Privacy Policy

Last updated: June 30, 2026

Overview

Gradient Smart Discount helps merchants identify slow-moving products and manage controlled markdown campaigns. The app stores shop, catalog, inventory, order-line aggregate, campaign, audit, and operational data needed to classify products, write guarded Shopify sale prices, clean up legacy app-managed discounts, and report campaign outcomes.

Data We Collect

• Shop profile: shop domain, primary currency, timezone, an encrypted Shopify access token, and install/uninstall timestamps — used to authenticate the shop and call Shopify Admin APIs in the correct money and time context.
• Catalog: product and variant identifiers, titles, status, vendor, product type, tags, image URL, SKU, price, compare-at price, cost, currency, and inventory quantities — used for product selection, classification, and margin/floor safety checks.
• Order-line aggregates: order-line identifiers, quantities, refunded quantity, gross/net revenue, currency, and discount allocations — used to compute velocity, sell-through, revenue, and campaign reporting.
• Derived data: velocity snapshots and Fast/Normal/Slow/Insufficient-Data classifications.
• Campaign and audit data: campaign settings, ladder and discount-bucket state, immutable audit events, and discount write attempts — providing a reversible audit trail.
• Operational data: webhook delivery metadata, worker failure records, and alerts — used to deduplicate deliveries and recover failed background work.

Data We Do Not Collect

• No customer names, emails, addresses, phone numbers, IP addresses, payment data, or customer account records are stored. The app has no customer data model.
• Order-line records store operational identifiers and aggregated line values, not customer identity.
• The storefront badge uses a Shopify theme app extension and app-owned product metafields — there are no ScriptTags, pixels, or browsing-behavior beacons.
• The embedded app relies on Shopify session-token authentication; Gradient does not create its own storefront tracking cookies.

How We Use Data

• Classify products by calculating variant velocity from local catalog, inventory, and order-line snapshots.
• Run merchant-configured discount campaigns through guarded Shopify variant sale-price writes, with legacy automatic-discount cleanup where older campaign state still exists.
• Enforce price safety rules such as effective-price floors, max-discount limits, and margin checks.
• Produce campaign reports, operational alerts, and audit history.

Retention and Deletion

Shop data is retained while the app is installed so that active campaigns can be audited and reversed. When Shopify sends a shop/redact request, Gradient runs a full purge of that shop's data, including its immutable audit events and the shop record itself. The only record retained afterward is an anonymous aggregate metric with no shop, product, variant, campaign, or delivery identifier and no link back to the shop.

GDPR Webhooks

The three mandatory Shopify privacy webhooks are registered and HMAC-verified before any side effects:

• customers/data_request — acknowledged; no customer data exists to return.
• customers/redact — acknowledged; no customer data exists to delete.
• shop/redact — runs the full shop purge after the verified delivery is processed.

Data Sharing

Gradient does not sell or share merchant data with third-party advertising, analytics, or data brokers. Operational data is stored in Gradient-managed PostgreSQL and used only to provide the app.

Security

• Shopify access tokens are encrypted at rest using AES-256-GCM.
• Secrets are redacted from logs.
• Embedded Admin API calls use Shopify App Bridge session tokens.
• Webhooks are HMAC-verified and deduplicated by delivery id before any side effects.

See the public Protected Customer Data Access evidence for the exact order-data justification and Partner Dashboard request.

Contact

For privacy questions, data requests, or any concerns about this policy, contact us:

• Email: gradientsupport1@gmail.com
• Discord: discord.gg/R9vQaNeMpB (DM: gradient001)

We aim to respond within 24 hours.