Introduction
Rapid Search Zrt. ("Rapid Search," "we," "us," or "our") develops and operates Rapid Upsell (the "App"), an application available through the Shopify App Store, as well as the website located at rapidupsell.com ("Website"). This Privacy Policy explains how we collect, use, and share information when a merchant installs or uses the App, and when a visitor accesses our Website.
By installing the App or using the Website, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any part of this policy, please do not use the App or the Website.
This policy is addressed to two audiences: merchants who install Rapid Upsell on their Shopify store, and visitors to our marketing Website. It does not cover how individual merchants collect or process their own customers' data on their storefronts — merchants remain responsible for their own storefront-facing privacy policy. Where the App processes data about a merchant's shoppers, the merchant is the data controller and we act as a processor on their behalf.
Information We Collect
a. Information Accessed Through the Shopify API
When you install Rapid Upsell, the App requests access to the following data from your Shopify store. We request the minimum access needed to generate recommendations and report results back to you:
| Data | What we access | Why we need it |
|---|---|---|
| Products | Products, variants, prices, collections and product listings | To build and display upsell recommendations from your own catalog |
| Orders | Order history for the last 60 days — order number, purchased products and prices | To learn which products are genuinely bought together, and to report upsell results in the app |
| Store owner | Name, email address, phone number and physical address of the store owner | Account identification, support and billing communication |
| Theme | Read access to your Online Store theme | To place the upsell module correctly in your existing cart |
| Store analytics | Web pixel — order completion events only | To attribute completed orders to upsells so we can show you accurate results |
Although Shopify grants order access as a whole, we only look at what was bought — products and prices — never at who bought it. Rapid Upsell does not read customers' names, email addresses, physical addresses or phone numbers from your orders, and we never use any store data for advertising or sell it to third parties.
b. Order Tracking & Consent
Rapid Upsell uses Shopify's web pixel framework to register when an order is completed, which is what allows us to show you whether an upsell actually converted. This tracker is deliberately narrow:
- It runs only when an order is completed — we do not track ordinary page visits or browsing sessions
- It runs only if the shopper has allowed analytics cookies through Shopify's own cookie banner, in line with Shopify's Customer Privacy API
- It is never used for advertising, retargeting or profile building
Shopify's permission screen lists device and activity data (such as IP address, geolocation, browser and client ID cookie) because that is what the web pixel framework can technically expose. We use it solely to attribute an order to an upsell, and the merchant remains the data controller for their own shoppers — we act as a processor on the merchant's behalf.
c. Information We Collect Directly From Merchants
In addition to the above, we may collect:
- Store name and
.myshopify.comdomain - Contact information you give us during onboarding or in support requests
- App configuration and usage data (e.g. which upsell features are enabled, plan tier)
- Technical/log data generated automatically by the App (timestamps, error logs, performance metrics) needed to operate and troubleshoot the service
d. Information We Collect From Website Visitors (Cookies & Analytics)
This section concerns rapidupsell.com, our own marketing website — not your storefront. When you visit it, we and our service providers may use cookies and similar technologies to collect: identifiers, IP address, device type, geolocation (approximate), and browsing behavior. Specifically:
| Provider | Purpose | Personal data collected | Retention |
|---|---|---|---|
| Google Analytics | Generates statistics on how visitors use our Website. IP addresses are masked. | No personally identifiable information (IP-masked) | Up to 50 months |
| Webflow | Website design/hosting platform; collects usage data to improve performance and user experience. | Identifiers, IP address, device type, geolocation, browsing behavior | Up to 12 months |
| Google Tag Manager | Manages tracking codes/analytics scripts on the Website. Does not itself collect personal data, but may process IP addresses and metadata needed for tag management. | No personal data stored directly by GTM | Follows underlying tool |
| Zapier | Automates internal processes such as email notifications and data synchronization between our tools. | Depends on the specific automation (typically contact/account data) | As long as necessary |
| Advertising cookies | Used to show relevant ads based on your behavior on our Website, including retargeting. | Identifier, geolocation, IP address, device type | As legally required |
You can manage or disable cookies through your browser settings or via the cookie preference banner on our Website. Opting out of Google Analytics is possible via Google's opt-out browser add-on, and you can manage personalized ads through Google's Ad Settings.
How We Use the Information
We use the information described above to:
- Provide, operate and maintain the App and Website
- Generate upsell recommendations from your catalog and purchase patterns
- Attribute completed orders to upsells, so we can show you accurate results in the App
- Place the upsell module correctly within your existing theme and cart
- Communicate with you about your account, support requests or service updates
- Improve and troubleshoot the App and Website (analytics, error logging)
- Comply with legal obligations
- Where applicable, deliver relevant advertising for our own marketing — this applies to visitors of rapidupsell.com only, never to store or shopper data from the App
We do not use store data, order data or shopper data for advertising purposes, we do not build cross-store profiles, and we do not sell any of it to third parties.
Data Retention
- Product and catalog data is retained for as long as the App is installed, and is refreshed as your catalog changes.
- Order records used for reporting (order number, purchased products, prices) are kept in our analytics records so that you can review your historical upsell performance in the App. We do not delete these on a fixed schedule, because doing so would erase the results you rely on.
- Store data is erased after uninstall. When you uninstall the App, Shopify sends us a
shop/redactrequest 48 hours later, and we delete or anonymize your store's data accordingly. You can also request earlier deletion at any time using the contact details in Section 13. - Website analytics and cookie data follow the retention periods listed in the table in Section 2(d) above.
- We may retain limited data beyond these periods where necessary to comply with legal, accounting or dispute-resolution obligations.
Third-Party Service Providers
We rely on the following categories of service providers (subprocessors) to operate the App and Website: analytics (Google Analytics, Google Tag Manager), website hosting/design (Webflow), and workflow automation (Zapier). These providers only receive the data necessary to perform their function on our behalf and are contractually or by policy restricted from using it for other purposes.
International Data Transfers
Some of our service providers (e.g., Google Analytics, Webflow) may process data on servers located outside the European Economic Area, including in the United States. Where this occurs, we rely on the applicable data transfer safeguards offered by those providers (such as Standard Contractual Clauses or equivalent mechanisms).
Protected Customer Data & Shopify Compliance
Some of the access Rapid Upsell requests — order and customer scopes — falls under Shopify's protected customer data rules. We handle this in line with Shopify's requirements:
- Data minimization. We use only the order fields we actually need (order number, purchased products, prices). We do not use the name, email address, physical address or phone number fields of your customers, which is what would otherwise place us in Shopify's higher protected-data tier.
- Consent. Our order tracker respects the shopper's analytics-cookie choice via Shopify's Customer Privacy API, as described in Section 2(b).
- Compliance webhooks. We maintain the three mandatory privacy webhooks —
customers/data_request,customers/redactandshop/redact— and respond to each within the timeframes Shopify requires. - Roles. For data relating to your shoppers, you are the data controller and Rapid Search Zrt. acts as a processor on your instructions. For your own merchant account data, we act as controller.
Data Processing Terms
Where Rapid Upsell processes data relating to a merchant's shoppers, we do so as a processor acting on that merchant's instructions, and only for the purposes described in this policy. We do not process it for our own purposes, and we do not combine data across stores.
In practical terms this means:
- We process only the data needed to deliver the App's functionality, as set out in Section 2
- We do not disclose store or shopper data to third parties other than the subprocessors listed in Section 5
- We apply appropriate technical and organizational security measures, and encrypt data in transit and at rest
- We assist merchants in responding to data subject requests, and support Shopify's mandatory compliance webhooks
- We delete or anonymize store data following uninstall, as described in Section 4
- We notify affected merchants without undue delay in the event of a personal data breach affecting their data
Merchants who require a separate, signed Data Processing Agreement — for example to satisfy GDPR Article 28 obligations — can request one at any time by emailing hello@rapidupsell.com, and we will provide it.
Your Rights
Depending on your location (e.g., under the GDPR, CCPA/CPRA, or similar laws), you may have the right to: access, correct, delete, or restrict the personal information we hold about you; object to certain processing; and receive your data in a portable format. To exercise any of these rights, contact us using the details in Section 13.
Data Security
We use reasonable technical and organizational measures to protect the information we process. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
Children's Privacy
The App and Website are not directed at individuals under the age of 16, and we do not knowingly collect personal information from children.
Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above. Continued use of the App or Website after changes take effect constitutes acceptance of the revised policy.
Contact Us
Kassai utca 129., Hungary
as the Court of Registry
If you have questions or concerns about this Privacy Policy, please contact us at the email address above.