Privacy Policy

Effective date: July 17, 2026 · Updated October 14, 2026

TierUp is a Shopify app operated by WinWithWeb Technologies. This policy explains what data TierUp accesses, stores, and processes when a Shopify merchant installs and uses TierUp on their store. Language is deliberately concrete; if you find a claim that’s ambiguous, email us and we’ll clarify or fix it.

1. What TierUp does

TierUp lets Shopify merchants configure quantity-break (also called “tiered”, “volume”, or “slab”) pricing on their products. Discounts are computed by a Shopify Function that runs on Shopify’s infrastructure at checkout; TierUp writes the compiled tier rules to a product metafield that the Function reads.

2. Data TierUp accesses on your Shopify store

When you install TierUp, the app requests these OAuth scopes:

• read_products — read product titles, images, prices, and IDs so tiers can be configured against specific products.
• write_products — write compiled tier rules to a product metafield (slabpricing.rules) that the checkout Function reads.
• write_discounts — create and update a single automatic discount node that binds the Function to checkout.
• read_themes — read-only. TierUp reads your product template to check whether its storefront block has already been added, so setup can show an “enabled” state instead of a button that would add a second copy of the tier table to a live store. TierUp never edits your theme and never reads any other part of it.

Once Shopify has approved TierUp’s protected-customer-data request, the app will also request:

• read_orders — receive the orders/createwebhook so TierUp can record which orders contained a product priced by one of your tier rules. This is how the in-app Analytics page shows whether a rule is converting. From each such order TierUp reads only the order ID, the order subtotal, the currency, and the quantity and unit price of the matched line items. It does not read or store the customer’s name, email, phone, address, payment method, or any other customer field. Existing merchants are asked to approve this scope once, in their admin, before it takes effect for their store.

TierUp does not request names, email addresses, phone numbers, addresses, payment methods, or any other customer-identifying data. Shopify enforces this via approval gates on scopes and webhook subscriptions.

3. Data TierUp stores

TierUp stores the following in a managed Postgres database (hosted by Neon on AWS, US East region):

• Merchant configuration — your Shopify shop domain, tier rule definitions (product ID, quantity thresholds, per-unit prices, currency, stacking preferences), and settings.
• Session tokens — Shopify OAuth session data, managed by the Shopify session-storage library, used only to authenticate admin requests from your embedded admin.
• Storefront impressions (anonymous) — the shop domain, a product ID, an optional A/B variant label, and a timestamp. This is a count of how often the tier-pricing widget rendered per product. It contains no customer identifiers, no IP addresses, no cookies, no device fingerprints, and no personal information.
• Order conversion records (only once theread_orders scope above is approved and granted for your store) — the shop domain, the Shopify order ID, the order subtotal and currency, and the quantity and unit price of the line items that matched a tier rule. Orders containing no tier-priced product are ignored and never stored.

TierUp does not store: customer names, emails, addresses, phone numbers, payment methods, customer IDs, or any other information that identifies your shoppers.

4. Where data is stored

• Application server: Railway (US East, Virginia).
• Database: Neon Postgres (AWS US East, Ohio).
• Compiled tier rules are also written to Shopify product metafields on your store, hosted by Shopify.

5. Third-party services

TierUp’s operation depends on these services:

• Shopify — required platform integration; TierUp reads and writes only via Shopify’s Admin API.
• Neon — managed Postgres database hosting.
• Railway — application server hosting.

TierUp uses Google Analytics 4 on the Shopify App Store listing page for TierUp only(apps.shopify.com/tierup). This measures aggregate engagement — page views, source of traffic, install-button clicks — so we can understand which listing content helps merchants decide to install. It runs on Shopify’s marketing domain, before a merchant has installed the app, and never collects data from the merchant’s admin, their store, or their shoppers.

Beyond that App Store listing measurement, TierUp does not sell, share, or transmit your data or your shoppers’ data to any advertising, analytics, or marketing service. There are no third-party trackers on the storefront widget or in the embedded admin (beyond Shopify’s own App Bridge, which is required for embedded apps).

6. Data retention and deletion

• While TierUp is installed: merchant configuration and session data are retained for as long as the app is installed.
• On uninstall: TierUp automatically deletes all rules, tiers, and settings for the uninstalled shop via theapp/uninstalled webhook. Sessions are removed at the same time.
• Impression logs: retained in aggregate; since they contain no personal information, they are not tied to any individual customer.
• Order conversion records: retained while the app is installed, deleted on uninstall together with everything else for the shop, and deleted for a specific order whenever Shopify sends a customers/redact request naming it.

7. GDPR and Shopify compliance webhooks

TierUp implements the mandatory Shopify privacy webhooks:

• customers/data_request — TierUp holds no data that identifies a customer. If the request names orders for which TierUp holds a conversion record (order ID, subtotal, matched line items), TierUp provides that record to the merchant.
• customers/redact — TierUp deletes the conversion records for the orders named in the request. Nothing else is held about the customer, so nothing else needs redacting.
• shop/redact — 48 hours after uninstall, Shopify sends this webhook and TierUp permanently deletes all remaining data for the shop.

8. Cookies

TierUp does not set cookies on your storefront. The embedded admin uses Shopify’s session-token authentication, not cookies. Shopify may set its own cookies as part of App Bridge; those are governed by Shopify’s privacy policy.

9. Your rights

If you are a merchant using TierUp and want to request data access or deletion outside the automated uninstall flow, contact us using the details below. If you are a shopper on a merchant’s store, TierUp does not hold any personal information about you; please contact the merchant directly for any store-level privacy request.

10. Contact

For privacy questions or requests, contact:

• Email: contact@winwithweb.in
• Operator: WinWithWeb Technologies

11. Changes to this policy

We may update this policy as TierUp evolves. Material changes will be reflected by updating the effective date at the top of the page. Continued use of TierUp after a change constitutes acceptance of the updated policy.