Privacy policy

Drift Cart Drawer & Upsell · operated by Drift Studio · last updated 2 November 2026

Drift Cart Drawer & Upsell ("the app") adds a cart drawer, rewards and upsells to Shopify stores. This policy explains what data the app collects when a merchant installs it and when shoppers use the merchant's store, how it is used, and how it is deleted.

Data we collect from merchants

• Store details from Shopify: shop domain, currency and money format, and whether it is a development store.
• An access token and the basic profile of the staff member who opened the app (name, email, locale), supplied by Shopify to authenticate the session.
• Your cart drawer settings, the IDs of products and discounts the app creates for you, and your plan.

Data we collect from shoppers

• Anonymous cart events (drawer opened, upsell added, reward unlocked) counted per day, linked to a random session ID. No name, email, address, IP address or payment data is stored.
• For orders: the order ID, date, currency and amounts (total, upsell and add-on revenue), used for your dashboard and to count monthly orders for billing. We do not store customer names, emails or addresses.

The app does not use cookies for tracking, does not sell data and does not share it for advertising.

How we use the data

• To show the cart drawer with your settings and apply rewards through Shopify Functions.
• To show performance stats in the app and to apply your plan's order limit.
• To provide support and keep the service secure (rate limiting, error logs).

Where data is stored

Data is stored on Cloudflare (Workers, D1 and R2) and processed by Shopify. Both act as our sub-processors. Data is encrypted in transit.

Retention and deletion

• Order rows are kept for 400 days (for year-over-year stats) and then deleted automatically.
• When you uninstall, the app stops processing your store immediately.
• 48 hours after uninstall Shopify sends a shop redaction request, and we then delete all data for your store, including sessions, settings, stats and order rows. Point-in-time recovery copies kept by our database host expire within 30 days.
• Customer data and redaction requests from Shopify are answered automatically. Because we hold no customer personal data, there is nothing to export or delete for a single customer.

Your rights

Merchants and shoppers can ask to access, correct or delete their data, including under GDPR and CCPA. Shoppers should contact the store they bought from; merchants can contact us at driftstudio79@gmail.com.

Changes

We will update this page when the policy changes and show the new date at the top.

Contact

Drift Studio, driftstudio79@gmail.com.