Privacy policy
This policy explains what Outline collects, why we collect it, who we share it with and what you can ask us to do about it. It covers both the Shopify app and this website.
Who we are
Outline is a Shopify app and the website you are reading now. In this policy, “we”, “us” and “Outline” mean the company that operates them, and “you” means a merchant who installs the app or a visitor to this website.
For merchants in the European Economic Area and the United Kingdom, we act as a data processor for the store data we handle on your behalf, and as a data controller for your own account and billing information. You remain the controller of your customers' personal data.
Information we collect
Store and account information
- Your store domain, store name, contact email, plan and country, provided by Shopify when you install the app
- The settings you create in the app, such as thresholds, product selections and offer rules
- Support messages you send us, and the email address you send them from
Store data accessed through Shopify
- Products, variants, prices, inventory levels and collections, used to build and validate offers
- Carts, checkouts and orders, used to decide which offer to show and to report on results
- Discounts created by the app, used to apply the savings an offer promises
Storefront visitors
When an offer is shown on your storefront, we record that an offer was displayed, dismissed or accepted, along with the cart value and a randomly generated identifier stored in the visitor's browser. We do not collect names, addresses or payment details from storefront visitors, and we do not use this data to build profiles or to advertise to them elsewhere.
This website
We keep basic server logs, including IP address, browser type and the pages requested, and we use a privacy focused analytics tool to count visits. We do not use advertising cookies on this website.
How we use information
- To provide the app: showing the offers you configure and applying the discounts they promise
- To report results back to you, such as how often an offer was shown and accepted
- To bill you, through Shopify's billing system
- To answer support requests and tell you about material changes to the service
- To keep the service secure, to detect abuse and to fix faults
We do not sell personal information, and we do not share it for cross-context behavioural advertising.
Legal bases
Where the UK GDPR or EU GDPR applies, we rely on the following bases: performance of our contract with you, for running the app and billing; our legitimate interests, for security, fault diagnosis and improving the service; your consent, where we ask for it, such as for marketing email; and compliance with legal obligations, such as tax record keeping.
How long we keep it
- App settings and offer configuration: while the app is installed, and for 30 days after you uninstall, so that reinstalling restores your setup
- Offer performance records: 24 months, then deleted or aggregated so they no longer identify a visitor
- Support messages: 24 months from the last message
- Billing records: as long as tax and accounting law requires
When Shopify sends us a shop redaction request, we delete or anonymise store data within the period Shopify requires. When Shopify sends us a customer redaction request, we delete the records linked to that customer.
Security
Data is encrypted in transit and at rest. Access to production systems is limited to staff who need it, protected by multi-factor authentication, and logged. We review access regularly and keep backups. No service can promise perfect security, but we will notify you and, where required, the relevant regulator if a breach affects your data.
International transfers
Outline and its providers may process data in the United States and elsewhere. Where data leaves the EEA or the UK, we rely on the European Commission's standard contractual clauses and the UK addendum, together with additional safeguards where they are needed.
Your rights
Depending on where you live, you may have the right to access the personal information we hold about you, to correct it, to delete it, to object to or restrict how we use it, to receive a copy in a portable format, and to withdraw consent you have given. To exercise any of these, email us at privacy@outline.app. We answer within one month.
If you are a shopper rather than a merchant, contact the store you were buying from. They control that data, and we will support them in responding to you.
You may also complain to your local supervisory authority. In the UK that is the Information Commissioner's Office.
GDPR and CCPA
If your store sells to people in the European Economic Area or the United Kingdom, Outline acts as your processor under the GDPR: we handle store and shopper data only on your instructions, only to run the offers you switch on, and only for as long as the retention periods above allow. You remain the controller.
Our commitments as a processor
- We process personal data only on documented instructions from you, including for transfers
- Staff with access are bound by confidentiality
- We apply the security measures described above, and keep records of processing
- We use the subprocessors listed above, and will tell you before adding a new one
- We help you respond to shopper requests, and with impact assessments where they apply
- We delete or return store data when you uninstall, within the periods described above
Uninstall and deletion requests
Shopify sends every app three mandatory privacy webhooks. When a shopper asks a merchant for their data, we return what we hold. When a shopper asks to be erased, we delete the records tied to them. When a store uninstalls Outline, we delete or anonymise that store’s data within the period Shopify requires.
A data processing agreement
A DPA covering the points above, including the standard contractual clauses and the UK addendum, is available on request from privacy@outline.app. If your own compliance team needs it signed, send it over and we will complete it.
If you are in California
Under the CCPA and CPRA, Outline is a service provider. We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not retain, use or disclose it for any purpose other than performing the service for you. California residents may ask us to access or delete the personal information we hold about them as a merchant contact.
Children
Outline is a business tool and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, contact us and we will delete it.
Changes to this policy
We will post any change on this page and update the date above. If a change materially affects how we handle your information, we will email the address on your account before it takes effect.
Contact us
Email privacy@outline.app and a person will answer. Write to us at the same address for any question about this policy, a data request, or a security concern.