This policy explains what we collect, why we collect it, and what we do with it. We are the data controller for data about brand admins (you, the merchant). For entrant data collected through your competitions, the brand running the competition is the controller and we are the processor.
What we collect
- Brand admins: email, hashed password, display name, timestamps.
- Entrants: email, optional name + phone, marketing-consent flag (with timestamp), competition entries and any type-specific metadata (caption, quiz answers, etc.).
- Operational data: IP address, user agent, fingerprint hash for anti-fraud.
- Billing data: handled by Stripe; we store the customer ID and subscription status only.
- Shopify data (if connected): shop domain, encrypted access token, list of granted scopes. We do not store any Shopify customer data beyond what is needed to award points or sync entries.
Why we collect it
- To run the platform and your account.
- To operate competitions you create, including drawing winners and emailing them.
- To process payments through Stripe.
- To detect and prevent fraud.
- To comply with our legal obligations.
Marketing consent
When an entrant ticks the marketing-consent box on one of your competitions, we record the consent and the timestamp. We never use that consent ourselves — it's recorded so you can rely on it when you market to those people via your own tools (Klaviyo, Shopify Email, Mailchimp, etc.).
Your rights
You can request access, correction, or deletion of your personal data at any time by emailing us. Entrants should contact the brand whose competition they entered for entrant-data requests — that brand is the data controller.
Data residency
Primary servers are in the US (Fly.io, region iad); object storage (Tigris) is region-replicated. We use sub-processors including Stripe (payments), Resend (transactional email), and Shopify (where the integration is enabled).
Contact: hello@comps-app.fly.dev