Privacy policy

Who we are

IQ Rewards is a Shopify app operated by IQ Apps and served from membership.iqapps.app. This policy explains how the app handles merchant data and data about merchants' customers. Last updated: 20 October 2026.

Data we receive about the merchant's store

When a merchant installs IQ Rewards, Shopify provides:

The store's myshopify.com domain, currency and time zone.
An access token that lets the app call Shopify on the merchant's behalf, limited to the permissions approved at install.
The store's IQ Rewards plan and subscription status from Shopify App Pricing.

Data about the merchant's customers

To give cashback as Shopify Store Credit, IQ Rewards stores:

The Shopify customer ID of customers who earn rewards or view their balance.
For each paid order: the order ID and number, merchandise subtotal, currency, sales channel, and the amount paid with Store Credit (which does not earn cashback).
For each refund: the order ID and refunded amounts, used to reverse cashback.
Reward records: cashback amounts, expiry dates, status and Shopify Store Credit transaction IDs, plus each customer's order count, total spend and Store Credit balance as seen by the app.
Customer tags that IQ Rewards adds in Shopify, if the merchant turns on that feature.

Data we do not store

Shopify order webhooks include customer contact details such as name, email, phone and address. IQ Rewards uses only the customer ID from them and does not save names, email addresses, phone numbers, addresses or payment details. Payments, card data and the main customer records stay in Shopify, and Store Credit balances are held in Shopify.

Storefront, checkout and customer accounts

The IQ Rewards theme blocks, checkout and Thank-you page blocks, and customer account page show balances and cashback. When a customer is signed in, Shopify tells the app who they are through signed requests, and the app returns only that customer's rewards. These blocks do not set cookies or use tracking or analytics technologies.

Data merchants give us

Cashback settings, display text and appearance choices entered in the app, and any messages a merchant sends to support by email or chat.

How we use data

We use this data only to run IQ Rewards: calculating, issuing, expiring and reversing cashback as Shopify Store Credit; showing balances and history to the merchant and their customers; running features the merchant turns on, such as Shopify Flow triggers; managing billing through Shopify; providing support; and keeping the service secure and working. We do not sell data or use it for advertising.

Service providers

We use these providers to run the app. Their servers may be located outside your country.

Shopify — the commerce platform, APIs, Store Credit, checkout and app billing.
Railway — hosts the IQ Rewards application and its database.
Tawk.to — the support chat in the merchant admin. It loads only when a merchant opens chat and receives what the merchant types plus technical details such as the page address and browser.
Our email provider — for messages sent to support@iqapps.app.

Security

Connections to IQ Rewards use HTTPS. The app checks Shopify's signature on every webhook, and storefront, checkout and customer account requests are accepted only when Shopify has signed them for that store and customer. The app accesses Shopify only with the permissions the merchant approves.

Retention and deletion

How long we keep data:

While the app is installed, reward and Store Credit history is kept so balances, expiry and refunds stay correct.
Webhook delivery records keep only the topic, delivery ID and time, not order contents. They are deleted with the store's data as described below.
When a merchant uninstalls, the store's access tokens are deleted immediately. Settings and reward history are kept so a reinstall can continue.
48 hours after uninstall, Shopify asks us to erase the store's data. We then clear customer contact fields, mark customer records deleted, and delete webhook delivery records and access tokens. Reward and Store Credit history and merchant settings, which identify customers only by Shopify ID, are currently kept; we have not yet set a fixed deletion period for them.
Server logs, which contain store domains and webhook IDs, are kept according to our hosting provider's log retention.

Customer privacy requests

Customers should contact the store they bought from. Shopify forwards requests to IQ Rewards:

Data request: we record it and, when the merchant contacts support@iqapps.app, send the merchant the data we hold for that customer within 30 days.
Deletion request: we clear the customer's contact fields, mark their record deleted, and remove any stored webhook data for their orders. Their reward history is kept by Shopify customer ID so the store's Store Credit records stay consistent.

Changes and contact

We will update this page when our data practices change. Privacy questions and requests: support@iqapps.app — please include your myshopify.com domain.