LesyLoyalty Privacy Policy
Last updated: October 26, 2026
1. Who we are
LesyLoyalty is a Shopify loyalty program app published by LesyDev, 2088 rue des Rêves, Sainte-Julienne, Quebec J0K 2T0, Canada ("we"). This policy explains what information the app processes, why, and for how long.
It covers two groups:
- merchants who install LesyLoyalty on their Shopify store;
- merchants' customers who are enrolled in a store's loyalty program.
For customers, the merchant is responsible for the program it offers; LesyLoyalty processes their information on the merchant's behalf and according to its instructions. Customer questions about their data should go to the store first, which can forward them to us.
2. Information we collect
We only collect what is needed to run the program. LesyLoyalty never receives or stores payment information: payments go through Shopify.
| Person | Information | Source | Why |
|---|---|---|---|
| Merchant | Store address (myshopify.com), currency, time zone, language | Shopify, at installation | Run the app on the right store |
| Merchant | Program settings, tiers, rewards, promotions, challenges, email reminder settings, plan | Entered by the merchant | Apply the merchant's rules |
| Merchant | Sender name, reply-to address and logo for email reminders, if provided | Entered by the merchant | Personalize the reminders sent to its customers |
| Merchant | Shopify access tokens; Judge.me token if Judge.me is connected; API keys and webhook URLs the merchant creates (Pro plan) | Shopify, Judge.me, the merchant | Read orders, create codes, reward reviews, provide the API |
| Customer | Shopify customer ID, email, first name | Shopify | Identify the member and show their account |
| Customer | Customer account language and email marketing subscription status, read when a reminder is sent (not stored) | Shopify | Write the reminder in the right language and respect consent |
| Customer | Choice to stop receiving program reminders | The customer, through the unsubscribe link | Stop emailing them |
| Customer | Phone number, only if the merchant uses it through the API to find or create a customer | Shopify, the merchant | Identify the customer |
| Customer | Birthday (optional) | Entered by the customer in the widget | Birthday reward |
| Customer | Balance, tier, points history, challenge progress | Calculated by the app | Keep the program up to date |
| Customer | Number, date and eligible amount of paid orders, cancellations, refunds, including orders placed before installation if the merchant runs a backfill | Shopify | Award or remove points |
| Customer | Sales made outside Shopify (reference and amount), if the merchant sends them through the API | The merchant | Award or remove points |
| Customer | Reward codes issued and used (in the widget, at the point of sale or at checkout), gift cards obtained with points; amount of the orders where a code was used | Created by the app in Shopify | Points redemption, merchant's ROI report |
| Customer | Referral code, referrals made or received | Calculated by the app | Referral program |
| Customer | Published reviews (ID, whether a photo is included) | Judge.me, if the merchant connected it | Points for reviews |
| Customer | Log of email reminders and Shopify Flow events (type, date, delivery status) | Created by the app | Avoid duplicates, show the merchant what was sent |
We do not collect postal addresses or browsing data for advertising purposes.
3. How we use information
Information is used only to provide the loyalty program chosen by the merchant:
- calculate and display points, tiers, challenges and rewards;
- create discount codes and gift cards in the Shopify store, including at checkout;
- show the balance at the point of sale, at checkout and in the store's emails;
- send, on the store's behalf and if the merchant turns them on, email reminders about the program (see below);
- send the store, if the merchant turns it on, Shopify Flow events it uses in its own automations;
- award points retroactively for past orders, if the merchant runs a backfill;
- apply the merchant's plan and show its statistics and program ROI;
- send the merchant, through the API and webhooks it configures, the data of its own program;
- handle access and deletion requests forwarded by Shopify.
Email reminders. The merchant chooses which reminders its customers receive. Account notices (points credited, expiring code, tier reached, birthday) are sent to program members. Incentive reminders (reward within reach, dormant points, monthly challenge) are only sent to customers subscribed to email marketing in Shopify. Every email includes a one-click unsubscribe link that stops all program reminders for that customer. The email address is read from Shopify when the reminder is sent.
Backfill of past orders. At the merchant's request, the app reads the paid orders of a period the merchant chooses (up to the store's full history, if Shopify allows it) and awards points under the program's current rules. Customers who ordered but were not yet members are then enrolled in the store's program. No reminder or event is sent during a backfill.
We do not sell, rent or trade any information. We do not use it for advertising or to train artificial intelligence models, and we never combine data from different stores.
4. Sharing and service providers
Information is only shared with the services needed to run the app:
| Service | Role | Information involved |
|---|---|---|
| Shopify | Store platform, app billing | Codes, gift cards, customer balance and tier metafields; Shopify Flow events if the merchant turns them on (customer ID, points, tier, reward, code) |
| Resend (only if the merchant turns on email reminders) | Email delivery | Customer email and first name, reminder content (balance, reward, code, expiry date); no marketing use by Resend |
| Judge.me (only if the merchant connects it) | Product reviews | Review ID, received from Judge.me |
| Klaviyo (only if the merchant connects it, Growth plan and up) | Merchant's email marketing and segmentation | Email, first name, points, tier, referral code, birthday and program events; marketing consent is never changed |
| DeepL | Translation of program texts | Texts entered by the merchant (tier names, reward names, etc.); no customer information |
| OVHcloud, Beauharnois data center (Quebec, Canada) | App server, database and backups | All information in section 2 |
| Systems chosen by the merchant (Pro plan) | API and outgoing webhooks | The program data the merchant chooses to receive, such as a member's ID, email and points |
We may also disclose information when required by law. App data is hosted in Quebec; Shopify, Resend, Judge.me, DeepL and Klaviyo process it under their own policies, and some of them process it outside Canada (notably in the United States). The merchant is responsible for the systems it points the API and webhooks to, and for the automations it builds in Shopify Flow.
5. Retention and deletion
Information is kept while the store uses LesyLoyalty, then deleted automatically:
| Situation | What is deleted | When |
|---|---|---|
| The merchant uninstalls the app | Shopify access tokens | Immediately |
| Shopify confirms the store's deletion | All store data: settings, members, points, codes, API keys, logs, pending requests | About 48 hours after uninstalling |
| A customer asks the store for deletion | Their member account, history, credited orders, codes, referrals and reminder log | When the request is received from Shopify |
| Technical log of Shopify events and webhook deliveries | Log entry | After 30 days |
| Log of email reminders and Shopify Flow events | Log entry | After 90 days |
| Database backups | Full copy | After 30 days |
Deleted data may remain in backups until the end of this 30-day period. Discount codes and gift cards already created in Shopify belong to the store and remain there after uninstalling.
6. Security
All communications use HTTPS. Every message from Shopify is verified by its signature before being processed, and every outgoing webhook is signed. Access tokens, the Judge.me token, API keys and the email sending key are never sent to the browser. Unsubscribe links are signed so no one can unsubscribe someone else. Member emails and first names, event log contents and backups are encrypted (AES-256). Member record views and API calls are logged and kept for 90 days. Server access is limited to the people who administer it.
7. Your rights
Anyone can request access to, correction of, or deletion of their information.
- Store customers: send your request to the store. Shopify forwards it to us; we prepare the export for the merchant or delete the data. To stop receiving program reminders, use the unsubscribe link at the bottom of any reminder.
- Merchants: write to us at the address below.
We respond within 30 days. In Quebec, you may also contact the Commission d'accès à l'information.
8. Privacy officer and contact
Person in charge of the protection of personal information: Alexis Leclerc, Founder, privacy@lesyloyalty.com, 2088 rue des Rêves, Sainte-Julienne, Quebec J0K 2T0, Canada.
Support: support@lesyloyalty.com
9. Changes
We will post any changes on this page with their date. Significant changes will also be announced to merchants in the app.