Privacy Policy

1. Information We Collect

We collect information necessary to operate the application, provide requested functionality, maintain security, improve our services, and comply with applicable legal requirements. The information we process depends on the Shopify features and Monkeys BXGY functionality enabled by the merchant.

Merchant and account information. When a merchant installs or uses Monkeys BXGY, we may receive or process information associated with the Shopify store and the people administering the application.

• Shopify shop domain
• Shopify store identifier
• Merchant account or administrator identifiers where provided by Shopify
• Name, email address, or other contact information when voluntarily provided to us through support or other direct communication
• Shopify OAuth/session information required to authenticate the application
• Application configuration and installation information
• Subscription and application-plan status
• Technical information required to maintain the service

2. Shopify Store and Commerce Information

Monkeys BXGY may process Shopify store information required to provide promotion functionality. Depending on the features used by the merchant, this may include products, product variants, collections, product tags, product types, vendors, product and variant identifiers, product availability information, inventory-related information required for gift eligibility, prices and compare-at prices, Shopify Markets information, currencies, promotion and discount configuration, cart-related information, promotion eligibility information, gift configuration, bundle configuration, promotion scheduling information, and promotion priority and stacking configuration.

We use this information to configure, evaluate, present, and enforce promotions requested by the merchant.

Monkeys BXGY does not maintain a separate database of the merchant's complete product catalog, inventory, orders, or customers as a replacement for Shopify. Shopify remains the source of truth for Shopify commerce data.

3. Customer-Related Information

Monkeys BXGY is designed to minimize customer-related data processing. Depending on the functionality enabled by the merchant and the permissions approved by Shopify, we may process limited information relating to a customer or prospective customer to determine promotion eligibility, attribution, analytics, or other merchant-requested functionality.

• Customer or buyer identifiers
• Customer segment identifiers
• Eligibility-related information
• Logged-in or guest status
• New or returning customer status
• Order-related eligibility information
• Minimum order count or spend eligibility
• Information necessary to determine whether a customer qualifies for a promotion

4. Customer Data We Do Not Process

We do not request or retain customer names, email addresses, phone numbers, or postal addresses unless a specific Shopify-supported feature requires such information and Shopify has approved our access.

Where customer information is processed, we process only the minimum information required for the relevant functionality.

We do not maintain a customer relationship management database containing the customers of merchants using Monkeys BXGY. We do not sell customer personal information. We do not use identifiable customer information obtained through Shopify to create unrelated advertising profiles.

5. Customer Segments

If a merchant enables customer-segment targeting, Monkeys BXGY may process Shopify Customer Segment identifiers or other eligibility information permitted by Shopify. This information is used only to determine whether a customer qualifies for a promotion or other merchant-configured experience.

Customer segment information is not used to create customer profiles for unrelated purposes. Where technically possible, segment eligibility information is processed temporarily and is not retained after it is no longer required for the eligibility decision.

Access to protected customer data is subject to Shopify's approval and applicable Shopify requirements. If Shopify restricts, redacts, or denies access to required customer information, Monkeys BXGY will fail safely rather than assuming eligibility.

6. Orders and Attribution

Where order attribution functionality is enabled and supported by Shopify, Monkeys BXGY may process limited order-related information necessary to measure promotion performance. This may include promotion identifier, promotion version, order identifier or reference, promotion attribution information, attributed revenue, timestamp, and limited eligibility or campaign information.

We do not use order information to maintain a separate merchant order database. Order-related information is used only for the purposes described in this Privacy Policy and for functionality requested by the merchant.

If Shopify restricts access to order information, Monkeys BXGY will not attempt to bypass those restrictions.

7. Promotion Analytics

Monkeys BXGY may provide analytics relating to promotions and conversion experiences. Depending on the features enabled, analytics events may include promotion identifier, promotion version, event type, timestamp, anonymous or session identifier, promotion exposure, interaction, gift selection, cart interaction, conversion, attributed order reference, attributed revenue, tier information, country or market, device category, and campaign or UTM information.

We use these events to provide promotion analytics, attribution, reporting, diagnostics, security, and product improvement.

We do not represent analytics as proof that a promotion caused a particular increase in revenue or conversion unless the relevant evidence and methodology support such a conclusion.

8. UTM and Campaign Information

Where UTM targeting or attribution is enabled, Monkeys BXGY may process campaign parameters including utm_source, utm_medium, utm_campaign, utm_term, and utm_content.

UTM information may be used to determine promotion eligibility, maintain campaign attribution, and report promotion performance. We do not use UTM information obtained through the merchant's store to create unrelated advertising profiles.

9. Country, Market, and Currency Information

Where market or country targeting is enabled, Monkeys BXGY may process information such as country, Shopify Market, market identifier, currency, and regional promotion configuration. This information is used to determine promotion eligibility or display behavior according to the merchant's configuration.

Monkeys BXGY does not require precise GPS location to provide country or market targeting.

10. Storefront and Theme Information

Monkeys BXGY may provide Theme App Extensions and storefront functionality such as promotion messaging, progress indicators, countdown displays, gift selection, bundle interfaces, cart promotion messaging, upsell and cross-sell experiences, automatic gift selection, and promotion landing pages.

Storefront components are designed to receive only the information necessary to provide the relevant merchant-configured experience.

Promotion discounts are not trusted from storefront JavaScript. Where applicable, final discount eligibility and discount value are determined through Shopify's supported discount infrastructure and Shopify Functions.

11. Cookies and Similar Technologies

We may use cookies, session storage, local storage, or similar technologies when necessary to authenticate merchants, maintain application sessions, provide storefront functionality, maintain anonymous or session-level attribution, protect the service, prevent abuse, understand application usage, and maintain application functionality.

We do not use tracking technologies for purposes unrelated to the functionality disclosed in this Privacy Policy.

Where Shopify provides customer privacy or consent mechanisms for storefront tracking or Web Pixels, Monkeys BXGY will use Shopify-supported mechanisms and respect applicable consent signals.

12. Automatically Collected Technical Information

When you access our website or application, we may automatically collect limited technical information such as IP address, browser type, operating system, device type, referring URL, pages or application screens accessed, date and time of access, application errors, diagnostic information, and security events.

We use this information for security, fraud and abuse prevention, troubleshooting, service operation, performance monitoring, and aggregated analytics. We do not use technical information to create unrelated consumer profiles.

13. How We Use Information

We may use information for providing and operating Monkeys BXGY; authenticating merchants; processing and enforcing promotion rules; providing discounts and rewards; providing gift and bundle functionality; determining promotion eligibility; providing customer-segment targeting where approved; providing UTM and campaign targeting; providing country and market targeting; providing promotion analytics; measuring attribution; providing reporting and dashboards; diagnosing and fixing technical problems; preventing fraud, abuse, and security incidents; improving application functionality; developing new features; performing aggregated and anonymized statistical analysis; understanding general product usage; complying with applicable laws; responding to lawful requests; and enforcing our Terms of Service.

14. Commercial and Product-Improvement Use

We may use aggregated, anonymized, de-identified, or otherwise non-identifying information for legitimate business purposes, including product development, product improvement, service optimization, benchmarking, statistical analysis, business planning, security analysis, performance analysis, research and development, understanding general promotion trends, and measuring aggregate application usage.

We may use aggregated statistics for commercial purposes. We do not sell identifiable customer personal information. We do not use identifiable Shopify customer information obtained through the application for unrelated advertising or marketing purposes. We do not attempt to re-identify properly anonymized or de-identified information.

15. Data Sharing

We may share information only as reasonably necessary to provide and protect the service.

Service providers. We may use infrastructure, hosting, database, monitoring, analytics, security, communication, and other service providers that process information on our behalf. Service providers are expected to process information according to our instructions and applicable contractual obligations.

Shopify. Monkeys BXGY operates through Shopify's platform and may exchange information with Shopify APIs, Shopify Functions, webhooks, and other Shopify-supported services.

Legal and regulatory authorities. We may disclose information where reasonably necessary to comply with applicable law, respond to a valid legal process, protect our rights, protect the security of our service, investigate fraud or abuse, or protect merchants, customers, or the public.

Business transactions. If Monkeys BXGY or substantially all of its assets are involved in a merger, acquisition, financing, restructuring, sale, or similar transaction, relevant information may be transferred as part of that transaction, subject to applicable law and contractual protections.

16. We Do Not Sell Customer Personal Information

We do not sell customer personal information obtained through merchants' Shopify stores.

We may use aggregated, anonymized, or de-identified information for commercial and product-development purposes as described above.

Where applicable law provides an opt-out right relating to data sharing or sale, we will respect the applicable legal requirements.

17. Data Retention

We retain information only for as long as reasonably necessary for the purposes described in this Privacy Policy, unless a longer period is required by law.

• OAuth/session information: retained while required to operate the merchant's installation and for a limited period necessary to process uninstall and security operations
• Promotion configuration: maintained through Shopify as the commerce/promotion source of truth
• Temporary customer eligibility information: retained only as long as reasonably necessary for the eligibility decision
• Customer segment identifiers: not retained longer than reasonably necessary for the relevant eligibility operation
• Analytics data: retained according to our operational analytics retention policy
• Attribution data: retained according to our attribution and analytics retention requirements
• Audit and security logs: retained for security, troubleshooting, legal, and operational purposes for a reasonable period
• Temporary processing data: deleted when no longer required
• Backups: deleted or overwritten according to the applicable backup lifecycle

18. Security

We use reasonable technical and organizational safeguards designed to protect information. These measures may include encrypted connections using TLS, access controls, least-privilege access, secure secret management, authenticated application sessions, CSRF protection, Shopify webhook verification, signed request verification where applicable, environment separation, monitoring and security logging, controlled infrastructure access, backup and recovery procedures, and secure deletion procedures.

Shopify access and refresh tokens are encrypted at rest using AES-256-GCM before they are written to our database, in addition to being transmitted over TLS.

No internet-based service can guarantee absolute security. If we become aware of a security incident requiring notification under applicable law, we will follow the applicable notification requirements.

19. International Data Transfers

Monkeys BXGY may use infrastructure and service providers located in countries other than the country where the merchant or customer is located.

Where required, we will use appropriate safeguards for international data transfers in accordance with applicable privacy laws.

20. Data Subject Rights

Depending on applicable law, individuals may have rights relating to their personal information, including access, correction, deletion, restriction, objection, portability, withdrawal of consent where applicable, and rights relating to automated decision-making where applicable.

Because Monkeys BXGY operates as a Shopify application, certain requests may need to be handled through the merchant or Shopify. We will cooperate with valid privacy requests and Shopify's mandatory privacy processes.

21. Shopify Compliance Requests

Monkeys BXGY supports Shopify's mandatory privacy and compliance processes. Where Shopify sends a valid privacy-related request, we will process it according to applicable Shopify requirements and our legal obligations.

We verify Shopify webhook authenticity before processing compliance requests.

22. Children's Privacy

Monkeys BXGY is a business-to-business service intended for Shopify merchants. We do not knowingly collect personal information directly from children for the purpose of providing our service.

23. Third-Party Services

Monkeys BXGY may depend on Shopify and other third-party infrastructure or service providers. Those third parties may have their own privacy policies and terms.

We encourage merchants to review the privacy practices of third-party services that they choose to connect to or use with Monkeys BXGY.

24. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our services, changes to data processing, changes to Shopify platform capabilities, legal or regulatory requirements, security improvements, or operational changes.

When material changes are made, we may provide notice through the application, website, email, or other reasonable means. The updated version will include a revised “Last Updated” date.

25. Contact

For privacy questions, data requests, or concerns regarding this Privacy Policy, contact PRIVACY@monkeysads.com.

Company: Monkeys Marketing. Business address: Building 41, Heliopolis Gardens, Egypt. Website: https://bxgyapp.monkeysads.com.

This Privacy Policy is intended to describe our actual data practices. If a future feature materially changes the categories of personal information we process, this Privacy Policy will be updated before that feature is made available where required by law.