Privacy policy

Effective November 6, 2026. Oru Studio provides Aovly to Shopify merchants. Contact naimkst@gmail.com about privacy, access, correction, deletion, or a data export.

Information we process

We store the shop domain, app authorization tokens, installation and staff session details supplied by Shopify, merchant settings, product selections, offer configuration, and offer events. Shopify order and refund webhooks are processed to calculate attributed item revenue. We retain order identifiers, offer identifiers, currency, amounts and event timestamps; we do not retain customer names, email addresses, phone numbers, shipping addresses, or payment card details from those webhooks. Short-lived purchase references and signed change tokens prevent duplicate post-purchase charges.

How information is used

We use this information to authenticate the app, deliver offers, manage discounts, report attributed sales and refunds, prevent duplicate actions, provide support, and maintain service security. We do not sell personal information or use customer data for advertising.

Service providers and international processing

Shopify supplies the commerce APIs and checkout infrastructure. Our application and database run on an Oru Studio managed Contabo server. Support messages are received through Gmail. These providers may process information in countries outside your location under their applicable terms and safeguards. We disclose information when required by law or to protect the service.

Retention and deletion

We retain merchant configuration while the app is installed and attribution records for up to 90 days. Uninstalling deletes shop records from active storage. Shopify’s shop-redaction webhook also deletes shop records. Customer-data requests are retained for up to 30 days. Expired purchase tokens are removed daily. Customer deletion requests received from Shopify remove associated order-attribution records. Server logs are retained for up to 14 days and backups for up to 7 days. Deleted data may persist in restricted backups until those expire.

Optional analytics and consent

Storefront attribution is included only when Shopify’s customer privacy API permits analytics and marketing processing. If the API is unavailable, attribution is omitted. On a consent change that disallows this processing, Aovly removes its attribution fields from the open cart. Product offers and discounts remain available without analytics attribution. For data already submitted with an order, contact the merchant to request deletion.

Your choices and rights

Merchants can pause offers, remove the theme embed, and uninstall the app at any time. Contact us for access, correction, export, or deletion; we verify requests before disclosing data. Customers should contact the store where they purchased, which can forward requests through Shopify. Depending on your location, you may also have rights to object, restrict processing, or complain to a supervisory authority.

Security and changes

We use HTTPS, restricted database access, authenticated Shopify requests, an encrypted database volume, and encrypted backup storage. No system can guarantee absolute security. We update this policy when our practices change and publish the updated effective date here.