Smart Upsell · Product & features · Shopify App Store

Privacy policy

Effective date: 1 October 2026

This notice describes how Dynamic Dreamz (“we”, “us”) processes information when a merchant installs Smart Upsell from the Shopify App Store or uses https://dynamicdreamz.com. It is written for Shopify’s app listing. It is not legal advice. Have counsel review it before you rely on it.

Who this covers

• Merchants who install the app on a Shopify store (including staff who open the embedded admin).
• Shoppers on that store who see or interact with an upsell in cart, checkout, or thank-you, or whose browse activity is used for ranking.

Who we are

Smart Upsell is operated by Dynamic Dreamz. Contact: support@dynamicdreamz.com. Hosting: the app runs on our servers at https://dynamicdreamz.com (currently Vercel) and uses a database we control.

Shopify is a separate controller for the merchant’s store, checkout, and Admin. We receive data through Shopify APIs, session tokens, webhooks, app proxy, and checkout / theme / pixel extensions.

Data we process

Merchant and store

• Shopify shop domain and offline/online session tokens needed to run the app.
• Offer configuration (names, placements, trigger products, recommended products, schedule, copy).
• Synced catalog fields we store to pick products (product and variant ids, titles, images, amounts).
• Subscription plan stored for the shop (for example Free or Silver) and related billing records from Shopify.
• Admin analytics aggregates derived from events below.

Shoppers

• Funnel events for an upsell: viewed, clicked, added to cart, purchased, with shop, offer id, product and variant ids, placement, time, and optional order id and revenue for purchases.
• Shopify customer id when the shopper is logged in; otherwise a guest key we generate in checkout storage or a similar anonymous key from the storefront. We use these to connect events, not as a login for shoppers.
• Browse activity from our web pixel (product views and similar events) with shop, product ids, customer id or guest key, and time, used to rank which product to show when that feature is enabled.

We do not ask shoppers for payment card numbers. Checkout payments stay on Shopify. Our GDPR handlers do not store customer email or phone from compliance webhooks; they use Shopify customer and order ids.

Why we process it

• Install, authenticate, and operate the embedded admin.
• Show merchant-configured related products in cart, checkout, and thank-you.
• Apply plan limits and Shopify App Pricing.
• Measure upsell performance for the merchant.
• Respond to Shopify mandatory GDPR webhooks and uninstall.
• Secure the service and debug faults.

Legal bases (where GDPR/UK GDPR apply) are typically performance of the merchant contract, legitimate interests in running a store app, and legal obligation for Shopify compliance webhooks.

How we share it

• Shopify — APIs, webhooks, Billing, Checkout UI, theme app extensions, and pixels as required to provide the app.
• Infrastructure — hosting and database providers that process data on our instructions (including Vercel and our database host).

We do not sell shopper lists. We do not use shopper events to advertise our app to those shoppers on other sites.

Cookies and similar storage

The embedded admin uses Shopify session tokens (not third-party cookies for auth). Checkout UI may store a guest key in extension storage. The storefront pixel and theme scripts may use cookies or local storage that Shopify and the merchant’s theme allow, to remember a guest key or send activity. Shoppers should review the merchant’s own store policy as well.

Retention

We keep store and offer data while the app is installed and the merchant’s plan allows storage. After Shopify sends shop/redact, we stop keeping that shop’s data as implemented in our compliance webhooks. After customers/redact, we remove or detach shopper identifiers we hold for that customer as implemented in those webhooks. Uninstall webhooks stop the app for that shop. Backups may lag for a short period.

Shopify mandatory webhooks

We subscribe to customers/data_request, customers/redact, and shop/redact. To request a copy or deletion outside Shopify’s flow, email support@dynamicdreamz.com with the shop domain.

International transfers

Servers may be outside the merchant’s country (including the United States). Shopify also processes data under its own terms.

Children

The app is for merchants. It is not directed at children. We do not knowingly collect data from children.

Your rights

Merchants and, where law allows, shoppers may request access, correction, deletion, or restriction. Shoppers should usually contact the merchant first. We will cooperate with Shopify GDPR webhooks. EU/UK representatives are not appointed in this notice; add them here if your counsel requires it.

Changes

We may update this page. The effective date at the top will change. Continued use after a change means the new notice applies to later processing.

Contact

Dynamic Dreamz
Smart Upsell
support@dynamicdreamz.com
https://dynamicdreamz.com