Privacy policy

From visitors to informly.co: standard server logs (IP, user agent), anonymous analytics events (page views, referrer), and cookies you accept (see Cookie policy).

From customers who sign up: name, work email, company, billing details, integration credentials. Authentication via email or Google sign-in.

From end-customers (data our customers send us): contact identifiers (name, email, phone), survey responses, loyalty stamps, coupon redemptions, ticket content, and usage events from integrated systems.

To run the platform you signed up for; to send transactional product notifications; to bill, support, and improve the service; and to detect abuse or fraud. We do not sell personal data, ever. We do not train AI models on customer or end-customer data without explicit opt-in.

Performance of contract (delivering the service you signed up for), legitimate interests (security, fraud prevention, product improvement), legal obligation (tax, accounting), and consent (marketing where required).

We use vetted infrastructure providers — listed publicly on our Sub-processors page. We require equivalent data-protection terms from every sub-processor.

Customer accounts are retained for the life of the contract plus 90 days. End-customer data — including data we receive through connected platforms such as Shopify — is retained for the duration of the customer's subscription plus 90 days after cancellation, or until an earlier deletion or redaction request, whichever comes first. We delete or redact sooner when we receive a verified customer-deletion request (see "11. Shopify customer data").

Access, rectification, erasure, portability, restriction, objection, and the right to withdraw consent. Submit a request to privacy@informly.co — we respond within 30 days.

Personal data is hosted in the United States (Google Cloud, us-central1). Where personal data of individuals in the EEA or UK is transferred to the United States or to another sub-processor in a third country, we rely on the EU Standard Contractual Clauses (EU SCCs) and the UK International Data Transfer Addendum (UK IDTA), together with supplementary technical measures. Our current sub-processors and their regions are listed on the Sub-processors page.

See our Security page for the technical and organizational measures we have in place.

Material changes are announced via product email and an effective-date update at the top of this page at least 30 days before they take effect.

Privacy questions: privacy@informly.co. EU/UK representative on request.

When a merchant connects their Shopify store, Informly accesses protected customer data through Shopify's APIs. We request only the minimumfields we need to deliver the service the merchant configures: the customer's name and email (and the order context needed to time a request). We do not request customer phone numbers or addresses.

Why we use it.This data is used solely to send the surveys, feedback requests, and follow-ups the merchant sets up. We do not sell it, use it for advertising, or process it for any purpose beyond providing the app's functionality to that merchant.

Retention.Shopify customer data is retained for the duration of the merchant's subscription plus 90 days after cancellation or app uninstall, or until an earlier deletion request — whichever comes first.

Deletion + redaction.We honor Shopify's mandatory compliance webhooks — customers/data_request, customers/redact, and shop/redact — and action them within 30 days. A merchant or end-customer can also request access or deletion directly at privacy@informly.co. The same sub-processors and security measures described above apply to Shopify data.