UPBAR PRIVACY POLICY

Last Updated: July 2026

1. INTRODUCTION

UpBar ("UpBar," "we," "us," or "our") is a Shopify
embedded app that helps merchants increase average order value and conversion
through two storefront placements: a site-wide Sticky Bar (free-shipping
progress and announcements) and in-product Product Highlights (geo-targeted
shipping estimates and delivery times). This Privacy Policy explains how we
handle information in compliance with applicable privacy regulations and
Shopify's requirements. By installing or using the app, you agree to this
policy.

2. INFORMATION WE COLLECT AND HOW WE USE IT

We collect only the minimum data necessary to operate the app. UpBar does not
store or process personally identifiable information about your customers or
end shoppers.

- Merchant & Shop Information: When you install the app we receive your Shopify
  store identifier (shop domain) and Shopify-issued offline access tokens
  (a short-lived access token plus a refresh token used to renew it), which we
  store securely to authenticate requests to Shopify on your behalf and to keep
  the app functioning between sessions.
- App Configuration: Your app settings (bar content, free-shipping thresholds,
  per-country display rules, and related preferences) are stored in Shopify as a
  metafield on your shop. We read and write this configuration to render your
  storefront placements; it is held within your Shopify account, not in a
  separate merchant database.
- Storefront Geo Signals: To display geo-targeted shipping estimates in the
  Product Highlights, the storefront determines an approximate visitor location
  (country/region). This signal is used at request time to select the estimate
  to show and is not stored or linked to an identifiable person.

We use this data exclusively to operate the app, provide support, and improve
the service. We do not use it for advertising and we do not build profiles of
your customers.

3. SHOPIFY DATA ACCESS

To provide its features, the app requests a minimal set of Shopify permission
scopes: reading your theme (to embed the storefront placements), and reading
and writing files (for background images used in your placements). We do not
request access to your customers, orders, Markets, or shipping settings. The
per-country shipping rules you configure in the app are display-only: they
control the estimates shown in your placements and are stored in your app
configuration; they do not create or modify Shopify Markets, shipping zones, or
rates—you manage those directly in Shopify. We access data only to perform
actions you initiate within the app.

4. DATA SECURITY AND RETENTION

- Security Measures: We protect data with industry-standard practices,
  including TLS encryption for data in transit and encryption at rest. Access
  is limited to authorized personnel.

- Data Retention:
  - Shop Records & Access Tokens: Retained while the app is installed and
    deleted within 48 hours after you uninstall the app.
  - App Configuration: Stored in your Shopify metafield; removed when you
    uninstall the app or delete the configuration.
  - Operational & Webhook Logs: Retained for up to 90 days for reliability and
    abuse prevention.
  - Support Communications: Retained for up to 2 years.
  - Anonymized/Aggregated Analytics: May be retained indefinitely for
    statistical purposes.

We also honor Shopify's mandatory GDPR webhooks (shop and customer data
requests, and shop redaction) for compliance.

5. INFORMATION SHARING

We do not sell your data. We only share information with:
- Essential Service Providers: Such as our cloud hosting and infrastructure
  providers, who are bound by data protection agreements.
- Legal Obligations: Where required by law or to protect our rights and the
  safety of others.

6. YOUR RIGHTS AND RESPONSIBILITIES

- Merchant Responsibilities: You are responsible for complying with privacy
  laws applicable to your store, informing your customers about your use of
  our app, and maintaining a lawful privacy policy for your storefront.
- Your Rights: You may request access to, correction of, or deletion of your
  information. To exercise these rights, contact us using the details below.

7. OTHER IMPORTANT INFORMATION

- International Data Transfers: We use appropriate legal safeguards for any
  international data transfers.
- Children's Privacy: Our service is directed at merchants and is not intended
  for children.
- Policy Updates: We will notify merchants of material changes to this policy
  through the app or by other reasonable means.

8. CONTACT US

If you have any questions about this Privacy Policy, please contact us:
- Email: support@afixer.app
- Website: https://upbar.afixer.app/

END OF PRIVACY POLICY