Kai Reward Play

Privacy policy

Last updated: October 31, 2026

Kai Reward Play (“the app”, “we”) adds reward games to Shopify stores. This policy explains what we collect from merchants who install the app and from shoppers who visit their stores, why, how long we keep it, and the choices people have.

Who is responsible

For shopper data, the merchant who installed the app decides how it is used, and we process it on their behalf. Merchants should mention the app in their store's own privacy policy.
For merchant data, such as the store domain and settings, we are responsible.

What we store

Your store: its domain, currency, time zone, settings, campaigns and designs, and the access token Shopify gives the app.
Plays: a random visitor ID, a one-way hash of the IP address (never the address itself), the cart value, the result and the code won. A Shopify customer ID only when the shopper is logged in; no names or addresses.
Emails: only on campaigns that collect them, typed by the shopper, with whether they agreed to marketing.
Orders: the IDs and totals of orders paid with a reward code, to count results.
Sidekick: when the merchant turns it on, Shopify's Sidekick reads campaigns and results through the app to answer them.
Customer data requests: an export of a shopper's plays and codes, prepared for the merchant to send them.
Store credit prizes: the ID and expiry of the Shopify store credit given to a winner.

In the shopper's browser

The storefront script keeps a few entries in the browser's storage: a random visitor ID, whether the game was shown, closed or used, and the code won, so the game doesn't repeat. No advertising cookies and no tracking across sites.
Visits count for measurement only when the store's customer privacy settings allow analytics.

How we use it

To run the games, issue the codes and stop abuse (one play per shopper, rate limits).
To show merchants their results: sales with reward codes and what the games added.
Emails go to Klaviyo or Mailchimp only if the merchant connects them, and only for shoppers who agreed to marketing.
If the merchant connects Shopify customers, shoppers who agreed to marketing are added to the store’s own customer list in Shopify, subscribed to email and tagged kai-reward. This needs the merchant’s permission to edit customers, which they can take back at any time.
We never sell data or use it for advertising.
If the merchant allows store credit prizes, a winner who is signed in to the store gets the prize as store credit in their Shopify customer account, and Shopify emails them about it. This needs the merchant’s permission to add store credit, which they can take back at any time.

Who we share it with

Providers that host the app and its database process data for us, under contract and only to run the app.
Shopify, the platform the app runs on, and Klaviyo or Mailchimp only when the merchant connects them. We disclose data to authorities only when the law requires it.
Crisp, for the support chat in the app: it receives only what merchants type in the chat and their shop domain.

How long we keep it

Storefront events used for measurement: 2 days. Order links for results: 7 days. Customer data request exports: 90 days.
Campaigns, plays, codes and emails: while the app is installed, unless a shopper's data is erased sooner.
48 hours after a store uninstalls the app, Shopify asks us to delete that store's data and we delete all of it.
When a shopper asks to be erased, Shopify tells us and we delete their plays, codes, emails and exports.
Customers added to Shopify belong to the store: the merchant manages and deletes them in Shopify, and Shopify handles shoppers’ requests about them.

Security

Data travels over HTTPS. Shopify access tokens stay on our servers and never reach the browser; IP addresses are stored only as a one-way hash.
Only the people who run the app can reach production data, and only to operate and support it.

Your choices and rights

Shoppers can ask the store they shopped at to see or erase their data. The store gets each request's export in the app and Shopify passes erase requests to us.
Shoppers who agreed to marketing can unsubscribe from the store's emails at any time.
Merchants can delete all their data by uninstalling the app.

Changes

When we change this policy we update the date above, and we announce important changes in the app.

Contact

Questions or requests about privacy: email support@kailab.app.