Last updated: October 9, 2026
1. Purpose and scope
Casa Apps Inc. complies with the EU General Data Protection Regulation (GDPR) and the UK GDPR when it processes personal data for merchants using Casa Loyalty. This policy explains what data we process, why, where it is stored, how we protect it, and how we support merchants in meeting their own obligations.
It applies to every Shopify store that installs Casa Loyalty and has customers in the European Economic Area (EEA), the United Kingdom or Switzerland. Our Data Processing Addendum (DPA), described in section 12, sets out our contractual commitments.
2. Roles
The merchant is the data controller and Casa Apps is the data processor. The merchant decides why and how its customers' data is used. We process that data only to run the loyalty program, following the merchant's documented instructions and the DPA.
We never sell customer personal data or use it for our own marketing.
We do not combine one merchant's customer data with another merchant's.
If a customer contacts us directly about their data, we pass the request to the merchant and help them respond.
3. Personal data we process
We process only the data needed to run the loyalty program. The data subjects are the merchant's customers and the merchant's own staff users.
Category | Examples | Purpose |
Identity and contact | Name, email address, phone number, physical address, Shopify customer ID | Identify members, send program emails the merchant enables |
Order data | Order ID, order value, products, order date | Award and adjust points, determine VIP tiers |
Loyalty activity | Points balance, rewards redeemed, referrals, tier status | Run the program and show members their balance |
Optional profile data | Date of birth (if the merchant enables birthday rewards) | Birthday rewards |
Technical data | IP address, browser type, widget session data | Display the storefront widget, prevent fraud and abuse |
Merchant staff data | Name and email of store admins | Account access and support |
We do not ask for or process special category data (such as health, religion or ethnicity) or payment card details. Payments stay within Shopify.
Legal basis
The merchant, as controller, sets the legal basis for each processing activity. This is typically performance of a contract (the loyalty program terms) or legitimate interests. For marketing emails, the legal basis is consent (see section 10).
4. Hosting and international transfers
Casa Loyalty data is hosted on Amazon Web Services (AWS) in the United States. AWS holds ISO 27001, SOC 2 and other certifications and is bound by its own GDPR Data Processing Addendum.
Casa Apps Inc. is a U.S. company and our engineering and support teams work from India. Personal data from the EEA, UK or Switzerland may therefore be transferred to or accessed from countries without an EU adequacy decision. We protect these transfers with:
Standard Contractual Clauses (SCCs) adopted by the European Commission (Decision 2021/914), Module 2 (controller to processor), included in our DPA.
The UK International Data Transfer Addendum for UK data.
The same SCC protections in our contracts with subprocessors, including AWS.
Encryption and access controls that protect data wherever it is accessed.
5. Subprocessors
We use a small number of vetted subprocessors. Each one is bound by a written agreement with data protection terms materially similar to those in our DPA.
Subprocessor | Purpose | Location |
Amazon Web Services, Inc. | Hosting, database, backups, email sending (Amazon SES) | United States |
Sendtray | Sending loyalty program emails | United States |
Intercom, Inc. | Merchant support conversations | United States |
We notify merchants by email before adding a new subprocessor. Merchants can object on reasonable data protection grounds within 7 days of the notice, as set out in our DPA.
6. Security measures
We apply technical and organisational measures appropriate to the risk of the data we hold. These include encryption of data in transit and at rest, access controls limited to authorised staff, secure hosting and backups, and monitoring of our systems.
Casa Loyalty is hosted on Amazon Web Services, whose infrastructure is certified to SOC 2 Type II and ISO 27001 and audited regularly by independent third parties. We do not materially reduce our security measures without giving merchants reasonable prior notice.
7. Data subject rights
We help merchants respond to their customers' GDPR rights within the one-month legal deadline: access, rectification, erasure, restriction, portability and objection.
Casa Loyalty supports Shopify's three mandatory privacy webhooks:
Webhook | What we do |
customers/data_request | We compile the customer's loyalty data and provide it to the merchant in a machine-readable format |
customers/redact | We permanently delete the customer's personal data from Casa Loyalty |
shop/redact | We permanently delete all of the store's data after the merchant uninstalls the app |
When a merchant deletes a customer in Shopify, Shopify sends the redact request and we erase that customer's data. Merchants can also email privacy@casaapps.com for help with any request.
8. Retention and deletion
We keep personal data only for as long as needed to provide Casa Loyalty to the merchant, or longer where the law requires it.
Customer erasure: when a merchant deletes a customer in Shopify, we delete that customer's data from Casa Loyalty.
App uninstall: after a merchant uninstalls Casa Loyalty, we delete the store's data.
Backups: deleted data may remain in backups for a limited period. It is held only temporarily, isolated from further processing, and automatically purged when the backup expires.
On request: merchants can ask us to confirm deletion in writing.
9. Personal data breach notification
We notify affected merchants without undue delay after becoming aware of a personal data breach. This gives the merchant time to meet its own 72-hour deadline to report to its supervisory authority.
We will take reasonable steps to contain and remedy the incident, and keep the merchant updated as we learn more.
10. Marketing consent and cookies
Casa Loyalty respects the customer's marketing consent recorded in Shopify. Transactional program messages (points earned, reward available) are separate from marketing messages, and every email includes an unsubscribe link.
The storefront widget uses only the cookies and local storage needed to show the member's loyalty status and keep them signed in. We do not use them for advertising or cross-site tracking. Our cookie list is available on request so merchants can include it in their own cookie banner and policy.
11. Accountability and merchant responsibilities
Our team members are trained in handling personal data and are bound by confidentiality obligations. We hold our vendors to data protection standards consistent with this policy, and we keep this policy and our practices under regular review.
Merchant responsibilities
As controller, the merchant is responsible for:
Telling customers in its privacy policy that loyalty program data is shared with Casa Apps, and what data is involved (see section 3).
Collecting marketing consent where required.
Deleting customers in Shopify when they ask for erasure, so the deletion reaches Casa Loyalty.
Getting its own legal advice on its GDPR obligations.
12. DPA, contact and updates
Our Data Processing Addendum, including the Standard Contractual Clauses, applies to every merchant and is accepted when the merchant installs Casa Loyalty.
Company: Casa Apps Inc., a Delaware corporation, United States
Privacy contact: privacy@casaapps.com
We will tell merchants about material changes to this policy at least 30 days before they take effect.