by IT BRAIN

Privacy policy

Last updated October 28, 2026

iSmart Rewards is a Shopify app made by IT BRAIN (“we”). It runs a loyalty program for a Shopify store (“merchant”): points, rewards, VIP tiers, referrals and loyalty emails. This policy explains what data the app handles, why, and for how long. For the store’s customers we act on the merchant’s behalf as a data processor.

Data we handle

About merchants: store domain, name, contact email, country, currency, timezone and language, program settings, Shopify plan, and the Shopify access token the app needs to work. If the merchant connects Klaviyo or iSmartSync, we keep the Klaviyo API key (encrypted) and a hashed iSmartSync key.

About the store’s customers who take part: Shopify customer ID, name, email, phone number, language, birthday (day and month only, if the customer adds it), order numbers and the order amounts that earn points, points history, reward codes, VIP tier, referral code, the email address of friends they refer, and a log of loyalty emails sent. For branch purchases through iSmartSync: phone number, name, sale number, amount and branch name.

We don’t collect payment card details, and we don’t sell or rent personal data or use it for advertising.

Why we use it

To give, show and spend points, and to create the customer’s reward discount codes in Shopify.
To send the loyalty emails the merchant switched on. Every email has an unsubscribe link.
To prevent referral fraud (for example, a customer referring themselves).
To save the customer’s balance, tier and referral code on their Shopify customer record for the merchant.
To send loyalty events to the merchant’s Klaviyo account, only if the merchant connects it.

Service providers

Vercel (hosting), Neon (database), Resend (sending emails) and Shopify. Data goes to Klaviyo or iSmartSync only when the merchant connects them. Providers may process data outside the customer’s country, under their own data protection terms.

How long we keep it

While the app is installed, a customer’s points and history are kept so their points stay correct.
Background job records: 7 days. Email log: 90 days.
When Shopify asks us to delete a customer’s data, we delete their wallet, history, codes, referrals and email log.
When a merchant uninstalls, the iSmartSync link is cut at once, and all the store’s data is deleted when Shopify sends the shop deletion request (48 hours after uninstall).

Security

Data is sent over HTTPS, keys are stored encrypted or hashed, and storefront requests are signed by Shopify, so customers can only see their own points.

Customers’ rights

Customers can ask the store to see or delete their data; the store sends the request through Shopify and we act on it. Customers can also email us at support@itbrain.com.pk.

Contact

IT BRAIN, support@itbrain.com.pk