Superpop Privacy Policy

Working with Protected Customer Data Responsibly

Superpop is committed to minimizing data collection and complying with Shopify's privacy requirements. This policy explains how we handle protected customer data in accordance with Shopify's data protection standards.

Data Access Levels

We follow Shopify's tiered approach to customer data access:

• Level 0: No customer data accessed. No additional action required.
• Level 1: Customer data excluding name, address, phone, and email fields. Requires protected data access implementation.
• Level 2: Data including personal identifiers. Requires enhanced security measures and Shopify review participation.

Our Data Protection Commitments

Level 1 Requirements

Superpop commits to:

• Processing only the minimum personal data required for functionality
• Informing merchants which data is processed
• Honoring consent preferences and opt-outs
• Encrypting data at rest and in transit
• Applying appropriate retention periods and deletion protocols

Level 2 Additional Commitments

Where applicable, we implement enhanced security measures including:

• Encrypted backups
• Separated environments for development and production
• Data loss prevention measures
• Restricted employee access to sensitive data
• Strong password policies and access controls
• Access logging and monitoring
• Documented incident response plans

Data Usage & Compliance

• Unapproved API fields return null values with descriptive errors
• We regularly review Admin, Customer Account, and Storefront API usage
• New functionality triggers security assessment before release
• Shopify may request data protection reviews at any time

Your Rights

As a merchant or end customer, you have the right to:

• Know what data we collect and how it's used
• Request access to your data
• Request deletion of your data
• Opt-out of data collection where applicable

Contact Us

If you have any questions about this privacy policy or our data practices, please contact us at hello@chetanverma.com