Gift Calendar App Privacy Policy

This Privacy Policy was posted and last updated on 4 November 2026. It explains how the Gift Calendar Shopify app (the "App") handles personal data, including the data collected from shoppers when they open a gift in a merchant's store.

This policy is specific to the App. The separate website Privacy Policy governs the giftcalendarapp.com marketing website. Any capitalized terms not defined here have the meaning given in our Terms and Conditions.

Who We Are

The App is developed and operated under the Sales Booster Squad brand by Ferenc Forgács EV, a sole proprietor (egyéni vállalkozó) registered in Hungary ("we", "us", or "our"). You can reach us at hello@salesboostersquad.com. The App is installed by Shopify merchants ("Merchants") on their Shopify stores and lets them build an advent-calendar-style gift calendar on their storefront. Shoppers ("you", in the context of shopper data) interact with that calendar to open gifts.

Our Role: Controller and Processor

Our role under data protection law (such as the GDPR) depends on whose data is involved:

• Shopper data. When a Merchant enables data collection on a gift and a shopper submits the form to open it, the Merchant is the Data Controller of that shopper data, and we act as a Data Processor on the Merchant's behalf and on their instructions. This data is stored inside the Merchant's own Shopify store (see "Where Your Data Is Stored" below), not on our own servers.
• Merchant and account data. For the data we collect to provide the App to Merchants (store details, staff account information, app configuration and logs), we are the Data Controller.

Information We Collect

Shopper data collected when opening a gift. This data is only collected when a Merchant has turned on the data collection feature for a specific gift. Before the gift is revealed, the shopper is asked to submit a form that may include:

• Email address — always required.
• First name and last name — collected only if the Merchant enables these fields.
• Additional information — an optional free-text field, collected only if the Merchant enables it. Shoppers should not enter sensitive information here.
• Marketing consent — an optional checkbox, recording whether the shopper agrees to receive marketing from the Merchant. Shown only if the Merchant enables it.
• Privacy policy acceptance — a required confirmation that the shopper accepts the applicable privacy terms before submitting the form.

Alongside the submitted form, the following is captured automatically with each gift opening:

• Gift date — the date of the opened gift.
• Language — the storefront language used.
• Timestamp — the date and time the form was submitted, which also serves as the record of when marketing and privacy consent was given.

We do not collect phone numbers, postal addresses, IP addresses, payment details, or device fingerprints through the gift-opening flow.

Merchant and account data. To provide the App to Merchants, we process: Shopify authentication session data (including the staff member's name, email address and Shopify user ID), store and store-owner details (such as the owner's name and email), the Merchant's App configuration and gift calendar content, and operational logs.

How and Why We Use the Data

We use shopper data, on the Merchant's instructions, to:

• Reveal the gift to the shopper after the form is submitted.
• Create or update a customer record in the Merchant's Shopify store so the Merchant can recognise and follow up with the shopper.
• Record the shopper as subscribed to the Merchant's email marketing only if the shopper gave marketing consent.
• Trigger the Merchant's own Shopify Flow automations (for example tagging, emails, or notifications the Merchant has set up).

We use merchant and account data to:

• Provide, operate and maintain the App.
• Provide customer support to Merchants.
• Secure the App and detect, prevent and address technical issues.

Legal bases (GDPR). Where the GDPR applies, we and our Merchants rely on: the shopper's consent (for submitting the form and for marketing); the performance of a contract with the Merchant; and our legitimate interests in operating, supporting and securing the App.

Where Your Data Is Stored

Shopper data collected through the gift-opening form is stored inside the Merchant's own Shopify store — as app-owned metaobject entries and as Shopify customer records that the Merchant controls. It is not stored in our own databases. Because the data lives in the Merchant's Shopify store, it is also subject to Shopify's Privacy Policy.

Merchant and account data is stored in a managed MongoDB database hosted in the European Union, and the App itself is hosted on infrastructure located in the European Union.

Your information may be transferred to — and maintained on — computers located outside of your state, province, country or other governmental jurisdiction where data protection laws may differ from those of your jurisdiction. We take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy.

Cookies, Local Storage and Tracking

The App's storefront gift calendar sets no cookies and uses no tracking or advertising pixels. It stores a small amount of information in the shopper's browser using local storage, solely to make the calendar work:

• Which gifts (doors) have already been opened.
• A cache of revealed gift content and a completion token so an opened gift stays open.
• The name, email and additional information the shopper entered, so the form can be pre-filled on return visits from the same browser.

This information stays in the shopper's own browser and can be cleared at any time through the browser's settings. Analytics used on the giftcalendarapp.com marketing website are described in the separate website Privacy Policy.

Third Parties and Sub-Processors

We do not sell shopper data and do not use it for our own advertising. We rely on the following service providers:

• Shopify — the platform the App runs on and the place where shopper data and Merchant data are stored. Privacy Policy.
• Shopify Flow — when a Merchant has built Flow automations, collected shopper data is passed into those Merchant-controlled workflows.
• Resend — our transactional email provider, used to send App-related emails to Merchants, including the data export we send to a Merchant in response to a data request. Privacy Policy.
• Sentry — error monitoring for the App's admin and server components (hosted in the European Union). It is not used in the storefront gift-opening flow. Privacy Policy.
• Fly.io — our application hosting provider (European Union region). Privacy Policy.
• MongoDB Atlas — the managed database (European Union) that stores Merchant and account data. Privacy Policy.

Data Retention and Merchant Responsibilities

Shopper data collected through the App is stored within the Merchant's own Shopify store and remains under the Merchant's control. As the Data Controller, it is the Merchant's responsibility to retain this data only for as long as it is needed and to delete it in a timely manner in accordance with applicable law and their own retention obligations. We provide tools to assist (including the deletion of records in response to the requests and app-removal events described below), but we do not determine retention periods on the Merchant's behalf.

Merchants who enable the data collection feature are also required to provide and maintain their own privacy policy that informs shoppers how the Merchant collects, uses, stores and deletes the data gathered through their gift calendar, and to obtain any consents required by law. The consent timestamp recorded with each submission is retained as a record of the consent given.

Your Data Protection Rights

Depending on where you live, you may have rights under laws such as the GDPR and the CCPA, including the right to access, correct, delete, object to or restrict the processing of your personal data, to data portability, and to withdraw consent at any time.

Because the Merchant is the Data Controller of shopper data collected through a gift calendar, shoppers should direct these requests to the Merchant whose store collected the data. We support Merchants in honouring these requests as their Data Processor, including through Shopify's standard data request and data erasure processes. If you are a Merchant or account holder, or you are unsure who to contact, you can reach us at hello@salesboostersquad.com. You also have the right to lodge a complaint with your local data protection authority.

Shopify Compliance and Data Requests

The App implements Shopify's mandatory compliance webhooks and handles Protected Customer Data in accordance with Shopify's requirements:

• Customer data request — when a data request is received, we assemble the shopper records held for that customer and provide them to the Merchant so the Merchant can respond.
• Customer data erasure (redact) — the shopper records we hold for that customer are deleted. The Merchant's own Shopify customer record remains under the Merchant's control.
• Shop data erasure and app uninstall — when a Merchant uninstalls the App or requests shop erasure, the Merchant's App data is purged from our systems, and the app-owned records stored in the Merchant's Shopify store are removed together with the App.

To provide these features, the App requests only the Shopify access scopes it needs, which include permission to read and write customer and metaobject data in the Merchant's store.

Security

The security of your data is important to us, but remember that no method of transmission over the Internet, or method of electronic storage, is 100% secure. While we strive to use commercially acceptable means to protect personal data, we cannot guarantee its absolute security.

Security Incident Response

We maintain procedures to detect, investigate and respond to security incidents affecting personal data. If we become aware of a personal data breach involving data processed through the App, we will:

• take reasonable steps to contain and mitigate the incident and investigate its cause and scope;
• notify affected Merchants without undue delay — and, where the App acts as Data Processor, assist each Merchant (as Data Controller) in meeting their own breach-notification obligations to regulators and affected shoppers;
• notify the relevant supervisory authority and affected individuals where we are required to do so by applicable law; and
• cooperate with Shopify and follow Shopify's incident reporting requirements where the incident involves Protected Customer Data.

You can report a suspected security issue to us at any time at hello@salesboostersquad.com.

Children's Privacy

The App does not address anyone under the age of 18 ("Children"). We do not knowingly collect personal data from anyone under the age of 18. If you believe a child has provided us with personal data, please contact us and we will take steps to remove that information.

Changes To This Privacy Policy

We may update this Privacy Policy from time to time. We will notify Merchants and post the new Privacy Policy on this page, and update the date at the top. You are advised to review this Privacy Policy periodically for any changes. Changes are effective when they are posted on this page.

Contact Us

If you have any questions about this Privacy Policy, please contact us at hello@salesboostersquad.com or by using the contact information at the bottom of this page.