Merchant Terms

Service

AOVIQ provides Shopify checkout extension surfaces for merchant-configured post-purchase, thank-you page, and order-status upsell offers. Merchants control funnel configuration, product selection, discounts, targeting rules, and offer status.

Shopify Checkout And Billing

AOVIQ does not bypass Shopify checkout, does not process payments outside Shopify, and uses Shopify Billing for app charges. Accepted post-purchase offers use Shopify's approved post-purchase changeset flow.

Merchant Responsibilities

Merchants are responsible for configuring truthful offers, lawful discounts, accurate product information, and customer-facing content that does not include misleading scarcity claims, invented discounts, fabricated reviews, or other deceptive claims.

Data Protection

AOVIQ processes only the data needed to provide app functionality, analytics, personalization, security, and privacy operations. The app supports Shopify privacy webhooks for customer data requests, customer redaction, shop redaction, and uninstall cleanup.

Roles

For personal data relating to the merchant's customers, the merchant acts as controller and AOVIQ acts as processor. This section forms the data processing agreement between the merchant and AOVIQ and applies for as long as the app is installed.

Subject matter, nature and purpose

AOVIQ processes personal data solely to decide whether a merchant-configured upsell offer applies to an order, to display that offer on Shopify's post-purchase, thank-you and order-status surfaces, to apply an accepted offer through Shopify's changeset flow, and to report the resulting impressions, acceptances, declines and revenue back to the merchant. Processing lasts for the term of the installation and the configured retention window.

Types of personal data

Shop domain, order and checkout identifiers, customer identifiers, customer tags, lifetime order count, product, variant and collection identifiers, discount codes, country code, currency, order totals, upsell events, and short-lived offer authorizations. AOVIQ does not request, receive or store customer names, email addresses, phone numbers, postal or billing addresses, geolocation, zip codes, payment card data or payment credentials. The categories of data subjects are the merchant's customers and store visitors.

Instructions

AOVIQ processes personal data only on the merchant's documented instructions, which consist of these terms and the merchant's own configuration in the app, unless required otherwise by applicable law. If AOVIQ believes an instruction infringes data protection law, it will inform the merchant.

Confidentiality

Persons authorised to process this data are bound by confidentiality and access is limited to what their role requires.

Security

Data in transit is protected by HTTPS with HSTS. The production database is stored on a LUKS2-encrypted volume (AES-XTS, 512-bit key), and database backups are held inside the same encrypted volume. Post-purchase offer authorizations are single-use and expire after 15 minutes. The scope and limits of these measures are described in the privacy policy.

Sub-processors

AOVIQ uses Shopify Inc. as the source and destination of the processed data, and Hostinger as hosting provider for the application server and database. AOVIQ will inform merchants of intended changes to this list and give them the opportunity to object.

Assistance to the merchant

AOVIQ assists the merchant in responding to data subject requests through Shopify's customer data request and redaction webhooks, and in meeting the merchant's obligations for security, breach notification and data protection impact assessments, taking into account the nature of the processing and the information available. AOVIQ notifies the merchant without undue delay after becoming aware of a personal data breach affecting that merchant's data.

Deletion

On shop redaction, customer redaction or app uninstall, AOVIQ deletes or anonymises the affected data. Data that is no longer needed is removed according to the configured retention window.

Audit and information

AOVIQ makes available the information necessary to demonstrate compliance with these obligations and allows for and contributes to audits by the merchant or an auditor mandated by the merchant, on reasonable notice and without disclosing other merchants' data.

Processing location

AOVIQ's application server and database are hosted in Frankfurt, Germany. Personal data processed by AOVIQ therefore stays within the European Union, and no transfer to a third country takes place on AOVIQ's side. Shopify's own processing of the same data is governed by the merchant's agreement with Shopify. Merchants can confirm the current processing location at support@aoviq.com.

Support

For setup, billing, privacy, or app support, contact support@aoviq.com.