bannerbirdPrivacy policy
Bannerbird shows free-shipping, countdown and announcement bars on Shopify stores. This policy explains what we collect from the merchants who install it and from the shoppers who visit their stores, why, and how long we keep it. The short version: we collect what the bars need to work and to count how they perform, we never collect shoppers' names, emails or addresses, and we don't sell anything to anyone.
Merchants who install Bannerbird
When you install Bannerbird, Shopify gives us:
- your store's address (for example, your-store.myshopify.com), time zone and currency;
- an access key that lets the app work with your store on your behalf, and which permissions you granted;
- your Bannerbird plan and its billing status, which Shopify handles. We never see card details.
We also keep the bars you create (their wording, design, targeting and schedule) and, if a free-shipping bar leaves out certain products, the IDs of those products. With your permission, the app reads:
- Your theme's settings, to check that the Bannerbird app embed is switched on. We never change your theme.
- Your products and collections, to work out which products a free-shipping goal leaves out.
- Orders, only to confirm an order's total and date when our checkout tracker reports it (see "Orders after seeing a bar" below).
We use this to run the app for you and to support you when you contact us. We don't store the names or email addresses of you or your staff.
Shoppers who visit a store that uses Bannerbird
The store that uses Bannerbird decides what shoppers see and is responsible for its shoppers' data. We process it for the store, as its service provider.
Shown without sending anything to us. Bars are shown from data the store already has, inside the shopper's browser. To work properly, the bar script keeps a few things in that browser's storage, never on our servers:
- which bars the shopper closed, so they stay closed;
- which version of a bar the shopper sees, when the store is testing two versions;
- when the shopper first saw a per-visitor countdown, so it keeps counting down;
- for the current visit only, where the shopper came from (an ad campaign tag or the referring site), when a bar targets traffic sources.
Counting views and clicks. The script tells our server, through the store's own address, when a bar is shown, clicked or closed, or when a free-shipping goal is reached, with the bar's ID and version. We add these to daily totals per bar and don't store anything about who the shopper is.
Orders after seeing a bar. Only if the shopper allows analytics in the store's cookie banner (Shopify's customer privacy settings), the script keeps a small first-party cookie, bnb_seen, for 7 days. It lists up to 10 bars the shopper saw and when. When the shopper completes a checkout, our tracker, which runs in Shopify's checkout under the same analytics consent, sends us the store's address, the order's ID and that list. We look up the order's total and date with Shopify, add the total to the daily figures of the bars the shopper saw, and keep the order ID for 3 days so the same order can't be counted twice. We never receive or store the shopper's name, email, address or what they bought. To stop abuse, Cloudflare's rate limiter counts reports per sending IP address for one minute, to limit how many reports one address can send. The address isn't written to our database, but Cloudflare's request logs may record it for up to 7 days.
We don't use this information for advertising, profiling or automated decisions about anyone, and we don't sell or share it.
Who else handles the data
- Shopify runs the store, the checkout, billing and the app platform.
- Cloudflare runs our app on its worldwide network and keeps our database in the United States.
We'd also share information if the law requires it, and with a buyer of the business, who would be bound by this policy.
How long we keep it
- Store details, bars and daily totals: for as long as Bannerbird is installed.
- Order IDs: 3 days.
- When you uninstall Bannerbird, the access key is deleted at once. Shopify then asks us to delete the store's data 48 hours later, and we delete everything we hold about the store: its details, bars and figures.
How we protect it
All traffic to and from the app is encrypted (HTTPS). The database and its backups are encrypted at rest by Cloudflare. Only the people who run Bannerbird can reach production data, with strong passwords and two-step sign-in, and test data is kept apart from it. If a security incident affected your data, we'd tell you and Shopify promptly, as the law and Shopify require.
Your choices and rights
- Merchants can ask to see, correct or delete their data by emailing us, or delete it by uninstalling the app.
- Shoppers can decline analytics in the store's cookie banner; Bannerbird then sets no cookie and counts no orders for them. Bars' other choices live only in their own browser, and clearing the browser's site data removes them. Because we don't hold shoppers' personal details, requests from shoppers go to the store. When Shopify forwards a shopper's request to see or delete their data, we answer it: there is nothing about them to return or delete.
Depending on where you live, you may have rights under laws such as the GDPR or California's privacy laws, including to complain to your data protection authority. We'll help with any request we can.
Children
Bannerbird is a tool for businesses and isn't meant for children.
Changes
If we change this policy, we'll update the date at the top. If a change affects how we use merchants' data, we'll tell merchants in the app or by email before it takes effect.
Contact
Email support@bannerbird.bar.