PRESTACK PRIVACY POLICY

Effective date: October 28, 2026 · Operator: PreTech Park, Dhaka, Bangladesh · Contact: support@pretechpark.com

PreStack ("the App") is a Shopify application that lets merchants build product stacks (step-by-step product routines and bundles), show them on their storefront and offer a discount for buying them together. This policy explains what data the App collects, why, how long it is kept, and who processes it.

Roles

For data about your store's customers and visitors, you (the merchant) are the controller and PreTech Park processes it on your behalf, only to run the App for you. This policy and the PreStack Terms of Service are our data processing terms with you. Your own store's privacy policy should tell your customers that you use apps such as PreStack.

Data we collect from merchants

Shop identity and access: your shop's myshopify.com domain and the Shopify access tokens the App needs to operate. The App does not store staff members' names or email addresses.
Store settings: your store's languages, the widget's colours and wording, your settings in the App, and technical state such as whether the App embed is turned on in your theme.
Products in your stacks: for each product you add to a stack, its Shopify IDs, title, handle, image, price and stock level, so the stack can be shown and kept up to date.
Your stacks: everything you create in the App — stack names, descriptions, steps, FAQs, footer notes, discounts, video links, colours and page addresses — plus the stack suggestions the App builds from your catalog, and stock alerts about your stacks' products.
Store sales totals: your store's number of orders and sales per day, used to compare stack orders with your store's average order value. These totals contain nothing about any customer.
Subscription status: your App plan, via Shopify's billing. Payment details are handled entirely by Shopify — we never see them.
Support messages: what you send from the App's Help page (with your store's address, name, owner name, email and plan) or by email is kept in our support inbox so we can help you. The App itself doesn't store it.

Data we collect about your customers and visitors

Anonymous storefront analytics

The App's storefront widget and stack pages count stack views, step clicks and "Add all" clicks. Each event is tied to a random visitor ID that the widget creates in the visitor's browser; the App stores only a one-way hash of it (SHA-256, combined with your shop's domain), never the ID itself. The same random ID is sent with the widget's requests so that one visitor can't use up your store's request limits.

Visitors' analytics choices are respected. The widget checks Shopify's Customer Privacy API (your store's cookie banner) before collecting analytics: if a visitor has not allowed analytics, no visitor ID is created, no view or click events are sent, and their cart is not marked for sales attribution. Features the shopper uses directly (their "I already have this" ticks and their own progress) and the records made from completed orders, described below, don't depend on this choice.

Orders

Shopify sends the App each new order with only these fields: order ID, order date, order total, the order's cart attributes (the App reads only its own two and ignores and stores none of the others), the customer's Shopify ID, and each item's ID, product ID, quantity, price and discounts. When an order is refunded or cancelled, Shopify sends only the IDs and refunded amounts. Names, email addresses, phone numbers and postal addresses are not requested. The App uses them to:

Credit sales to a stack: when a visitor who allowed analytics adds a stack to their cart, the widget marks the cart with that stack's ID and the time, in hidden cart attributes that stay on the order inside your Shopify store. The App then records, for that stack, the amount of the order's items that are the stack's own products, after discounts, without shipping, and without tax unless your prices include tax. Refunds of those items are taken off and a cancelled order counts for nothing. It keeps the order ID, those items' IDs, the order's total, the amounts refunded and whether the order was cancelled (nothing about the customer).
Count stack buyers and progress: for any order linked to a Shopify customer, the App records which stacks the customer bought from and which steps they now own. These are used for counts such as "Bought by N customers", popularity labels and completion rates.
Show signed-in customers their own progress (Build and Grow plans): the App also keeps the products each customer bought from you and the latest purchase date, to show them which steps they already own, a reorder reminder when a product is due again, and their "My Journey" page.
Avoid counting an order twice: the order ID is kept for 14 days, and so are the IDs of refunds and cancellations, so each counts once.

The per-customer records above are stored under a pseudonymised customer reference (a SHA-256 hash of your shop's domain and the customer's ID), not the customer ID itself.

On the Build and Grow plans, the App also reads a customer's recent orders from Shopify (Shopify shares only the last 60 days) to show their progress and to decide when they have completed a stack. Only the products in those orders and their dates are used; they are kept in memory only, used for at most a few minutes, and never written to the database.

The App's database stores no customer name, email address, phone number, postal address or raw customer ID (except briefly for a privacy request, below).

Data kept in your Shopify store

"I already have this" ticks: on the Build and Grow plans, a signed-in customer's ticks are saved on their Shopify customer record (an app metafield) so they follow the customer between devices.
Shopify Flow: on the Build and Grow plans, when a customer buys a stack's products, the App sends Shopify Flow its "Step Owned" and "Stack Completed" events with the customer's ID, the stack's name and ID and, for "Step Owned", the step number. It keeps a list of the events already sent on the customer's record (an app metafield), so each is sent only once. What any Flow workflow you set up then does (for example, sending an email) is set up and controlled by you.
Store data: a copy of your live stacks (an app metafield, so the widget shows instantly), the automatic discount(s) for your stacks and their settings. These contain no customer data.

In the visitor's browser

The widget stores small values in the visitor's own browser (localStorage and sessionStorage): the random visitor ID (only when analytics are allowed), the visitor's "I already have this" ticks, a short-lived copy of the stacks on the page and, for a signed-in customer, their ticks and latest progress (step IDs only, so the page shows it instantly), stored under a key that includes their Shopify customer ID. The App sets no cookies of its own. These values are not used to track visitors across sites and are not advertising identifiers.

IP addresses

A visitor's IP address is used only to limit abusive request rates. It is combined with your shop's domain and a secret key into a one-way code, used for a one-minute rate-limit window, kept in memory only and never stored.

Step videos

If you add a YouTube or Vimeo video to a step, it loads only when the shopper presses play. YouTube videos use YouTube's privacy-enhanced (youtube-nocookie.com) player. Once a video plays, YouTube's or Vimeo's own privacy policy applies to it.

How we use data

Solely to provide the App's features: showing your stacks, applying their discounts, keeping stock and stack health up to date, showing customers their own progress, computing stack analytics and sales attribution, sending your Flow events, answering support requests and operating your subscription. We do not sell data, share it with advertisers, or use it for any other purpose. The App makes no automated decisions about people.

Emails we send

The App sends no emails to you or your customers. It emails only our own support inbox: when a customer data request arrives (see below), when your store's plan changes, and when you send us a message from the Help page. We reply only to messages you send us.

How long we keep data

Analytics (views, clicks, attributed sales, steps owned and stacks completed): your plan decides how far back you can view them (30 days on Core, 90 on Build, 13 months on Grow). On every paid plan, rows older than 400 days are deleted automatically. While your store has no active plan, they are kept while the App is installed. Downgrading hides data outside your new plan's window.
Order, refund and cancellation IDs used to avoid double counting: 14 days.
Orders credited to a stack (order ID, item IDs, amounts, whether it was cancelled): as long as the analytics above — up to 400 days.
IP rate-limit codes: a one-minute window, in memory only.
Everything else (stacks, settings, which stacks each customer bought from, the products they bought, store sales totals) is kept while the App is installed, because the App's features depend on it.
When a customer asks Shopify to erase their data, the App deletes or unlinks everything it holds about them (see below).
Server logs (shop domains, request paths and counts; never customer names or contact details) are kept by Fly.io on its own log-retention schedule.
Customer data-request emails in our support inbox are deleted once the request has been answered, and within 90 days at the latest.

Uninstalling and data deletion

When you uninstall, the App stops acting on your store right away and tries to remove the automatic discounts it created. Your stacks, settings and analytics are kept for about 48 hours, so that reinstalling within that time finds everything intact.
About 48 hours after uninstall, Shopify sends the shop/redact request and the App permanently deletes all data for your shop. Encrypted backups expire within 90 days. If you reinstalled within that window, the App is live again and your data is kept.

Privacy requests (GDPR and similar laws)

The App implements Shopify's mandatory privacy webhooks:

customers/data_request: the App emails our support inbox the records it holds for that customer (products bought and dates, steps owned and stacks completed, stacks bought from), with the request and the customer's Shopify ID, and our support team sends them to the store owner within 30 days. Until that email is sent, the request (with the customer's Shopify ID) is held in the App's database; after it, only a note that it was sent is kept, for 30 days. The ticks and Flow event list are on the Shopify customer record and are included in Shopify's own export.
customers/redact: the App deletes that customer's purchase records and removes the customer reference from their analytics and stack rows, so the counts stay but no longer point at anyone. Shopify erases the customer record, with its ticks and event list, itself. Encrypted backups expire within 90 days.
shop/redact: all data for the shop is permanently deleted, as described above.

To ask what data we hold about your shop, or to correct or delete it, email support@pretechpark.com.

Service providers

We use the following providers, each only to deliver its part of the App:

Shopify — the platform the App runs on, including billing and Shopify Flow.
Fly.io — application hosting, logs and the database, in the United States. The App is operated from Bangladesh, so your data is transferred to and processed in the United States.
GitHub — encrypted storage of our database backups (in a private repository, kept for 90 days).
Resend — delivers customer data-request records, our internal plan-change alerts (your store's address and plan only), and the messages you send from the App's Help page (with your store's address, name, owner name, email and plan, so we can reply), to our support inbox.
Slack — our internal error alerts, in the United States: when something in the App fails, a short note with your store's address and what went wrong is posted to our team's private channel. Email addresses, customer IDs and credentials are removed from it first.
Namecheap (Private Email) — hosts our support inbox (support@pretechpark.com), which receives your messages and customer data-request records.

Security

Data is transmitted over HTTPS and stored encrypted at rest by our hosting and backup providers. Admin requests are authenticated with Shopify session tokens, every merchant and storefront request reads and writes only that shop's data, and the App requests only the Shopify access it needs. Storefront requests are signature-verified by Shopify's app proxy and rate-limited. Customer references are stored only as pseudonymised hashes, and visitor references as one-way hashes of random IDs.

Changes and contact

We may update this policy; material changes will be shown by a new effective date. Questions or requests: support@pretechpark.com.

● End of document