Privacy Policy

1. Who we are

TierFlow is operated by TierFlow LLC, a limited liability company registered in California, USA.

TierFlow LLC is the data controller for merchant data and, where applicable under GDPR, acts as a data processor on behalf of merchants for any end-customer data that flows through the app.

2. Scope

This policy applies to:

• The TierFlow Shopify app (the "App")
• The marketing website at tierflow.app
• Any related support or communication channels

It covers data collected from merchants (Shopify store owners who install TierFlow) and data processed about their end-customers during checkout.

3. Data we collect from merchants

§3.6 — Marketing & Communications Data

When you install TierFlow, we receive your shop owner email address via Shopify. We may use this to send:

• Product updates and new feature announcements
• Promotional offers and plan upgrade suggestions
• TierFlow newsletter and tips

This is separate from transactional emails (billing alerts, policy updates, GDPR notices) which are required for the service and cannot be opted out of.

Your choices:

• US merchants (CAN-SPAM): Every marketing email includes an unsubscribe link. Opt-outs are honored within 10 business days.
• EU/UK merchants (GDPR): We rely on consent for marketing emails. You will be given an explicit opt-in opportunity at first login. You may withdraw consent at any time via the unsubscribe link or by emailing care@tierflow.app.
• Canadian merchants (CASL): We rely on implied consent arising from the install relationship for 24 months. You may unsubscribe at any time.

4. Data we process about end-customers

TierFlow applies tier pricing using real Shopify product variants, so the price a shopper sees is the price they pay at checkout. To report on how those tiers perform, we keep records about the orders placed in your store.

Order attribution records

For each order we store a row containing the Shopify order identifier, the order number and name, the product identifiers and titles involved, quantities, the revenue attributed to the order, and whether any discount codes were used. We keep these records for as long as they are needed for your reporting.

Aggregate statistics

We also store daily totals per store, such as the number of orders and total revenue for a given day. These contain no order or customer identifiers.

Shopify protected customer data

Shopify classifies certain information, including order records and customer name and email address, as protected customer data. Access to it is granted by Shopify on a per-app basis.

TierFlow does not currently store customer names or email addresses. We are developing customer analytics features, such as repeat purchase reporting, that would require Shopify approval to access a customer's email address and name. If and when those features launch, we will process that data only to provide the feature to the merchant whose store it came from, only where Shopify has approved the access, and we will update this policy before doing so.

5. How we use the data

We do not sell your data, use it for advertising targeting, or share it with third parties beyond the sub-processors listed in Section 7.

6. Legal bases (GDPR)

If you are located in the European Economic Area (EEA), UK, or Switzerland, we process personal data under the following legal bases:

Where we act as a data processor on your behalf, such as when we store order attribution records about your customers' orders, we rely on your instructions as the data controller.

7. Sub-processors & third-party sharing

We use the following sub-processors. All are contractually bound to process data only on our instructions and to maintain appropriate security measures.

We do not share data with analytics platforms (e.g., Google Analytics), advertising networks, or data brokers.

We may disclose data if required by law, court order, or to protect the rights and safety of TierFlow LLC, our merchants, or others.

8. Data retention

We retain information only for as long as reasonably necessary to provide the service, satisfy applicable Shopify requirements, resolve disputes, and meet our legal obligations.

When you uninstall TierFlow, your Shopify access tokens are deleted immediately. Shopify then notifies us to erase the rest of your shop's data, and we act on that notification.

9. International transfers

TierFlow LLC is based in the United States. If you are accessing TierFlow from outside the USA, your data may be transferred to and processed in the USA.

For EEA/UK merchants, such transfers are covered by:

• Standard Contractual Clauses (SCCs) with our sub-processors where required.
• Shopify's Data Processing Addendum and Privacy Shield commitments.

We take reasonable steps to ensure your data receives the same level of protection as it would in your home jurisdiction.

10. Security

Measures we have in place include:

• TLS encryption for data in transit between TierFlow, Shopify and your browser
• Shopify OAuth for store authentication, so we hold scoped access tokens rather than your store credentials
• HMAC verification of every webhook we receive from Shopify before its contents are processed
• Administrator access protected by a password and a mandatory authenticator app code, with rate limiting and expiring sessions
• Credentials supplied through environment configuration rather than stored in source code
• A written incident response process covering containment, investigation, remediation and notification

Data at rest is held by our infrastructure providers and is subject to their platform security controls. We do not make specific claims about storage or backup encryption on their behalf.

More detail is on our Security page.

No system is completely secure. If you believe your data has been compromised, contact us immediately at care@tierflow.app.

11. Your rights

Depending on your location, you may have the following rights regarding your personal data:

To exercise any of these rights, email care@tierflow.app with the subject line "Data Rights Request". We will respond within 30 days (or as required by applicable law).

If you are in the EEA, you also have the right to lodge a complaint with your local supervisory authority.

12. Cookies & tracking

Marketing website (tierflow.app)

The marketing website does not use analytics cookies or third-party tracking pixels. We do not use Google Analytics, Meta Pixel, or similar services.

Shopify admin (embedded app)

The TierFlow admin interface is embedded in the Shopify admin using an iframe. Shopify may set cookies necessary for their admin session. We do not set additional tracking cookies in the admin.

Storefront widget

The TierFlow JavaScript widget runs on your storefront. It uses sessionStorage to preserve tier selection during a browsing session. No cookies are set and no data is sent to TierFlow servers from the widget beyond the order-processing requests described in Section 4.

13. Children's privacy

TierFlow is a business-to-business (B2B) service intended for Shopify merchants. We do not knowingly collect personal data from individuals under the age of 13 (or 16 in the EEA).

If you believe we have inadvertently collected data from a child, please contact us at care@tierflow.app and we will delete it promptly.

14. CCPA / CPRA (California)

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) grants you specific rights.

Categories of personal information collected

In the preceding 12 months, we have collected the following categories as defined by the CCPA:

• Identifiers — Shop domain, Shopify store ID
• Commercial information — Aggregate order analytics
• Internet or network activity — App usage logs

We do not sell or share personal information

TierFlow LLC does not sell personal information and does not share personal information for cross-context behavioural advertising as defined by the CCPA/CPRA.

Your California rights

• Right to know what personal information is collected, used, shared, or sold
• Right to delete personal information
• Right to correct inaccurate personal information
• Right to opt-out of sale/sharing (not applicable — we don't sell)
• Right to non-discrimination for exercising your rights

To submit a CCPA request, email care@tierflow.app with subject "CCPA Request".

15. LGPD (Brazil)

If you are located in Brazil, the Lei Geral de Proteção de Dados (LGPD) may apply to your data.

The legal bases we rely on under the LGPD mirror those described in Section 6 (contract performance, legitimate interests, consent, legal compliance).

You have the right to confirmation of processing, access, correction, anonymisation, portability, deletion, and information about third-party sharing. To exercise these rights, contact care@tierflow.app.

16. PIPEDA (Canada)

If you are located in Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws may apply.

We collect, use, and disclose personal information only for the purposes identified in this policy, with your knowledge and consent (express or implied). You may withdraw consent at any time, subject to legal or contractual restrictions.

To exercise your rights under PIPEDA, contact care@tierflow.app.

17. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will:

• Update the "Last updated" date at the top of this page
• Post a notice in the TierFlow admin dashboard for material changes
• Email registered merchants for significant changes affecting their rights

Continued use of TierFlow after changes take effect constitutes acceptance of the updated policy.

Previous versions of this policy are available on request by emailing care@tierflow.app.