Draft, pending attorney review
DiscountStack™ and MerchantAscent™ Privacy Policy
Effective date: October 27, 2026
Last updated: October 27, 2026
1. Who we are
DiscountStack is built and supported by SecureOrbit Labs, LLC (a Texas limited liability company), MerchantAscent division ("we," "us," "our").
We are responsible for (the "controller" of) the information described in this policy.
Email: support@merchantascent.com
This policy covers the DiscountStack Shopify app and our website, merchantascent.com. It works together with our Terms of Service.
2. What the app uses
We keep this to the minimum the app needs to work.
Your store record. For each store that installs DiscountStack, we keep:
- your shop's myshopify.com address
- the date you installed the app
- the date you uninstalled it (if you did)
- your plan status (for example, free trial or paid plan)
Your access token. Shopify gives the app an access token so it can save your discount settings in your store. We keep it only while the app is installed.
Privacy request log. When Shopify sends us a privacy request about your store or your customers, we log:
- your shop's myshopify.com address
- the type of request
- when it was received and when we completed it
This log contains no customer names, emails or other customer details. We keep it to show that we handled each request, for up to 24 months after the request.
Discount settings (stored in your store, not ours). Your settings, such as the amount off, the number of full-price units, the products, product tags and customer tags you choose, and any cost floor, are saved in your own Shopify store as Shopify metafields. They stay in your store even after you uninstall. You control them and can delete them in Shopify at any time.
3. Your customers' information
DiscountStack does not collect, store or share your customers' personal information.
The discount runs inside Shopify's checkout as a Shopify Function. While it calculates savings, it looks at:
- the items in the cart and their prices, and
- whether the logged-in customer has a tag you chose (for example, a tag for staff or wholesale pricing).
The app only gets a yes-or-no answer about the tag. It does not see the customer's name, email, phone or address, and nothing about the customer or the tag check is stored.
4. Why we use this information
We use the information above only to:
- run the app and apply your discounts at checkout
- manage your free trial and plan
- provide support when you contact us
- keep the app secure and working
- handle privacy requests and meet our legal duties
We use it because we need it to provide the service you installed, and, for the privacy log, to meet legal requirements.
We do not use your data for advertising, and we do not reuse or resell it.
5. Shopify's role and billing
DiscountStack is a Shopify app. Shopify runs your store, the checkout and the Shopify Functions the app uses. Shopify's own privacy policy covers what Shopify does with data.
All billing goes through Shopify. Shopify charges your plan on your Shopify bill. We never see or store your card or payment details. We only learn whether your plan or trial is active.
6. Who we share it with
We do not sell or share your information with advertisers, data brokers or anyone else.
We use these service providers to run the app:
- Shopify, the store platform, checkout and billing.
- Cloudflare, which hosts our app server (Cloudflare Workers) and database and processes requests on our behalf.
We may also disclose information if the law requires it, or as part of a merger, sale or reorganization of our business.
7. Cloudflare and international transfers
Our app server runs on Cloudflare's global network. That means requests may be processed in data centers outside your country, including the United States.
Where the law requires it, we rely on appropriate safeguards for these transfers, such as Cloudflare's data processing terms and the Standard Contractual Clauses.
8. How long we keep it, and deletion
- Access token: removed right away when you uninstall the app.
- Store record: deleted within 30 days after you uninstall, or after Shopify sends its shop data removal request, whichever comes first.
- Privacy request log: kept for up to 24 months, as described in Section 2.
- Discount settings: stay in your Shopify store until you delete them.
If you reinstall the app, a new store record is created.
9. Security
We protect data with reasonable safeguards, including:
- encrypted connections (HTTPS) for all traffic
- checking that every Shopify webhook is genuine before acting on it
- limited app permissions (the app asks only for discount and product access, not customer or order access)
- limited access to our systems
No system is completely secure. If we learn of a security incident affecting your store's data, we will tell you as the law requires.
10. Your privacy rights
Everyone. You can ask us for a copy of your store's data, ask us to correct it, or ask us to delete it, at any time.
If you are in the EU, UK or similar places (GDPR). You also have the right to access, correct, delete, restrict or object to our use of your data, to receive it in a portable format, and to complain to your local data protection authority.
If you are a California resident (CCPA/CPRA). You have the right to know what personal information we collect and how we use it, to access it, to correct it, and to delete it. We do not sell or share personal information, and we do not use sensitive personal information. We will not treat you differently for using your rights.
11. How to make a request
Merchants: email support@merchantascent.com from the email on your Shopify store, and tell us your myshopify.com address and what you'd like.
Your customers: customer requests go through you and Shopify. Shopify sends them to us automatically (its customer data request and customer data erasure webhooks), and we answer them. Because the app stores no customer data, there is normally nothing to return or delete.
Shopify's store deletion request: Shopify also sends us a shop data removal request after you uninstall, and we delete your store record as described in Section 8.
How fast we answer: we confirm your email within 5 business days and complete requests within 30 days. We may need to confirm the request really comes from the store owner.
12. Children
DiscountStack and merchantascent.com are for businesses. They are not meant for children, and we do not knowingly collect information from anyone under 16.
13. This website (merchantascent.com)
The website sets no cookies, uses no analytics or tracking, and runs no scripts.
Our hosting provider may keep standard server logs (such as IP address, browser type and pages requested) for security and reliability. We do not use them to identify or profile visitors.
If you email us, we use your message only to reply.
14. Changes to this policy
If we change this policy, we will post the new version on this page and update the "Last updated" date.
For important changes, we will also let merchants know by email or in the app before the change takes effect.
15. Contact
Questions? We're happy to help.
Email: support@merchantascent.com
Company: SecureOrbit Labs, LLC (a Texas limited liability company), MerchantAscent division