Privacy policy — Lilya: Pro Program & Discounts

This policy describes how Lilya: Pro Program & Discounts (“the app”) handles data when a Shopify merchant installs and uses it. The app is made by Lilya Work. Contact: support@lilya.work.

Who this applies to

The app is used by merchants and their staff in the Shopify admin to run a pro or trade discount program: professionals apply on the merchant’s online store, the merchant approves or rejects them, and approved members get an automatic discount for the length of their membership. The applicants and members are the merchant’s customers; the merchant decides who becomes a member and is responsible for their relationship with them, and the app processes their data on the merchant’s behalf.

Data the app accesses

When you install the app you grant it the Shopify permissions read_customers, write_customers, write_discounts, read_orders, read_validations, write_validations, write_app_proxy and customer_read_customers. With them the app:

• Reads and, when needed, creates the Shopify customer for each member: customer ID, name and e-mail address. It creates a customer when you approve someone who applied without an account, add a member by e-mail or import members who aren’t customers yet. It does not read addresses, phone numbers or payment details.
• Saves each member’s membership in your own Shopify store, as app data on the customer (a customer metafield): status, end date, discount percentage and the discount allowance left. Shopify’s checkout reads it to apply the discount; the member can see it in their customer account if you add the app’s block there.
• Marks members as tax exempt in Shopify, and removes that mark when a membership is cancelled, only if you turn on “Mark members as tax exempt”.
• Creates one automatic discount and one checkout rule in your store, both run by the app’s Shopify Functions, and saves your program’s discount percentage on your store for the product page block.
• Reads new and cancelled orders of members (customer ID, order ID, subtotal and the member discount on the order) to count the discount used against the allowance and to show the program’s value.
• Serves the program page /apps/pro and the application form block on your online store through Shopify’s app proxy. Shopify tells the app which customer is logged in, so a member sees their own membership.
• Sends Shopify Flow events (membership started, renewed, ending, expired, cancelled) with the customer ID, the end date and how the membership started, if you use Shopify Flow.

Data applicants enter

The application form always asks for first name, last name and e-mail address. You choose whether it also asks for a company or organization, a role or job title, a free text note, a member group, an invite code, and proof files (PDF or images, up to 3 files of 5 MB each). It never asks for an address or phone number. Applicants can tick an optional, separate box to agree to marketing e-mails; the app only records the answer and shows it to you. It does not send marketing e-mails and does not change the customer’s marketing consent in Shopify. If you add program terms, applicants must accept them to apply.

Data the app stores

• Your store’s myshopify.com domain and the access token Shopify gives the app; your plan and trial status.
• Your program settings, member groups and your own versions of the member e-mails.
• For each application: the applicant’s name, e-mail address, Shopify customer ID (if they were logged in), the answers, the marketing answer, the chosen group, the language of the form, the status, the reason you entered when rejecting, and the dates.
• Proof files uploaded with an application or a renewal request, in private storage. Only your staff can open them, from the application page in the Shopify admin.
• For each member: Shopify customer ID, name and e-mail address (copied from Shopify for the member list, search and e-mails), status, start and end date, group, personal discount percentage, the discount used in the current period, how the membership started, the language for e-mails, a renewal request date and a note your staff can write.
• A history of each membership (approved, renewed, end date changed, cancelled, imported, reminder sent…) with dates and short details, without personal data.
• For each order with the member discount: order ID, customer ID, the discount amount, the order subtotal and the membership period it counted against.
• For each member e-mail: the customer ID, which e-mail it was, the period or application it belonged to, the time and the delivery result. This stops the same e-mail from being sent twice; the e-mail’s content is not stored.

The app does not store addresses, phone numbers, order line items or payment details.

Member e-mails

The app e-mails applicants and members when an application is received, approved or rejected, when a membership is renewed, 30 and 7 days before it ends and when it has ended. You can switch each e-mail off and change its text. E-mails are sent from notify@mail.lilya.work with the sender name “Lilya Pro Program – ” followed by your store’s name, and your store’s contact e-mail as the reply-to address, in the applicant’s language where available. They contain your store name, the program name, the discount, the end date, a link to the program page and, for a rejection, the reason you entered. They have no tracking pixels and no marketing. “Send test email” sends an example to your store’s contact e-mail. E-mails are delivered through Cloudflare Email Sending.

How the data is used

Only to provide the app’s features: taking applications, approving and managing members, applying the member discount and checkout rules, sending member e-mails, showing the program’s value and applying your plan. We do not sell data, use it for advertising, profile customers, or share it with third parties other than the service providers below. The app never decides on its own who becomes a member: you approve applications, or the app approves at once an applicant who enters one of your invite codes or has an e-mail address at one of the domains you listed.

Service providers

• Cloudflare, Inc. runs the app and stores its data (Workers, D1 database and R2 file storage, Western Europe) and delivers member e-mails (Cloudflare Email Sending). Error logs contain your store domain and are kept by Cloudflare for a few days; request logs that could contain customer details are turned off.
• Shopify processes billing through Shopify App Pricing. The app asks Shopify’s Partner API which plan your store is on.

Retention and deletion

• Applications, proof files, members, history, order records and e-mail records are kept while the app is installed, so you can see a member’s full history and the allowance stays correct.
• When you uninstall the app, its access token is deleted and the app stops working in your store; the member discount and checkout rule stop applying.
• 48 hours after you uninstall, Shopify asks us to erase your store’s data (shop/redact) and the app deletes everything it stores for your store, including the proof files. If you reinstall within those 48 hours, it is kept.
• When Shopify asks us to erase a customer’s data (customers/redact), the app deletes that customer’s applications (also those sent without an account, matched by e-mail address), proof files, membership, history, order records and e-mail records.
• When Shopify forwards a customer’s data request (customers/data_request), we send you the records we hold for that customer within 30 days.
• Customers the app created and their tax exempt mark are part of your Shopify store and stay after uninstall; remove the tax exempt mark in Shopify if you no longer want it. Shopify removes the app’s data on customers (the membership) when the app is uninstalled.

Security

Admin requests are authenticated with Shopify session tokens; storefront requests are checked with Shopify’s app proxy signature and rate limited. Data is sent over HTTPS only and is encrypted at rest by Cloudflare, including backups. Proof files are never public: they are served only to signed-in store staff through the app. Only the developer has access to the production systems, with two-factor authentication.

Your rights

You can ask for a copy of the data the app holds about your store, or ask us to delete it before you uninstall, by writing to support@lilya.work. Your customers can contact you, and you can forward their requests to us. You can also complain to the data protection authority where you live.

Changes

If we change this policy we update the date at the top of this page.