Privacy Policy

Last updated: April 26, 2026

Onecount Notify ("we", "our", "the app") is operated by Onesita Tech. This Privacy Policy describes how we collect, use, and protect information when a Shopify merchant installs and uses Onecount Notify, and when an end customer of that merchant interacts with notifications sent through the app.

1. Information We Collect

From Merchants

• Shop domain, store name, and Shopify access tokens (issued by Shopify during install).
• SMTP, SMS, WhatsApp, and Push provider credentials that the merchant chooses to enter. All such credentials are encrypted at rest using AES-256-GCM.
• Notification templates, trigger configuration, and other operational settings.

From End Customers (the merchant's shoppers)

• Email address, phone number, and/or web push subscription endpoint — only when the customer voluntarily subscribes to a notification.
• Anonymous browse events (product views) when enabled by the merchant, used solely to deliver abandoned-browse reminders.
• Notification delivery and engagement events (sent, delivered, opened, clicked).

2. How We Use Information

• To deliver the notifications the merchant has configured and the customer has consented to.
• To provide analytics to the merchant on the performance of those notifications.
• To operate, maintain, and secure the service.

3. WhatsApp Business Messaging

If a merchant enables WhatsApp through the app, messages are sent via Meta's WhatsApp Business Cloud API or Twilio. End customers receive messages only after opting in through a merchant storefront form, checkout, or other explicit consent surface. Customers may reply STOP at any time to opt out. We do not use WhatsApp message content for advertising or share it with third parties beyond the underlying messaging provider.

4. SMS Messaging

SMS notifications require explicit double opt-in. Standard message and data rates may apply. Reply STOP to opt out, HELP for help.

5. Sharing of Information

We share information only with:

• The merchant whose store the customer subscribed through.
• Sub-processors required to deliver messages: SMTP/email providers, Twilio, MessageBird, Vonage, Meta, and web push services (FCM/APNs/Mozilla).
• Authorities, when required by law.

We do not sell personal information.

6. Data Retention

Subscription and delivery records are retained while the merchant's installation is active. On uninstall, customer data tied to that shop is purged within 30 days, except where retention is required by law. GDPR data-subject requests are processed within 30 days.

7. Your Rights

EU/UK/California residents may request access, correction, deletion, or portability of personal data. Contact the merchant directly, or email privacy@onecount.app.

8. Security

All third-party credentials are encrypted at rest. Transport uses TLS 1.2+. Access to production systems is restricted and audited.

9. Changes

We may update this policy. The "Last updated" date above reflects the latest revision. Material changes will be communicated to merchants in-app.

10. Contact

Onesita Tech — privacy@onecount.app