BesPoP Popup — Privacy Policy

Last updated: 2026-06-03

BesPoP Popup ("the app", "we") is an email/discount popup app for Shopify, operated by BesPoP. This policy explains what personal data the app processes, why, how long we keep it, and the rights available to merchants and their customers. For each Shopify store, the merchant is the data controller and BesPoP acts as a data processor on the merchant's behalf.

What we collect

• Shopper email address — submitted by a shopper through a popup form.
• Marketing-consent flag — whether the shopper opted in.
• Signup metadata — the originating popup, source URL, timestamp, and any discount code issued.
• Order-attribution metadata — for conversion reporting only: order id, total, and currency (via the orders/paid webhook). We do not store order line items, shipping/billing addresses, phone numbers, or payment data.
• Aggregate popup events — impressions, dismissals, and conversions (non-identifying).

We collect the minimum personal data required to provide the service. We do not collect names, phone numbers, addresses, or payment information.

Why we process it

• App functionality — capture email signups and store them for the merchant.
• Marketing — create/update the Shopify customer with email-marketing consent and forward the signup to the merchant's own connected email platform (e.g. Klaviyo, Mailchimp, Omnisend), at the merchant's direction.
• Analytics — attribute conversions and revenue to popups so the merchant can measure campaign performance.

Who we share it with

Signups are forwarded only to the merchant's own connected email service provider, under the merchant's account and instruction. We do not sell personal data and do not share it with any third party of ours for their own purposes.

Retention & deletion

Personal data is retained only while the app is installed and is deleted via Shopify's mandatory privacy webhooks:

• customers/redact — deletes that shopper's signups.
• shop/redact — deletes all of the store's data.
• customers/data_request — returns the stored data for that shopper.
• Uninstalling the app purges popup event data.

Security

• All data is transmitted over encrypted connections (HTTPS/TLS).
• Data is stored in an app-isolated PostgreSQL database (per-app, bpu_ table prefix).
• Staff access to personal data is limited on a least-privilege basis, and access to personal data is logged.
• We maintain a security incident-response policy and notify affected parties of breaches as required by law.

Your rights

Merchants and their customers may request access to, correction of, or deletion of personal data. Customer requests are handled through Shopify's data-request and redaction webhooks; merchants can also contact us directly.

Contact

Questions or requests: support@bespop.com. More from BesPoP: https://bespop.com.

Changes

We may update this policy; the "Last updated" date above reflects the latest version.