Discount Ninja (the "App”) provides the ability to manage promotions (the "Service") to you (the "Merchant") who uses Shopify to power their store.
This Privacy Policy describes how personal information about you (the Merchant) and the visitors of your store (the "Visitors") is collected on your store (the "Site"), used, and shared when you install or use the App in connection with your Shopify-supported store.
Data the App Processes and/or Stores
Data classification table
Data element | Personal data? | Stored? | Transfer risk |
IP address | Yes | No | Transient only |
Pseudonymous Device Identifier | Yes | Yes | None |
Promotion integrity metadata | No | Yes | None |
Analytics aggregates | No | Yes | None |
Config data | No | Yes | None |
Shopify Storefront Data
When you install the App the app acquires access to a set of information in your Shopify account required by the App to operate. Specifically, the App has access to:
Discounts: the App can access details of existing discount codes and can create new ones. This is needed to be able to allow you to select a discount code to apply or generate new ones on the fly.
Products: the App can access the list of products and collections available on your store; this allows you to select products and collections directly from the app
Script tags: the App registers a JavaScript script to be executed on your store; this script can be updated to enhance or correct functionality if necessary
Theme files: the App adds liquid files to your theme; these files allow your theme to show discounted prices
Orders: the App can read new orders created in your store. The order data is not persisted on our servers. It is only used to determine how much revenue each of your promotions generates. This helps you determine the ROI on each promotion managed by the App
Customer data: the App optionally temporarily processes transient customer data associated with the orders that are discounted by the app.
The feature is explicitly opt-in, gated by a Shopify permission (PAI), and is disabled by default. This permission is only requested if the feature "Automatically add tags to flag coupon fraud" is enabled. If the feature is disabled, no customer data is accessed.
When this option is selected, Discount Ninja accesses customer data linked to the orders discounted by the app. Specifically, the app processes the first and last name, the shipping address, the email address and the phone number.
This data is processed exclusively in memory for the purpose of evaluating whether a promotion marked as ‘one use per customer’ has been abused. The data is not persisted to storage, is not logged, is not cached, and is automatically discarded immediately after the evaluation.
This data is used for the sole purpose of evaluating whether the customer has attempted to place multiple orders that include the same promotion that is marked as 'one use per customer'.
This data is not persisted, is not shared with third parties and is not used for any other purpose.
In summary:Explicit merchant opt-in (Shopify PAI permission)
Feature-gated (“Automatically add tags to flag coupon fraud”)
Order-scoped
Transient only (Data exists only in memory)
Not persisted
Not shared
Used for a single, narrow purpose (fraud / abuse prevention)
Draft order: the App can create draft orders. Draft orders allow visitors to check out a cart that includes advanced discounts that cannot be applied through a normal checkout.
Personal information of the Merchant
We collect the following types of personal information from you (the Merchant) once you have installed the App:
Name and email address of the Owner and optionally other Staff: this information allows the App to send information when important events occur (e.g. when a scheduled promotion starts or ends; an issue is detected that affects one or more of your promotions; new features are released; ...)
Personal information of the Visitors
We collect the following types of personal information from the individuals who visit your store (the Visitors) once you have installed the App:
IP address (personal data): the App processes, but does not store, the IP address of the visitor in order to determine their location for the purposes of serving them promotions applicable for their location
Pseudonymous device identifier
The app generates a pseudonymous unique device identifier for each device used by individuals who visit your store (the “Visitors”) when accessing promotions.
This identifier is used exclusively for fraud-prevention and promotion-integrity purposes, in particular to enforce promotion settings such as restrictions that allow an offer to be redeemed only once per customer or device.
The device identifier is generated using a cryptographically secure random value combined with a timestamp at the time of creation. It is not derived from IP addresses, device fingerprints, browser characteristics, or any other information that directly identifies an individual, nor is it combined with such data by Discount Ninja.
While this identifier does not directly identify a natural person, it may allow a device to be singled out over time for the limited purposes described above. As such, the identifier is treated as pseudonymous personal data under the GDPR.
Discount Ninja processes this pseudonymous identifier on the basis of its legitimate interests in preventing fraud, abuse, and circumvention of promotion rules, and in maintaining the integrity and fairness of promotions offered by merchants. These interests are balanced against the rights and freedoms of Visitors, taking into account that:
the identifier does not directly identify an individual,
it is used solely for a narrowly defined purpose,
it is not used for advertising, profiling, or cross-site tracking, and
it is not shared with third parties.
The identifier is retained only for as long as necessary to fulfill the fraud-prevention and promotion-integrity purposes described above, or until the relevant promotion or merchant account is no longer active, after which it is deleted or rendered unusable.
Where required under applicable data-protection laws, data-subject rights requests relating to this pseudonymous identifier are handled in cooperation with the relevant merchant, as Discount Ninja acts as a processor with respect to Visitor data.
Admin UI usage data
We partner with Microsoft Clarity to capture how you use and interact with the Discount Ninja admin through behavioral metrics, heatmaps, and session replay to improve and market our products/services. Admin app usage data is captured using first and third-party cookies and other tracking technologies to determine the popularity of products/services and online activity. Additionally, we use this information for site optimization and fraud/security purposes. For more information about how Microsoft collects and uses your data, visit the Microsoft Privacy Statement.
Note that our use of Microsoft Clarity:
is limited to the merchant admin interface
does not track store visitors or shoppers on your storefront
is used for usability and product improvement only
does not result in advertising to store visitors
While Microsoft Clarity is used to understand how merchants interact with the Discount Ninja admin interface, Microsoft may process usage data in accordance with its own privacy documentation.
Sharing Your Personal Information
We do not sell personal data and do not share personal data with third parties for their own independent purposes.
We do share personal data with service providers acting as processors on our behalf, strictly for the purpose of operating, maintaining, securing, and improving the Discount Ninja service, and always under contractual data-processing obligations.
We may also share your Personal Information to comply with applicable laws and regulations, to respond to a subpoena, search warrant or other lawful request for information we receive, or to otherwise protect our rights.
Processing activities
Limoni Apps BV maintains an up-to-date Record of Processing Activities in accordance with Article 30 GDPR.
The company clearly distinguishes between controller and processor roles and applies data minimization principles.
International data transfers have been assessed via a documented Transfer Impact Assessment and are protected through contractual, technical, and organizational measures.
Subprocessor list
Limoni Apps BV maintains a list of the subprocessors used here.
Your data protection rights
Under applicable data protection laws, including the General Data Protection Regulation (GDPR), individuals have certain rights in relation to their personal data. These rights may include the right to access, rectify, erase, restrict or object to processing, and the right to data portability.
How these rights can be exercised depends on your relationship with Discount Ninja and our role in the processing of your personal data.
Merchants (Customers of Discount Ninja)
If you are a merchant using Discount Ninja, we generally act as a data controller for personal data related to your account, billing, and direct communications with us.
You may exercise your data protection rights by contacting us as described on our Data Subject Rights Requests (DSAR) page. We may need to verify your identity before fulfilling your request.
More information about the available rights and how to submit a request is available on our Data Subject Rights Requests (DSAR) page.
Store visitors and end customers
If you are a visitor or customer of a merchant’s online store that uses Discount Ninja, we process your personal data solely on behalf of the merchant, who is the data controller.
As a result:
Discount Ninja cannot independently verify your identity
Discount Ninja cannot determine whether, how, or for how long your data is stored by the merchant
Discount Ninja is generally not authorized to directly fulfil rights requests from store visitors or customers
To exercise your data protection rights, you should contact the merchant directly, using the contact details provided in their privacy policy.
If the merchant submits a valid request to us, we will cooperate with them as required by applicable data protection law and our Data Processing Agreement.
Further details are explained on our Data Subject Rights Requests (DSAR) page.
Right to lodge a complaint
If you believe that your personal data has been processed in violation of applicable data protection laws, you have the right to lodge a complaint with a supervisory authority in your country of residence, place of work, or where the alleged infringement occurred.
Data Residency
Limoni Apps stores data on servers that are in the United States (Azure US regions; exact region may change). Where data is processed and stored is documented per subprocessor here.
Data Retention
Personal data is not retained longer than necessary for the purposes for which it is processed. Retention periods are determined based on contractual obligations, legal requirements, and operational necessity. Where possible, data is deleted or anonymized automatically once it is no longer required.
Data Category | Description | Purpose of Processing | Retention Period | Deletion / Anonymization |
Merchant account data | Store name, shop domain, app configuration settings, promotion definitions | Provide and operate the Discount Ninja service | Retained for the duration of the merchant’s active subscription | Deleted within 30 days after app uninstallation |
Promotion & pricing configuration data | Promotion rules, discount logic, conditions, schedules | Execute promotions and pricing logic on the storefront | Retained while the promotion exists or until deleted by the merchant | Deleted immediately upon merchant deletion or app uninstall |
Order-related metadata (non-personal) | Order IDs, promotion identifiers, discount results (no customer PII by default) | Promotion evaluation, reporting, debugging | Up to 24 months | Automatically deleted or aggregated after retention period |
Optional customer data (fraud-prevention feature) | Customer name, email, phone number, shipping address (retrieved transiently from Shopify) | Detect repeated use of single-use promotions | Not persisted | Processed in memory only; discarded immediately after evaluation |
Application logs | Technical logs, error messages, request metadata (may include pseudonymous identifiers) | Security monitoring, debugging, performance optimization | Up to 90 days | Automatically deleted on a rolling basis |
Analytics & usage data | Feature usage events, interaction metrics, anonymized identifiers | Product analytics and service improvement | Up to 24 months | Aggregated or deleted after retention period |
Support & communications data | Support tickets, chat messages, email correspondence | Customer support and issue resolution | Up to 36 months after last interaction | Deleted or anonymized upon request or after retention period |
Billing & invoicing data | Invoices, payment references, subscription records | Legal and accounting obligations | 7 years (statutory requirement) | Deleted or archived once legal retention expires |
Security & audit data | Access logs, authentication events | Fraud prevention, system security, compliance | Up to 12 months | Automatically deleted unless required for investigation |
Changes
We may update this privacy policy from time to time in order to reflect, for example, changes to our practices or for other operational, legal, or regulatory reasons.
Data Protection Officer
Based on an assessment under Article 37 GDPR, Limoni Apps BV is not required to appoint a Data Protection Officer. The company is not a public authority, does not conduct large-scale regular and systematic monitoring of individuals as a core activity, and does not process special categories of personal data at scale.
Responsibility for data protection compliance, including handling data subject requests and liaising with supervisory authorities, is assigned to the company’s management.
Contact Us
For more information about our privacy practices, if you have questions, or if you would like to make a complaint, please contact us by e-mail at [email protected] or by mail using the details provided below:
Physical address: Gote Moortel 12, 9830, Sint-Martens-Latem, Belgium
Last updated: January 7, 2026