GemUpsells — Privacy Policy

Please read this privacy policy carefully

GemUpsells is a software-as-a-service product developed and operated by GemCommerce Co., Ltd. (“GemUpsells”, “Company”, “we”, “us”, or “our”). GemUpsells provides tools that help Shopify merchants create, configure, deploy, and measure upsell experiences across supported customer-facing touchpoints. These services are made available through our application on the Shopify App Store (the “App”) and related functionalities (collectively, the “Services”).

This Privacy Policy (“Policy”) describes how we collect, use, disclose, and protect personal data obtained through the use of the Services. References to your use of the Services in this Policy include any interaction with the GemUpsells, whether or not you are a subscribed User. By using the Service, you acknowledge that you have read, understood, and agreed to the terms of this Policy.

Where GemUpsells processes Shopper or Customer Personal Information on behalf of a Merchant, the Merchant remains responsible for determining the purposes and lawful basis for that processing and for providing any required privacy notices to its customers. GemUpsells processes such data only as necessary to provide the Services and in accordance with this Policy, applicable Shopify requirements, and applicable law.

Definitions

“Service”, “App” or “GemUpsells” refers to the Shopify application developed and operated by GemCommerce Co., Ltd., together with the associated features, tools, functionality, content, and services provided in connection with the App.

“User”, “Merchant”, “You” or “Your” means any individual or legal entity that accesses or uses the Service in connection with the operation of a Shopify store.

“Shopper or Customer” means any individual who visits, browses, or interacts with a Merchant’s storefront or any Touchpoint where the Service is made available, whether or not such individual has completed a purchase.

“Touchpoint” means a customer-facing point, page, stage, or interaction within a Shopify store or shopping journey at which the Service may display or deliver an Offer or other functionality, including, without limitation, product pages, add-to-cart experiences, cart, checkout, post-purchase, thank-you, and order-status pages, and any other touchpoints supported by Shopify or made available through the Service.

“Personal Information” or “Personal Data” refers to any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to a specific, identified or identifiable natural person. This includes, but is not limited to: (i) Identifiers such as full name, alias, mailing address, unique personal identifiers, online identifiers, Internet Protocol (IP) address, email address, account name, government-issued identification numbers (e.g., national ID, passport, driver’s license), or other similar identifiers; and (ii) Any other information that is considered “personal information”, “personally identifiable information”, “personal data”, or similar terms under applicable data protection and privacy laws, including but not limited to the GDPR, CCPA, and any other relevant international, federal, or state data privacy regulations. In addition, Personal Information may also include information about your device, browsing activities, purchase or usage history, and customer data submitted through the Service if such data can be used to identify a natural person.

“Personal Data Breach” means any actual or suspected incident that results in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed by GemUpsells or its authorized third-party service providers. This includes breaches resulting from both intentional and unintentional acts or omissions that compromise the confidentiality, integrity, or availability of personal data, as defined under applicable data protection laws.

“Aggregated/De-Identified Data” refers to information that has been processed in such a way that it can no longer reasonably be linked to any identified or identifiable individual.

1. Sources of Personal Information Collected

For the purposes of providing, securing, supporting, and improving the Service, GemUpsells may collect Personal Information from the following sources, depending on the features used and the permissions granted by the Users:

Information You Provide to Us: We collect information you directly provide when you install or configure the App, contact support, request assistance, provide feedback, submit forms, or otherwise interact with the Services. This may include your name, business or store information, contact information, account or subscription information, Funnel and Offer configurations, customer-support communications, and other content or information you choose to provide.
Information from Shopify: Through authorized Shopify APIs, webhooks, extensions, or other supported mechanisms, we may receive information relating to the Merchant and its Shopify store, such as store name, store ID, store domain, Shopify plan, owner or staff information, products, variants, collections, inventory information, selling plans, cart and order information, discount information, customer information, order history, and other Shopify Data necessary for the applicable Service functionality. The specific data available to us depends on the Shopify permissions granted, the features used, and Shopify’s applicable access controls.
Shopper or Customer Data: When GemUpsells is deployed on a Merchant’s storefront or supported Touchpoint, we may process Shopper or Customer data, including, where authorized by Shopify, customer identifiers, order and cart information, and related events or metafields associated with a specific customer or order. Access to protected customer data is subject to Shopify’s applicable requirements and approvals.
Information from Third Parties: We may receive information from third-party providers that support the Service, such as analytics, monitoring, customer-support, hosting, communication, or artificial intelligence providers. The information received depends on the relevant integration and may include technical, usage, support, or other information necessary to provide the enabled functionality. We do not purchase personal data from third parties, nor do we process third-party data for profiling unless specifically described in this Policy or separately consented to.
Automatically Collected Data (Log Data and Cookies): We automatically collect technical data when you access or use the App, such as IP address, browser type, operating system, device identifiers, and usage logs. We may also use cookies and similar technologies to enhance functionality and performance. You can manage your cookie preferences or opt out of certain types of tracking by following the instructions provided in our [Cookie Policy].

GemUpsells is committed to processing Personal Information in accordance with applicable laws and the requirements set forth by the Shopify platform. We ensure that diagnostic and analytics data collected through cookies and logs are used solely for the purpose of monitoring, maintaining, and enhancing the performance, security, and quality of the Service.

2. Purpose of Data Processing

GemUpsells processes Personal Data for specific, legitimate purposes necessary to operate and support the Services. Depending on the applicable context, our purposes may include:

App Operation and Enhancement: To authenticate and administer the Service, sync and use Shopify Data, create and manage Funnels and Offers, evaluate conditions and supported customer or visitor segments, display Offers at supported Touchpoints, process cart or order context, and provide the core functionality of the App.

For more detail, we also process data to measure Offer impressions, interactions, acceptance, conversions, AOV, attributed upsell revenue, and other performance metrics; attribute Shopper interactions to orders where supported; and provide related analytics and reporting to you in accordance with applicable Shopify requirements.

Where enabled, to provide AI-assisted styling, reports, recommendations, analyses, or other supported functionality using information or instructions submitted for the relevant feature. AI processing may involve third-party AI Providers as described in Section 3.

Communications and Support: To communicate with you as the User, including providing important notices related to your account, billing updates, service announcements, and responses to technical or customer support inquiries. Where permitted by applicable law and based on your consent where required, we may also use your contact information to send non-transactional messages, such as product updates, surveys, or marketing communications.
Personalization and User experience: To configure or adapt Service functionality based on Merchant settings, Funnel configurations, historical usage, supported customer or visitor segments, and performance information, where necessary to provide the selected functionality.
Legal Compliance and Enforcement: To comply with applicable legal obligations, regulatory requirements, or enforce our contractual rights. This includes responding to lawful requests from governmental authorities, such as subpoenas or court orders, and protecting the security, integrity, and lawful use of the Service.
Security and Fraud Prevention: To prevent, detect, investigate, and mitigate potentially fraudulent, unauthorized, or malicious activities. This may involve analyzing behavioral patterns and usage anomalies to identify threats and ensure a secure operating environment for all users.
Research and Development: To analyze Aggregated or De-Identified Data to understand trends, diagnose issues, improve features, enhance performance and security, and develop new functionality.
Marketing and Promotion: To send promotional messages or display marketing content tailored to your interests, including product offers, service recommendations, and newsletters. These communications may be based on how you interact with the Service and your usage patterns, and are only sent where legally permitted or with your consent. You have the right to opt out of receiving these communications at any time by following the unsubscribe instructions in the message, adjusting your communication preferences in your account settings, or by contacting our support team.
Business Operations and Analytics: To generate usage statistics, evaluate the effectiveness of product features, and understand overall user engagement with the Service. We may use this data to improve operational efficiency and guide business decisions.

3. Data sharing

3.1. Third Party

We may disclose Personal Data to trusted third-party service providers that process information on our behalf or support the Services. Such providers are permitted to access Personal Data only as reasonably necessary for their designated functions and are subject to contractual, security, and confidentiality requirements appropriate to the nature of the processing.

Categories of such providers include, but are not limited to:

No.	Category	Purpose	Third party
1	Cloud Hosting, Storage, and Infrastructure Providers:	Providers that host application infrastructure, databases, backups, and related systems necessary to operate the Services.	Amazon Web Services, Inc.
2	Monitoring, Security, and Error-Management Providers	Providers used to monitor performance, detect errors, maintain security, and troubleshoot technical issues.	Sentry (Functional Software, Inc
3	Customer Communication and Support Providers	Providers used to deliver support, service communications, onboarding, and related merchant communications.	Intercom, Inc., Google LLC, Slack Technologies, Inc.
4	Artificial Intelligence Providers	Third-party AI Providers used, where enabled, to process applicable Inputs and generate AI-assisted reports, recommendations, analyses, styling, content, or other Outputs. Such processing is subject to the applicable provider terms and our contractual and privacy safeguards.	OpenAI, LLC

Third-party providers may process Personal Data in countries other than the country in which the data was collected. We require applicable service providers to maintain appropriate safeguards and to process data only for authorized purposes.

3.2. Law enforcement and Legal Requirements

Personal Information may be disclosed where required by applicable law, regulation, legal process, or enforceable governmental request (e.g., subpoenas or court orders). We may also disclose such data when reasonably necessary to:

Establish, exercise, or defend legal claims,
Protect the rights, property, or safety of GemUpsells, its Users, or others,
Detect, prevent, or respond to suspected fraud, security incidents, or technical issues.

Any Disclosures under this section will be strictly limited to the extent required by law and executed in a secure and responsible manner.

3.3. Change of ownership

In the event of a merger, acquisition, reorganization, sale of assets, or any other change in ownership, Personal Information may be transferred to a successor entity or affiliate as part of the transaction. Such transfers will be conducted in compliance with applicable data protection laws. Where required, you will be notified of the change and your rights under relevant legislation will be respected.

3.4. Testimonials

With your explicit consent, we may publish aggregated or anonymized testimonials and reviews on our website or other marketing materials. These will not include any directly identifiable information unless you have expressly agreed to such disclosure.

3.5. Hosting

GemUpsells uses a secure cloud-based infrastructure, currently located in North America, which may be distributed across several regions to ensure a stable and reliable Service experience. We may host, process, and share Personal Data across these jurisdictions within these regions with our Affiliates and trusted service providers (e.g., AWS) solely for the purpose of delivering and improving the Service, and always in compliance with applicable privacy laws.

When transferring Personal Data outside the originating region (e.g., from the EU to North America), we will implement additional safeguards (e.g., Standard Contractual Clauses) to ensure compliance with applicable legal requirements. In such cases, we will also employ appropriate technical and organizational measures, including AES-256 encryption for data at rest and in transit, two-factor authentication (2FA), and periodic security audits, to protect confidentiality, integrity, and availability of Personal Data. These measures are designed to secure your data against unauthorized access, misuse, or disclosure and to ensure that your rights are upheld throughout all stages of the aforementioned activities.

4. Data Retention

We retain Personal Data only for as long as reasonably necessary to provide the Services, fulfill the purposes described in this Policy, maintain security and service integrity, resolve disputes, enforce agreements, and comply with applicable law and Shopify requirements. Retention periods vary depending on the nature of the data and the purpose for which it was collected.

While your use of the GemUpsells App remains active, we will maintain your account details, configuration data, and related records to support the ongoing operation and performance of the Service. Upon uninstallation of the App, we will immediately cease the collection of any new data and delete, return, or de-identify Personal Data in accordance with applicable Shopify requirements. For clarity, once you uninstall our app you are revoking your permission for us to access your data. After 48 hours of the action, we receive a request to erase all your personal information that was collected when the application was installed. Any remaining data associated with your use of the App will be permanently deleted within three (3) months.

You may submit a request to delete your stored Personal Data at any time. GemUpsells will evaluate and respond to such requests within a reasonable period, consistent with applicable data protection and privacy laws. Notwithstanding the foregoing, GemUpsells reserves the right to refuse, in whole or in part, any deletion request where the continued retention of Personal Data is required to satisfy legal, regulatory, or contractual obligations. These obligations may include, but are not limited to, compliance with tax rules, retention duties, and audits required by authorities.

GemUpsells may retain aggregated, de-identified, or anonymized performance metrics in a non-personalized format beyond the retention period for Personal Data to analyze trends, improve Service functionality and performance, and support reporting and analytics. All processing of aggregated and de-identified Data is performed in accordance with applicable data protection laws and supported by a legitimate interest in enhancing and maintaining the performance, functionality, and relevance of the Service.

GemUpsells adheres to the principle of data minimization, ensuring that no more Personal Data is retained than is necessary to fulfill the purposes described herein.

5. Security

GemUpsells implements reasonable technical and organizational measures designed to protect Personal Data against unauthorized access, alteration, disclosure, loss, destruction, or other unlawful processing. Depending on the nature of the data and the applicable system, these measures may include encryption, access controls, authentication mechanisms, logging and monitoring, secure development practices, backup controls, and other safeguards appropriate to the risks.

Despite our best efforts and implementation, you acknowledge and agree that no method of transmission over the Internet or method of electronic storage is entirely secure. Accordingly, GemUpsells cannot ensure or warrant the absolute security of Personal Data transmitted through or stored within the Services on our systems.

In the event of a confirmed Personal Data Breach, GemUpsells will, without undue delay, take all necessary steps to assess, contain, and mitigate the breach. Where the breach is likely to result in a risk to the User’s rights, GemUpsells will promptly notify impacted Users and, where legally required, report the breach to the relevant supervisory authorities within the timelines established under applicable data protection laws.

All such actions will be carried out in accordance with Shopify’s policies and relevant legal obligations to ensure transparency and accountability.

6. Your Rights Under Applicable Laws

GemUpsells is committed to enabling and supporting you in exercising your data protection rights in full compliance with applicable laws and regulations, including but not limited to the GDPR, the CCPA, and Shopify’s policies.

Right of Access and Information: You have the right to request information about the personal data we hold about you, including the categories of data, purposes of processing, and third-party disclosures. Upon request, we will provide a copy of your personal data in a structured, commonly used, and machine-readable format.
Right to Rectification: If any of your personal information is inaccurate or incomplete, you have the right to request that we update or correct it promptly and in a timely manner.
Right to Erasure: You may request the deletion of your personal data, and we will honor such requests unless we are legally required or otherwise permitted to retain the data for legitimate purposes (e.g. regulatory compliance or legal claims).
Right to Restriction of Processing: You may request that we limit the processing of your personal data under certain circumstances, such as when you contest the accuracy of the data or object to its processing.
Right to Data Portability: Where applicable, you may request to receive a copy of your personal data in a portable format or request that it be transferred to another service provider.
Right to withdraw Consent: If the processing of your personal data is based on consent, you have the right to withdraw that consent at any time. Please note that this may impact your ability to use certain features of the Service.
Right to Opt-Out of Marketing Communications: You can opt out of receiving marketing emails or other promotional communications from us at any time by using the unsubscribe link in those communications or contacting us directly.

To safeguard your personal information, GemUpsells may require verification of your identity before processing any request to exercise your rights. This verification process may include confirming account credentials or requesting additional information necessary to authenticate your identity and prevent unauthorized access.

If you are a resident of California, you may be entitled to additional rights under CCPA, such as: (i) right to know what personal information is being collected and to access that information), (ii) right to know what personal information is sold or shared and to whom, (iii) right to opt out of the sale or sharing of personal information. Please note that these rights are subject to certain limitations and exceptions as provided by law. For the avoidance of double, we do not sell or share Personal Information as defined under the CCPA, without authorization or as otherwise permitted by applicable law.

To exercise any of the rights above, please contact us using the information provided in the “Contact Us” section of this Policy. We will respond to verifiable requests in accordance with applicable legal requirements.

7. Children’s Privacy

GemUpsells is designed for adult Users operating stores on the Shopify platform and is not intended for use by children. In compliance with applicable laws, including the Children’s Online Privacy Protection Act (COPPA) and Shopify’s policy guidelines, we do not knowingly collect or process personal information from individuals under the age of 13.

If we become aware that we have inadvertently collected personal data from a child under 13 without verified parental consent, we will take immediate steps to delete such information from our systems.

If you believe that a child under 13 may have provided us with personal data, please contact us promptly using the contact information provided in this Privacy Policy. We will investigate and address the issue in accordance with our obligations under applicable data protection laws.

8. Update to the Policy

We may update this Privacy Policy from time to time to reflect changes in our data practices or legal requirements, and such updates may be made without prior notice. When we make changes, we will update the “Last Updated” date at the top of this page. The revised Policy will become effective upon its publication on this page. Accordingly, we encourage you to review this Policy periodically before submitting any personal information.

Your continued use of our services after any amendments to the Policy constitutes your acceptance of the updated terms. Where material changes are made, we will highlight them at the top of this page and indicate the date on which the Policy was last updated.

9. Contact Information

If you believe this Policy has been violated or if you have any questions, please contact us at GemCommerce Co., Ltd.
Add: 5th Floor, Artemis Tower, 3 Le Trong Tan Street, Phuong Liet Ward, Hanoi, Vietnam
Email: support@gemupsells.net