use these providers:

• Shopify — the platform the app runs inside, the store's own data, and billing for the app subscription (global).
• Hosting and security providers — hosting and storage (global; a shop's data is stored in the location nearest where the store first uses the app).

Only the listed providers receive data from us.

4. Your rights

Where data-protection law applies, including the EU and UK, you can ask to see, correct, delete, restrict or export your data. You can object to our use of it. You can complain to your local supervisory authority.

Email support@rulestage.com to exercise these rights. We answer within 1 month. Export or delete shop records in Settings. Shopify customer-redaction requests remove the related hashed records.

5. Children

Rulestage is for Shopify merchants, not children. We do not knowingly request children's personal information.

6. Changes

We tell you in the app before a change affects how we use data.

7. Contact

Email support@rulestage.com or write to WaveApp LLC, 30 N Gould St Ste N, Sheridan, WY 82801, USA.