Privacy Policy

How Lucky You collects, uses, shares and retains merchant and customer data.

Last updated April 29, 2026

1. Who We Are

Business name: Lucky You Jurisdiction: Slovenia / European Union Contact: lucky.you.shopify@gmail.com

Lucky You provides gamified storefront engagement tools, including popup games, reward systems, and email capture functionality.

2. Scope of This Privacy Policy

This policy applies to merchants, storefront visitors, customer data, and app communications. It does not govern Shopify's own privacy practices.

3. Information We Collect

A. Merchant information

Shopify store domain, authentication, tokens, configuration, billing
App usage metrics, engagement metrics, technical logs
Support chat content via Crisp

B. Customer and storefront visitor information

Email addresses, verification status, OTP data
Reward claim history, redemption status, session identifiers
Device interaction data and IP metadata for abuse prevention

C. Automatically collected information

Browser type, device type, operating system, referrer URL, timestamps
Cookie and storage identifiers

D. Support chat and screen assistance

Crisp processes messages, shop identifiers, and device metadata. Session assistance is available for troubleshooting and onboarding purposes.

4. How We Use Information

Core functionality, authentication, integration, and storefront delivery
Preventing abuse, fraud, and spam
Analytics, security, and support services

5. Legal Basis for Processing (GDPR)

Contractual necessity
Legitimate business interests
Consent, where applicable
Legal compliance

Merchants are responsible for obtaining required customer consents.

6. Cookies and Tracking Technologies

Cookies and storage are used for session maintenance, abuse prevention, and eligibility storage. Lucky You does not currently use independent third-party advertising or behavioral tracking systems.

7. Data Sharing and Disclosure

Third-party processors

Crisp — support, troubleshooting, session assistance
Fly.io — hosting
PostgreSQL — data storage
Resend — transactional email
Shopify — platform and billing

Data is shared only as necessary to perform services.

Disclosure circumstances

Legal compliance
Fraud prevention
Business transfers

Lucky You does not sell personal data.

8. Merchant Responsibility

Merchants are responsible for customer privacy disclosures and consent. In relation to the data processed through the app, Lucky You acts as:

Data processor for customer data
Data controller for operational, billing, and app security data

9. Data Retention

Data is retained only as long as necessary for operational purposes, legal compliance, billing records, security, and fraud prevention. Retention periods vary by merchant activity and legal obligations.

10. Security Measures

Lucky You uses HTTPS encryption, secure authentication, session protection, and database access controls. No system can guarantee absolute security.

11. International Data Transfers

Data may be processed in multiple jurisdictions, with GDPR-compliant protections applied where required.

12. Your Rights

You may request to:

Access your data
Correct your data
Delete your data
Restrict processing
Object to processing
Receive your data in a portable format
Withdraw consent

Requests can be sent to lucky.you.shopify@gmail.com, subject to legal, contractual, or operational retention requirements.

13. Children's Privacy

Lucky You is not intended for children under 13, and does not intentionally collect data from minors.

14. Third-Party Services

Crisp — merchant support, with optional session assistance
Shopify — platform ecosystem
Hosting, email, and analytics sub-processors are listed in Section 7

15. Changes to This Privacy Policy

Changes become effective upon posting of the updated version.

16. Contact Information

Email: lucky.you.shopify@gmail.com Location: Slovenia / European Union

For sensitive matters, email is preferred over in-app chat.

17. Shopify Compliance Notice

Lucky You operates within the Shopify ecosystem using authorized permissions, and only accesses data reasonably necessary to provide app functionality.