AS Upsell & Cross-Sell

Privacy Policy

for the AS Upsell & Cross-Sell app by Augmentum Studios Ltd, available on Shopify App store

Last updated: 21 April 2026

1. Who we are

This Privacy Policy explains how Augmentum Studios Ltd (“Augmentum Studios”, “we”, “us”, or “our”) processes personal data in connection with our Shopify app, a Cart Page Upsell Widget (the “App”).

Augmentum Studios Ltd is the controller of personal data about merchants using the App. For personal data of customers of Shopify stores, we generally act as a processor on behalf of the relevant merchant (the “Controller Merchant”).

Our App is distributed through the Shopify App Store, and we comply with Shopify’s data and user privacy requirements for apps.

2. Scope of this Privacy Policy

This Privacy Policy applies to:

This Privacy Policy does not apply to:

For those, please refer to the merchant’s store privacy policy and Shopify’s own privacy policy.

3. How the App works (high-level summary)

We only request and use Shopify scopes that are necessary for the App to function, in line with Shopify’s app requirements. We do not store any personal identifiable information of stores’ customers, or merchants themselves, other that what’s outlined below for shop identification purposes.

4. Personal data we process

4.1 Data about merchants and their store

We may process the following information about merchants and their store:

We do not intentionally store the merchant’s personal name, personal email, or address unless they are part of the Shopify shop account information provided to us by Shopify or are voluntarily provided via support communications.

4.2 Data about shoppers (customers of merchants)

The App does not store any directly identifying customer personal data (e.g., customer name, email address, phone number, or shipping address) in our database.

However, to function, the App may access order information via the Shopify read_orders scope. This may technically include customer personal data at the API level, but we do not persist or use those identifiers, and we have no control on what Shopify sends with their order data, and order data is necessary to provide the App’s functionality & enable the app’s billing. We only process order information to:

We therefore store only aggregated analytics, such as:

4.2.1 Per-product analytics

To help merchants optimize their offers and understand product-level performance, we also store per-product analytics for items sold through each offer. This includes:

This data is used solely to provide merchants with historical performance insights at the product level. No order references, customer identifiers, or other personally identifiable information is stored as part of this per-product analytics feature, or any other feature.

We do not store individual order events with customer identifiers; we aggregate data so that it cannot reasonably be linked back to an identifiable customer.

We do not store any order identifying data used in customer/merchant communication (e.g. Order ID used in customer/merchant communication emails), but we do store API level order ID (Shopify’s internal Order ID) to ensure revenue attribution accuracy and idempotency (i.e. so we do not process the same order twice and inadvertently over-attribute revenue).

4.3 Data processed in the cart and product pages

To distinguish items added by the app’s offers from items added elsewhere (i.e. other apps’ offers or products added directly by the merchant), we use line item properties, for example:

These properties are also crucial to attribute revenue to the correct offer, as well as enable the optional nested line items functionality on Product Page offers (i.e. when a product from the offer is added as an add-on of another product in the Product Page, being nested under that product - see nested line items in Shopify for more info).

5. How and why we use personal data (purposes & legal bases)

We process personal data for the following purposes and on the following legal bases:

  1. To provide and operate the App
    • Setting up and maintaining the merchant’s app configuration
    • Rendering the upsell widget on the supported surfaces (Cart Page, Cart Drawer, Product Page)
    • Tracking eligibility and status of the App Blocks and App Embeds in the theme
      Legal basis: Performance of a contract (or steps prior to entering into a contract) with the merchant.
  2. To provide analytics and reporting to merchants
    • Aggregating views, add-to-carts, purchases, and attributed revenue for offers configured with this app
      Legal basis: Performance of a contract; and/or our legitimate interests in improving and reporting on our services.
  3. To maintain security, prevent abuse, and fix issues
    • Monitoring logs and system metrics
    • Protecting the App from misuse, fraud, and security incidents
      Legal basis: Legitimate interests (security and fraud prevention) and, where applicable, legal obligations.
  4. To manage billing and subscriptions
    • Processing Shopify app charges (e.g., billing tiers, free trial) via Shopify Billing API with usage based pricing and potentially other billing models
    • Normalizing attributed revenue to USD to support usage-based pricing and revenue attribution reporting. Shopify orders typically include the shop’s currency (the store’s default currency) and the presentment currency (the currency the shopper paid in), but do not provide all exchange rates needed to normalize revenue to a single currency.
    • To perform this normalization, we retrieve USD exchange rates from Open Exchange Rates (https://openexchangerates.org/) and refresh them hourly. We use the latest available exchange rate we have available in our database records at the time of attribution.
    • We do not guarantee that exchange rates will be refreshed without interruption at all times. If rate refresh fails, we reserve the right to use the last available exchange rate we have stored, and we will use reasonable efforts to detect issues and restore hourly refresh so that the latest rates are used.
    • Tracking subscription status and renewal Legal basis: Performance of a contract; legitimate interests in being paid for our services.
  5. To comply with Shopify and legal requirements
    • Responding to mandatory privacy law compliance webhooks:
      • customers/data_request
      • customers/redact
      • shop/redact
    • Complying with applicable data protection laws (e.g., GDPR/UK GDPR).
      Legal basis: Compliance with legal obligations.

We do not:

6. Shopify API scopes and how we use them

We use the following Shopify scopes only for the purposes described below:

  1. read_orders
    • To access orders created in the merchant’s store;
    • To check if orders contain upsell items originating from the App;
    • To calculate and store aggregated analytics such as attributed revenue per offer, which is necessary for revenue usage based billing.
    • We do not store customer identifiers such as names, emails, addresses, or phone numbers from these orders.
  2. read_reports
    • To access store-level reporting data made available through Shopify’s reporting APIs;
    • To enrich the metrics and contextual insights presented in the App’s merchant dashboard, so merchants can interpret upsell performance alongside broader store trends and make better-informed commercial decisions.
  3. read_products & write_products
    • To allow merchants to configure upsell offers by selecting products and variants in the App Admin UI;
    • To add line item properties to cart items to distinguish upsell-originated items and support the offers’ functionality;
    • We do not modify product details beyond what is necessary for the upsell configuration and identification logic.
  4. read_themes
    • To read theme information so we can provide feedback in the App Admin UI about whether the App Block is installed and active in the theme.
  5. read_locales
    • To read the locales configured in the merchant’s store;
    • To provide translation options for the upsell widget’s copy, so that offer labels and text can be tailored to each of the store’s active locales.
  6. read_translations
    • To read translation resources for theme and related storefront content via Shopify’s Translations API;
    • So that localized widget copy can be rendered accurately in the App’s in-editor preview before merchants publish or launch changes on the live storefront.
  7. write_discounts
    • To allow the App to configure and apply discounts to products sold within the App’s offers;
    • This scope is required to support automatic discount functionality on upsell items as configured by the merchant.
  8. read_metaobjects & write_metaobjects
    • To read and write Metaobject entries used by the App to store structured offer configuration data;
    • Metaobjects are Shopify’s recommended mechanism for apps to manage custom structured data that can be efficiently accessed from the storefront, minimizing performance impact on merchants’ stores.
  9. read_metaobject_definitions & write_metaobject_definitions
    • To read and create the Metaobject type definitions (schemas) that the App requires to store its data structures;
    • These definitions are created once during App setup and are required before any Metaobject entries can be created or read.

These uses are intended to be consistent with Shopify’s guidance on limited permissions and protected customer data.

7. Cookies and similar technologies

Any such use is limited to what is necessary to operate the App. Merchants should also refer to Shopify’s own policies regarding cookies and tracking technologies.

8. Sub-processors and data sharing

We may share data with the following categories of service providers (“sub-processors”) to operate the App:

These service providers may process data only on our behalf, in accordance with our instructions, and under appropriate contractual safeguards, including data protection and confidentiality obligations.

We may also disclose information:

We do not sell personal data to third parties.

9. International data transfers

Our infrastructure and sub-processors may be located in the United Kingdom, the European Economic Area (EEA), or other countries, including the United States.

Where we transfer personal data from the UK or EEA to countries that do not provide an equivalent level of data protection, we rely on appropriate safeguards, such as:

10. Data retention

We retain data only for as long as necessary for the purposes set out in this Privacy Policy, including:

When Shopify sends us a shop/redact webhook, we will delete or anonymize personal data related to that store within 30 days, unless we are legally required to retain certain information.

For customer data redaction and data requests:

Aggregated analytics that no longer contain personal data may be retained for longer for statistical and product improvement purposes.

11. Security

We take reasonable technical and organizational measures to protect personal data, including:

However, no method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.

12. Your rights (merchants and staff)

Depending on your location (for example, under the UK GDPR or EU GDPR), you may have the following rights in relation to personal data we hold about you:

If you are a merchant or member of a merchant’s staff, you can exercise these rights by contacting us at:

We may need to verify your identity before fulfilling your request.

13. Rights of customers of merchants (data we process as a processor)

If you are a customer of a Shopify store that uses our App:

We will assist the merchant in fulfilling data requests by:

14. Children

The App is intended for business users only (Shopify merchants and their staff) and is not directed at children. We do not knowingly collect personal data from children.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in:

We will indicate the “Last updated” date at the top of this document and, where appropriate, provide additional notice (for example, via the App Admin UI or email).

16. Contact us

If you have any questions about this Privacy Policy or our data practices, please contact:

Your use of the service is also governed by our Terms of Use.

‍