Privacy Policy

When you install xPostio we receive the shop details Shopify passes to apps, such as your store name, owner name, contact email and phone, store address, domains, currency, timezone and Shopify plan. We keep what you build and set in the app: your post-purchase workflows and offers, your offer page layout, your setup guide progress (the steps you ticked, and whether you dismissed the guide), and the AI clients you connect with their audit trail. For billing we keep your xPostio plan, the ID Shopify gives your subscription, its status, its renewal date, and whether it is a test charge. We also keep the messages you send us.

At install you grant one Shopify permission: read your products. We keep a copy of your product catalogue, including variants, prices, stock and images, and Shopify keeps it up to date when you create, change or delete a product. We use it to recommend and show products on the offer page. xPostio does not read or copy your orders: when a customer accepts an offer, Shopify adds the items to their order from the change xPostio signs. We ask for nothing beyond the permission shown at install.

When a customer reaches the post-purchase page, Shopify gives xPostio a signed summary of their order: the order reference, the customer ID if there is one, the products, variants, quantities and prices, the order total and currency, and the shipping country. xPostio uses it to choose the offer and check its rules.

For each customer who reaches the offer page we store the order reference, the Shopify customer ID, the product and variant IDs and quantities in the order, the order total and currency, and what happened on the offer page: the offers shown, the products recommended, whether each offer was accepted or declined, how long the customer took, whether a countdown ran out, and the revenue and discount added. We do not store the customer’s name, email, address or phone number, and xPostio never receives card details. The offer page itself keeps the offer data for that checkout in the browser, through Shopify’s storage for checkout extensions.

Our hosting provider’s technical logs can also contain these order details for a limited time, for troubleshooting.

We use it to decide which offer a customer sees, to recommend products, to price and check an accepted offer before it goes to Shopify, to add accepted offers to the order through Shopify, and to show you your results. We also use it to answer your support requests, to keep the service secure, and to understand how xPostio is used so we can improve it. We never sell your data or your customers’ data, and we don’t use it for advertising.

When you install xPostio, for the products already in your store, and afterwards whenever a product is created or its title, description or tags change, xPostio sends its title, description (with HTML removed) and tags to OpenAI, through our own OpenAI connection, to build product-similarity data. The offer page then recommends the products in your catalogue most similar to what the customer bought, and that comparison runs in our own database. Only your catalogue text is sent to OpenAI. No customer or order data is included, and we don’t use your content to train any model of ours.

Connect AI lets you connect the AI client you already use, such as Claude or ChatGPT, over MCP. You approve it on a screen in your own Shopify admin. Your assistant can read your workflows, your product catalogue and your store details, and it can create, change, turn on, turn off and delete your post-purchase workflows. It can never read your orders, your customers or your offer results. What it reads goes to the provider you chose, under your account and their terms. Every action it takes is recorded in an audit trail by our server. We store no AI provider keys. Disconnecting a client ends its access immediately, and uninstalling xPostio disconnects all of them.

xPostio runs on Gadget, which hosts the application and its database, alongside Shopify, which holds your store data and runs the checkout. OpenAI receives your product catalogue text, as described in section 6. The AI client you connect yourself works under your own agreement with its provider. Shopify bills xPostio’s paid plans and handles the payment, so xPostio never receives your card or bank details. xPostio also reports offer activity to Shopify through its App Events API: that an offer was shown, accepted or declined, with the offer, its discount type and its workflow, and no customer or order data. Shopify keeps these events for 30 days. Once Shopify approves xPostio for App Events in Analytics, they can appear in your Shopify Analytics. Sentry receives error reports so we can find and fix problems: from the xPostio admin pages, the error, the page it happened on, how fast pages load, and your browser and device type; from xPostio’s servers, the error and the part of xPostio it happened in. We share only what a provider needs to do its job.

Shopify passes privacy requests to xPostio automatically, and we act on each one within 30 days:

• A customer asks for their data. When a customer asks you for their data, Shopify tells xPostio. We gather what we hold about them, which is their post-purchase sessions and offer answers, and send it to you.
• A customer’s data is erased. When a customer’s data is to be deleted, Shopify tells xPostio and we delete their post-purchase sessions and offer answers.
• Your store’s data is erased. 48 hours after you uninstall xPostio, Shopify asks us to erase your store’s data. We delete your workflows and offers, your offer page layout, your setup guide progress, your plan, your results, your Connect AI records and our copy of your product catalogue. If you install xPostio again within those 48 hours, nothing is erased.

We keep a record that each request was handled, and the basic store record Shopify gave us at install, which the app needs if you install it again. You can also write to us at the address below to have your store’s data or a customer’s data exported or deleted, and we answer within 30 days. Customers should contact you first, because you are their controller, and we will help you answer them.

We keep your data while xPostio is installed. When you uninstall, your workflows are turned off and every connected AI client is disconnected, with its access tokens and sessions removed. 48 hours later the rest of your store’s data is erased, as described in section 9.

Traffic to xPostio travels over HTTPS. Every record belongs to one store, and each store can only reach its own records. Requests from the offer page are checked against Shopify’s signed token, and every accepted offer is checked against your settings on our server before it is signed and sent to Shopify. A Connect AI connection is limited to the store that approved it, and its actions are logged. No system is perfectly secure, but we work to protect yours.

DevOps Crowd Inc. is based in Montreal, Canada. Your data may be processed by us and by the providers named above in Canada, the United States and other countries where they operate. AI clients you connect yourself run wherever their provider runs. Where the law requires it, we rely on appropriate safeguards for cross-border transfers.

Depending on where you live, you may have the right to access, correct, delete or export your personal information, to object to or restrict some processing, and to withdraw consent. Write to us and we will answer within 30 days. Your customers should contact you first, and we will help you answer them.

We update this policy as xPostio and the law change. The current version always sits at this address with its date. When a change matters to you or your customers, we will say so plainly in the app or by email. Continuing to use xPostio after an update means you accept the updated policy. If you don’t, uninstall the app and write to us.

Questions, requests or complaints: write to help@devopscrowd.com, or to DevOps Crowd Inc., 1275 Av. des Canadiens-de-Montreal, Suite 5-129, Montreal, QC H3B 0G4, Canada. If our answer doesn’t satisfy you, you may complain to your local data protection authority, including the Commission d’accès à l’information du Québec.