Privacy policy

This policy explains how Foysal Solutions ("we", "us") handles data in WinBack Customer CRM(also listed in the Shopify Partner Dashboard as Sales CRM Insights, and earlier called SegmentIQ), a Shopify app that helps merchants understand and win back their customers. It applies to merchants who install the app and to the store's customers whose data the app processes on the merchant's behalf.

1. Our role

For your store's customer data, you (the merchant) are the controller and we are your processor. We only use that data to provide the app to you. For your own account details as a merchant, we are the controller.

2. Data we collect

• Store data: your shop address, store name, currency, time zone and the access token Shopify gives the app when you install it.
• Customer data: names, email addresses, phone numbers, addresses, marketing consent status and order history, read from your Shopify store through Shopify's official APIs.
• Order data: order numbers, dates, amounts, line items, financial and fulfilment status.
• Data you add: notes, follow-up reminders and settings you create in the app, and API keys you enter for Klaviyo or Mailchimp.
• Technical data: sync logs and error logs we need to keep the app working.

We never collect card numbers or payment details. Billing is handled entirely by Shopify.

3. How we use data

• To show your customer groups, Customer Scores, risk of leaving, reports and Win Back list.
• To keep the app up to date as new orders and customer changes arrive from Shopify.
• To send customer groups to Klaviyo or Mailchimp, only when you connect them and ask us to.
• To provide support and to find and fix errors.

We do not sell or rent data, we do not use it for advertising, and we do not use your store's data to train AI models.

4. Marketing consent

When you send a group to Klaviyo or Mailchimp, only customers who agreed to receive marketing emails in Shopify are added as subscribers. Other customers may be added with a non-subscribed status so you can see them, and will not receive campaign emails.

5. Service providers

6. Storage and security

• All traffic between Shopify, the app and your browser uses HTTPS (TLS).
• The database is not publicly reachable and access is limited to the people who run the app.
• Access tokens and API keys are never written to logs or shown in full.
• In-app downloads such as CSV exports require you to be signed in to your Shopify admin.

If we ever learn of a breach that affects your data, we will tell you without undue delay.

7. How long we keep data

• While the app is installed, we keep the data needed to run it.
• When you uninstall, Shopify sends us a deletion request for your store (normally 48 hours later) and we delete your store, customer and order data.
• When one of your customers asks Shopify to erase their data, Shopify tells us and we delete that customer's records.
• We keep only your shop address and the number of trial days used, so a free trial cannot be restarted by reinstalling.

8. Your rights and your customers' rights

Depending on where you or your customers live (for example under the GDPR in the EU and UK), you can ask to access, correct, export or delete personal data. We handle Shopify's privacy webhooks (customers/data_request, customers/redact and shop/redact) automatically. Merchants can export customer lists as CSV from inside the app. For anything else, emailsupport@foysalsolutions.com.

9. International transfers

Our service providers may process data outside your country, including in the United States. Where the law requires it, transfers rely on the providers' standard contractual clauses or equivalent safeguards.

10. Children

The app is for businesses. We do not knowingly collect data from children.

11. Changes

If we change this policy we will update the date at the top. For important changes we will also tell merchants inside the app.

12. Contact

Foysal Solutions, support@foysalsolutions.com