Privacy policy

Information we process

• Shop and account information supplied by Shopify, including the shop domain, the access token used to call the Shopify Admin API, and installation or authentication records needed to connect the app. Session records may include staff identity fields Shopify provides at sign-in, such as name, email, and locale.
• Rule configuration, including customer-tag conditions, spend thresholds, product selectors, exclusions, discount values, messages, and shipping rules.
• Plan status, including the active plan, its rule limit, and when it was last verified with Shopify.
• Sample carts a merchant enters in the draft checkout simulator, processed to calculate the preview.
• Technical and diagnostic information such as request timestamps, application errors, and security or availability events needed to operate and protect the service.

Customer and order data

RuleForge does not persist customer profiles, order records, or payment information in its own database. At checkout, Shopify provides the configured Function with the cart, eligible product information, and customer tags needed to evaluate a rule. That evaluation occurs inside Shopify’s Function runtime.

RuleForge requests only the Shopify permissions required to read products and discounts and to create or update app-managed discounts.

How we use information

• Authenticate the merchant and provide the app inside Shopify Admin.
• Create, update, validate, and troubleshoot the merchant’s automatic discount configuration.
• Maintain security, prevent abuse, diagnose errors, and improve service reliability.
• Respond to support, privacy, and legal requests.

Where configuration is stored

Rule configuration is stored on the Shopify automatic discount as app-owned metafields. Authentication sessions and plan status are stored in a managed database so the app can securely communicate with Shopify. Shopify controls data processed within its platform and Function runtime under Shopify’s own terms and privacy practices.

Billing

Paid plans are billed by Shopify through Shopify App Pricing and appear on the merchant’s Shopify invoice. We never receive or store card numbers or other payment credentials.

Product analytics

RuleForge uses PostHog for limited product analytics. The app records which admin screen is open; app install and uninstall; rule create, enable, disable, and sync; and verified plan changes. A shop is represented by a salted one-way hash, not by its domain, and development stores are marked with a single yes-or-no value.

RuleForge does not send staff, customer, order, URL, form, discount-rule contents, or billing amounts to PostHog. Automatic click and page tracking, person profiles, persistent browser identifiers, session replay, surveys, and IP geolocation are turned off.

Error monitoring

We use Sentry to receive reports when the app encounters an error. Reports are limited to the error type, where it happened in our code, the app release, and short operational codes. They exclude user identity, cookies, request and response headers and bodies, URL query parameters, database data, and session replay.

Service providers and disclosure

We share information only with the providers needed to run RuleForge: Shopify (platform, authentication, checkout, and billing), Railway (application hosting and managed database), Sentry (error monitoring), and PostHog (product analytics), each limited as described above. They may process information only to provide those services to us. We may also disclose information when required by law, to protect rights and safety, or as part of a business transaction subject to appropriate safeguards.

We do not sell merchant or customer personal information.

Retention and deletion

We keep merchant authentication and operational records only for as long as reasonably necessary to provide RuleForge, meet legal obligations, resolve disputes, and protect the service. After uninstallation, Shopify notifies RuleForge and the app removes the active session for that shop. When Shopify requests shop redaction, the app deletes the shop’s remaining session and billing records. App-owned configuration stored on Shopify resources remains subject to Shopify’s platform behavior and merchant controls.

Verified deletion and access requests can be sent to hello@jamaklab.com. We also process Shopify’s mandatory shop and customer privacy webhooks.

Security and international processing

We use administrative, technical, and organizational safeguards designed to protect information. No system is completely secure, and we cannot guarantee absolute security.

Jamak and its service providers may process information in countries other than the merchant’s country. Where required, we use appropriate safeguards for those transfers.

Your choices and rights

Depending on applicable law, you may have rights to request access, correction, deletion, restriction, or a copy of personal information. We may need to verify your identity and authority for the relevant shop before responding.

Changes and contact

We may update this policy as RuleForge or applicable requirements change. The effective date on this page identifies the latest version. Questions and requests may be sent to hello@jamaklab.com.

Contact support

hello@jamaklab.com