Privacy policy

Freebies Engine by Log Studio Lab and Experiment Engine by Log Studio Lab are Shopify apps made by Log Studio Lab (operated by its founders as individuals, not a registered company, from Buenos Aires, Argentina). This policy explains how we handle personal data when you visit our website, use the merchant app, install either product on a Shopify store, or shop on a store that runs one of them.

We act in two roles. For information about merchants and their team (who you are, how to reach you, what you pay) we decide why and how it is used, so we are the controller. For information about the shoppers of a merchant's store we act only on the merchant's instructions, so the merchant is the controller (or the business, under US state laws) and we are its processor (or service provider). Our data processing agreement sets that out.

• Account details. Name, email address and sign-in method (email code or Google), handled through our sign-in provider, plus the stores you connect and your role in them.
• Store connection. The store's myshopify.com domain, the access token Shopify gives us (stored encrypted), the access scopes granted, store name, currency, time zone and plan information Shopify provides.
• Store content we need to run the products. Products, variants, collections, inventory levels, markets and locales, which we read to let you pick items and show offers in the right language and currency. The offers, rules, codes, widgets and settings you create, and the discounts, cart transformations and validations we create in your store.
• Billing. Subscriptions are charged by Shopify as part of your Shopify bill. We receive the plan, the status, the trial dates and the charge amount. We never see or store card numbers.
• Activity and support. An audit log of changes made in the app (who, what, when), messages you send us, and a record of the times our staff open your store to help you.

We keep this to what each product needs and we do not store shopper names, email addresses or postal addresses. To decide whether a signed-in shopper qualifies for an offer rule, Freebies Engine by Log Studio Lab reads from the merchant's store, at the time of the cart check, the customer's tags, number of orders, total spent, latest order total and the country of their default address. This is not saved to our database; it is held in a short-lived cache for up to 45 seconds and then expires. If the merchant connects an email marketing integration, the order email or phone is queued only until it is delivered; a customer erasure request deletes any undelivered item.

• Freebies Engine by Log Studio Lab. Offer events such as an offer being shown, a gift being added or a cart qualifying, each with a random session id, a cart token, the page path, and the Shopify customer id only when Shopify supplies one for a logged-in shopper. Order facts for orders that used an offer (order id and name, time, amounts, currency, refund and cancellation status, the landing page path). A list of which offers a customer has already used, when an offer is limited to one use per customer, kept also in a private metafield on the customer in the merchant's store.
• Experiment Engine by Log Studio Lab. A random visitor id, which test and variant the visitor was shown, page and cart events, and order facts (order id, visitor id, amounts, line items and costs). No customer id and no personal details. The visitor id is created only after the shopper allows analytics in Shopify's privacy settings. While a visitor is in a test, the storefront script also writes the visitor id and the versions as a cart attribute, which Shopify keeps on the order; only orders that carry it are recorded.
• On the storefront. Browser storage described in our cookie policy to keep an offer working through checkout and to remember a declined gift.

Merchants decide which of their shoppers this applies to and are responsible for telling shoppers about it in their own privacy notice and for any consent their local law requires.

• Page views and performance measurements through Vercel Web Analytics and Speed Insights, which do not use cookies and receive page paths with query strings removed.
• A first-touch attribution cookie (mlf_ft, 30 days) recording campaign parameters or the referring site of your first visit, to learn which channels lead to installs. For visitors from the European Economic Area, the United Kingdom and Switzerland it is set only after consent.
• The details you type into the contact form (name, email, company, message) and, for rate limiting, a hashed form of your network address.
• Standard hosting logs (network address, time, address requested, browser) kept by our hosting provider.
• Error reports from the website and app, with request bodies and customer identifiers removed.

• To provide, secure and support the products, including publishing offers to your store, measuring how they perform and running tests.
• To bill through Shopify, enforce plan limits and the once-per-store trial.
• To answer requests, send service messages (team invitations, security and billing notices), and fix errors.
• To understand which of our own channels lead to installs, and to measure and improve our website.
• To meet legal obligations and protect against fraud and abuse.

We do not sell personal data. We do not share it for cross-context behavioral advertising. We do not use shopper data to advertise, to profile shoppers across merchants, or to train generative AI models. We never combine one merchant's data with another's.

Where the law of the European Economic Area, the United Kingdom or Switzerland applies to us as controller, our bases are performing our contract with you, our legitimate interests in running and securing the services, complying with law, and consent for the non-essential cookie described above.

Shopify classifies some of the data the products can reach (customer and order information) as protected customer data. We request only the access the products need, we use the data only for the purposes above, we encrypt store access tokens, every query is restricted to a single store, access by our staff is limited and logged, and data is kept only for the periods below.

We honor Shopify's mandatory privacy webhooks:

• Customer data request. We prepare an export of the data we hold for that customer and make it available to the merchant for 30 days.
• Customer redact. We delete that customer's rows, remove the used-offers metafield we wrote to that customer and, for the orders Shopify names, delete the order facts or detach them from events. Testing visitor rows have no customer link and stay so that test results keep their sample.
• Shop redact. About 48 hours after a store uninstalls a product, Shopify asks us to erase the store. We delete the store record and all of its data for that product, as long as the store has not reinstalled in the meantime. If the store still has our other product installed, that product's data stays until it is uninstalled too.

• Store configuration, offers and settings: while the product is installed and until the store is erased after uninstall.
• Raw offer events: 90 days by default (the store can be set to a longer window, up to 365 days).
• Order facts and daily summaries for Freebies Engine by Log Studio Lab: 400 days.
• Experiment Engine by Log Studio Lab raw visitor rows and order facts: 90 days after the test ends. Daily summaries have no personal data and stay.
• Experiment Engine by Log Studio Lab cancelled-order markers (order id only): 30 days. Webhook delivery records: 7 days (30 if failed). Rate-limit counters: 24 hours.
• Customer data-request exports: 30 days.
• Merchant audit log: 400 days. Staff support log: kept as the record of what staff did, with its input and network hash erased when the store is erased.
• Account profile: while the account exists. When it is deleted, the profile is removed and any email and name we hold are anonymized.
• Database backups: they expire on the schedule of our database provider and of our encrypted nightly backup (14 days); erased data leaves backups on that schedule.
• Contact form messages and support email: as long as needed to answer and for our records, then deleted.

Each store gets one free trial per product. To enforce this we keep one record per store domain and product: the domain, the plan the trial started on, the start date and the number of trial days. It contains no personal data about people. We keep it after the store is erased, on purpose, on the basis of our legitimate interest in preventing repeated free trials.

Only with the companies that help us run the services, listed with their purpose and location on our subprocessors page, with Shopify as the platform you use, with a successor in a merger or sale (we will tell you), and when the law requires. We require our subprocessors to protect data to a standard equal to this policy.

Our hosting and database are in the United States. If you are in the European Economic Area, the United Kingdom or Switzerland, we transfer data to the United States under the Standard Contractual Clauses (see the data processing agreement) or another valid mechanism.

We encrypt store access tokens, restrict every query to one store, verify the signature on every call from Shopify, encrypt backups, and log staff access. See our security page. No system is perfectly secure, and we will notify affected merchants of a breach as our agreement describes.

Depending on where you live (for example the European Economic Area, the United Kingdom, California and other US states) you may have the right to access, correct, delete or export your personal data, to object to or restrict some uses, to opt out of sale or targeted advertising (we do neither), and not to be treated worse for using these rights.

• Merchants and team members: write to us at support@marginlabs.app or use the account settings in the app. We answer within 30 days. You can also remove your store data yourself with Reset app data before you uninstall.
• Shoppers: the merchant of the store you shopped in is responsible for your data. Ask the merchant. If you write to us we will pass your request to the merchant and help them answer it. The merchant can make it through Shopify, which sends us the request.
• You may complain to your data protection authority or, in the US, your state attorney general.

The services are for businesses. We do not knowingly collect personal data from anyone under 18.

We will post changes here and change the effective date. For a material change we will email the owner of each connected store.

operated by its founders as individuals, not a registered company, from Buenos Aires, Argentina. Email: support@marginlabs.app.