Privacy policy
This policy explains what information the Sale Sight Shopify app processes, why, who it is shared with, and how long it is kept. It is effective as of October 26, 2026.
Who we are
Sale Sight is operated by Carterdea LLC (“we”, “us”), an Arizona limited liability company. For privacy questions or requests, email privacy@salesight.app.
What Sale Sight does
Sale Sight reads a store’s automatic discounts and products from Shopify,
calculates the discounted price for eligible products, and shows that price on
the storefront through a theme app embed. It requests only two Shopify access
scopes: read_discounts and read_products. It does not request access to
customers, orders, checkouts, or payments.
Information we collect
Store and installation data
- Shop domain (for example,
example.myshopify.com) - Shopify access token and session record for the shop
- Install and uninstall dates, plan status, and sync timestamps
- Settings the merchant chooses, such as price selectors and whether segment-restricted discounts are enabled
Sale Sight uses Shopify offline access tokens. It does not store the names or email addresses of the merchant’s staff accounts.
Catalog and discount data
- Automatic discount IDs, titles, values, start and end dates, and status
- Which products, variants, and collections a discount applies to
- Product and variant IDs, product handles, prices, and currency
- Customer segment IDs attached to a discount, if the merchant has turned on segment-restricted discounts. These are Shopify identifiers for a segment, not information about individual customers.
- Sync and price-check records, such as counts, status, and error messages
Operational logs
When the app or its storefront endpoints receive a request, our hosting provider records standard request data, such as time, URL, status code, IP address, and user agent. Our application logs record events such as sync results and errors, identified by shop. We filter tokens, secrets, cookies, and session values out of application logs.
If you email us, we receive your email address and anything you include in the message.
Shopper data
Sale Sight does not collect, store, or profile the merchant’s customers.
The storefront embed runs in the shopper’s browser on the merchant’s store. It reads the product and price shown on the page and requests discount prices from Sale Sight through Shopify’s app proxy. It does not set cookies, does not use local storage or session storage, and does not include analytics, advertising, or tracking code.
Because these requests pass through Shopify’s app proxy, Shopify may attach information such as the shopper’s IP address and, if the shopper is logged in, their Shopify customer ID. Sale Sight does not read, use, or store that customer ID. Request details may appear briefly in our hosting provider’s request logs, which are deleted on the schedule described under Retention.
How we use information
We use the information above only to:
- Install, authenticate, and run the app for the merchant
- Sync discounts and products and calculate storefront prices
- Show prices on the storefront and settings in the Shopify admin
- Monitor, debug, and secure the service
- Respond to support and privacy requests
- Meet legal obligations
We do not sell personal information, share it for cross-context behavioral advertising, or use it to train AI models. We do not use any information for advertising.
Legal bases (EEA and UK)
Where the GDPR or UK GDPR applies to us as a controller, we rely on:
- Contract: to provide the app the merchant installed
- Legitimate interests: to keep the service secure and reliable, fix errors, and answer messages
- Legal obligation: where a law requires us to keep or disclose information
Our role and Shopify’s role
Sale Sight works with data that Shopify makes available to it under Shopify’s API terms. For any personal data about a merchant’s customers that reaches Sale Sight, the merchant is the controller and Sale Sight acts as a processor on the merchant’s behalf. Shopify’s own processing is covered by Shopify’s privacy policy.
For merchant account and contact information, and for our own operational logs, Carterdea LLC is the controller.
Service providers
We share information only with providers that run the service for us. They process it on our behalf under their own terms and security commitments.
| Provider | Purpose | Location |
|---|---|---|
| Shopify | App platform, authentication, app proxy, webhooks | Global |
| Vercel | Application hosting and request logs | United States |
| Neon | PostgreSQL database | United States (AWS us-east-1) |
| Redis Ltd. (Redis Cloud) | Short-lived price cache | United States (AWS us-east-1) |
We do not currently use third-party analytics, advertising, or error-reporting services. If we add a provider that processes personal data, we will update this list.
We may also disclose information if required by law, to protect our rights or users’ safety, or as part of a merger, acquisition, or sale of assets, in which case this policy will continue to apply.
International transfers
Sale Sight stores and processes data in the United States. If you are outside the United States, your information will be transferred there. Where the GDPR or UK GDPR requires it, we rely on our providers’ transfer mechanisms, such as the EU Standard Contractual Clauses and the UK Addendum, or the EU-US Data Privacy Framework where the provider participates.
Retention
| Data | How long |
|---|---|
| Store, settings, catalog, and discount data | While the app is installed, then deleted when Shopify sends the shop redaction request (about 48 hours after uninstall) |
| Session records and access tokens | Deleted at uninstall, and in all cases at shop redaction |
| Price cache | Expires within 1 hour, and is cleared at uninstall and shop redaction |
| Database point-in-time backups | 1 day |
| Hosting request and application logs | No more than 30 days |
| Support and privacy emails | Up to 2 years after the matter is closed |
We may keep information longer only if the law requires it.
Uninstall and Shopify privacy webhooks
Uninstall (app/uninstalled): we mark the shop as uninstalled, cancel its
plan status, delete its session records, and clear its cached prices.
Shop redaction (shop/redact): Shopify sends this about 48 hours after
uninstall. We delete the shop’s record and everything linked to it: discounts,
product eligibility, prices, settings, sync records, billing records, sessions,
and cache. This happens when the webhook is received. Remaining copies age out
of database backups within 1 day and out of logs within 30 days.
Customer data request (customers/data_request): Sale Sight does not store
customer personal data, so there is nothing to export. We acknowledge the
request, and if the merchant contacts us we confirm in writing within 30 days
that we hold no data about that customer.
Customer redaction (customers/redact): for the same reason there is
nothing to delete. We acknowledge the request, and we will confirm this to the
merchant on request.
Your rights
Depending on where you live, you may have the right to access, correct, delete, or export your personal information, to restrict or object to how we use it, and to withdraw consent where we rely on it. In the EEA or UK you can also complain to your local data protection authority.
To make a request, email privacy@salesight.app. We will respond within 30 days, or sooner if the law requires. We may need to verify your identity, for example by confirming the request comes from the store owner’s account. If you are a shopper, your request is usually best sent to the store you bought from, because the merchant controls your data. We will help the merchant respond.
California
If the CCPA, as amended by the CPRA, applies:
- In the last 12 months we collected identifiers (such as IP address, shop domain, and email address if you contacted us) and internet activity information (request logs), from you or from Shopify, for the purposes listed above.
- We have not sold or shared personal information, as those terms are defined in the CCPA, and we do not do so.
- We do not use or disclose sensitive personal information for any purpose that would give you a right to limit it.
- You may request to know, delete, or correct your personal information, and you may use an authorized agent. We will not discriminate against you for using these rights.
Security
We use HTTPS for traffic to the app, encrypted connections to our database, password-protected access to our cache, restricted access to production systems, and Shopify’s signature checks on webhooks. The storefront endpoints return only public product price information. No service can guarantee absolute security. If a breach affects your personal information, we will notify affected merchants and authorities as the law requires.
Children
Sale Sight is a business tool for Shopify merchants. It is not directed to children under 16, and we do not knowingly collect their personal information.
Changes
We may update this policy when the app or the law changes. We will post the new version at https://salesight.app/privacy with a new date. For material changes, we will also give notice in the app before the change takes effect.
Contact
Carterdea LLC, privacy@salesight.app