Privacy policy

Last updated 13 November 2026.

Easypops is this website, easypops.me, and the Easypops app for Shopify. The service is run by an independent developer based in Ukraine. Write to us at support@easypops.me.

This policy has three parts: this website, the app as a merchant uses it, and the app as a store visitor meets it.

This website

The only personal data we collect here is the email address you type into the waitlist form.

• We use it for one thing: to tell you when Easypops is live on the Shopify App Store.
• It is stored in a small database at Cloudflare and nowhere else. We do not put it into a mailing list service.
• We do not sell it and do not pass it to anyone else.
• Ask us at support@easypops.me and we delete it.

The site sets no cookies and runs no analytics or tracking scripts. Cloudflare hosts the site and, like any host, handles your IP address and request details to serve the page and block abuse. Fonts come from Google Fonts, so Google receives your IP address when a page loads.

The app: merchant data

When you install Easypops, we store what the app needs to run your campaign:

• your store domain, country and time zone;
• your campaign settings: text, design, hooks, discounts, targeting and schedule;
• the key or token of an email or SMS provider you connect. Keys are stored encrypted and we show you only the last four characters;
• counters and daily statistics about how the campaign performs.

The app works through the Shopify permissions you approve when you install it. They let it read your customers, create discounts and discount codes, and add its script to your theme. It changes nothing else in your store.

We do not use your store data to train models and we do not share it with other merchants. Billing runs through Shopify, so we never see your card details.

The app: store visitor data

When a popup runs on a store, Easypops works for that store. The merchant decides what the popup asks for and what happens with the answers. In GDPR terms the merchant is the controller and we are a processor acting on their instructions.

What the script keeps in the visitor’s browser:

• a random visitor id in local storage, with a cookie (easypops_vid) as a fallback, kept for one year;
• the current session, the last 50 pages seen on that store, and a short queue of events waiting to be sent;
• which teasers the visitor has already closed.

This is how the app decides when to show a popup, shows it only once, and leaves alone someone who already signed up. None of it carries a name.

What the script sends to us:

• the visitor id, the session id, the page path and page type, the device type and the time of each event;
• when someone submits the form: the email address, the phone number if the form asks for one, the answer to the question, the consent given, and campaign details such as UTM tags, the referring site and ad click ids.

We use the visitor’s IP address to limit how often a browser can call us. We do not store it.

Where the contact goes:

• into the store’s own Shopify customer record, with the consent, tags and the answer given;
• to Shopify’s visitor API in the browser, so the store’s own marketing can recognise the person;
• to Klaviyo in the browser, if the store has Klaviyo on the page and the store’s consent settings allow marketing;
• to an email or SMS provider the merchant connected, through its API.

If a store uses Klaviyo, Postscript or Yotpo, the script also checks in the browser whether the visitor is already a subscriber, so a popup does not interrupt the same person again.

We hold contacts only in transit. Each contact waits in an encrypted queue, is deleted as soon as it reaches its destination, and is deleted after seven days at the latest.

How long we keep data

• Waitlist email: until the launch email is sent, or earlier if you ask.
• Contacts in transit: until delivered, seven days at most.
• Raw events: 90 days.
• The record of why a popup was shown: 30 days.
• Visitors who never gave contact details: 120 days after their last visit.
• Visitors who signed up, and the discount codes issued to them: while the app is installed on the store.
• Daily statistics: they hold no personal data and stay while the app is installed.

When a merchant uninstalls Easypops, we delete that store’s data. We also answer Shopify’s privacy webhooks: a deletion request for a customer removes that person’s data from our systems, and a shop deletion request removes everything belonging to that store.

Your rights

If you are a store visitor, send your request to the store you signed up with. They hold the data and decide. You can also write to us at support@easypops.me and we will pass it on and do our part.

If you are a merchant or on our waitlist, write to support@easypops.me. You can ask for a copy of your data, a correction, or deletion. In the EU and the UK you can also complain to your data protection authority.

Who processes data for us

• Shopify — the platform your store runs on.
• Render — our hosting and database, in the United States.
• Cloudflare — this website, the waitlist database, and the image service that delivers popup images to store visitors. Cloudflare receives the visitor’s IP address and the page address when an image loads.
• Google — Google Workspace holds our support mailbox, and Google Fonts serves the fonts on this site and in popups.

Data is stored in the United States. Where data moves out of the EU or the UK, we rely on the standard contractual clauses in our agreements with these providers.

Security

Contacts and provider keys are encrypted. Access to the production systems is limited to the people who run the service. No service can promise perfect security, so we keep the amount of data we hold small on purpose.

Changes

We update this page when the app changes, and the date at the top shows the last change. If a change matters to merchants, we say so in the app.

Contact

Write to support@easypops.me.

Back to Easypops