Privacy policy
Perk Studio helps Shopify merchants run reward activities and collect email marketing consent.
Who operates this service
Brimleaf Studio Contact: contact@brimleafstudio.com.
Information we process
We store shop identifiers, access credentials, campaign settings and uploaded brand artwork. When a visitor participates, we process a random participation identifier, their selected reward, and any email address, Shopify customer identifier, subscription confirmation and reward claim needed for that activity.
For paid orders using an activity coupon, we record the order identifier, currency, order amount and discount amount to show campaign attribution. We do not collect payment card details.
Purpose and service providers
These records let us operate activities, verify eligibility, prevent duplicate rewards, issue Shopify coupons, provide reports and respond to customer requests. Shopify processes store, customer, discount and billing operations. Optional notifications send customer references and reward details to Shopify Flow and Shopify Messaging. Subscribing requires explicit marketing consent. Visitors can enter an email address without signing in, or use their signed-in Shopify account. Guest subscriptions use single opt-in and do not verify ownership of the email address. Signing in alone does not subscribe you. The merchant may separately require sign-in to claim a reward. Legacy confirmation messages may still use Resend while previously issued confirmation links remain active.
Retention and deletion
Our maintenance process removes personal participation records after 365 days of inactivity and order records after 365 days. Email delivery logs and customer data exports expire after 30 days. Pending email contents are encrypted and removed after provider acceptance or expiry. Anonymous totals may remain to preserve consumed reward stock. On receiving a Shopify customer deletion request, we remove identifying records and invalidate participation credentials. On Shopify’s shop deletion request, we remove the store’s records and artwork.
Encrypted backups are restricted to recovery. Operators must expire backups within 30 days and reconcile deletion requests before restoring them to service. Merchants are responsible for copies they download and their own marketing messages and privacy notices.
Your choices
Participation requirements are shown by the merchant. You can withdraw marketing consent through the store. Contact the store for access to or deletion of your customer data. The merchant can request it through Shopify and securely provide the resulting export. Service questions can be sent to the operator above.