Privacy Policy

1. Who we are

NexRetain (“NexRetain”, “we”, “us”) provides the NexRetain Shopify app (the “App”), which calculates a store’s net profit and generates AI insights, and the website at nexretain.com (the “Website”).

Our role. For personal data in a merchant’s store (for example, the store’s customers), the merchant is the controller and we act as a processor on the merchant’s behalf. For the details merchants and Website visitors give us directly (for example, when installing the App or filling in a form), we are the controller.

2. Data we read from your Shopify store

When a merchant installs the App, Shopify asks the merchant to approve the access we request. We request read access only, and we read:

• Store information: store name, domain, currency, time zone, plan and the email address of the store owner or staff member who installed the App.
• Orders: order totals, line items, discounts, taxes, shipping, refunds, returns, payment gateway, payment status, dates and the country or zone the order shipped to.
• Products: products, variants, prices, weights and the cost-per-item field.
• Customers: customer records linked to orders, which can include a customer’s name, email address, location and order history. We use these to calculate lifetime value, repurchase rate and cohort retention.

Data syncs through Shopify’s official APIs and webhooks. The App adds nothing to your storefront theme and does not track your store’s visitors.

3. Data from ad platforms

If a merchant connects an ad account, we receive access through that platform’s official authorization flow and read ad-account and campaign identifiers, names, spend, and performance metrics such as impressions, clicks and conversions. Supported platforms are:

• Meta Ads (Facebook and Instagram)
• Google Ads
• TikTok Ads

We use this data only to include ad spend in your profit, POAS, ROAS and LTV:CAC figures. We never create, edit or pause ads. You can disconnect an ad account at any time in the App, or revoke our access from the ad platform’s own settings.

4. Data you give us

• Cost settings: product costs, shipping rules, transaction fee settings, custom expenses and calculation preferences you enter in the App.
• Email report recipients: the email addresses you add to scheduled email reports. Please add only people who have agreed to receive them.
• Website forms: when you join early access or contact us, your name, email address, Shopify store URL, monthly order range and anything you write in your message.
• Support: the content of emails you send to support@nexretain.com.

5. How we use data

• To calculate net profit, costs and margins by day, order, product and customer.
• To build reports, charts, custom metrics and CSV exports you ask for.
• To generate NexRetain Intelligence insights and recommendations (see below).
• To send the scheduled email reports you set up, to the recipients you choose.
• To provide support, send service messages, and tell early-access sign-ups when we launch.
• To keep the App secure, prevent abuse and fix problems.
• To meet legal obligations, including Shopify’s privacy and data-protection requirements.

We do not sell personal data, share it for cross-context behavioural advertising, or use merchant store data to market to a merchant’s customers.

Legal bases (EU/UK). We process data to perform our contract with merchants, for our legitimate interests in running and securing the service, with consent where we ask for it (for example, launch emails), and to comply with legal obligations.

6. AI processing (NexRetain Intelligence)

NexRetain Intelligence uses Google Gemini, provided by Google through its API, to write insights, root-cause explanations and recommendations. To do this we send Google store-level metrics such as revenue, costs, profit, ad spend, trends, product performance and cohort figures. We do not send customers’ names, email addresses or postal addresses.

Google processes this data to return a response, under Google’s API terms. AI-generated insights can be incomplete or wrong. They are not financial, tax or accounting advice, so check anything important before you act on it.

7. Who we share data with

We share data only with service providers that help us run NexRetain, and only as needed:

• Shopify: the platform the App runs on, which also handles billing.
• Google (Gemini API): AI processing of store metrics, as described above.
• Cloud hosting and database providers: to run the App and store its data.
• Email delivery providers: to send email reports, service emails and replies to your messages.
• Website hosting and analytics: to serve the Website and, where enabled, measure visits in aggregate without cookies.

We may also disclose data if the law requires it, to protect our rights or users’ safety, or as part of a merger or acquisition, in which case this policy continues to apply. See GDPR and your data for our list of subprocessors.

8. How we protect data

• Shopify and ad-platform access tokens are encrypted when stored.
• Data is sent over encrypted connections (HTTPS/TLS).
• We request read-only store access, the minimum the App needs.
• Access to production data is limited to people who need it to run and support the service.

No system is perfectly secure. If a breach affects your personal data, we will notify you and the relevant authorities as the law requires.

9. How long we keep data, and deletion on uninstall

We keep store data while the App is installed, so you get unlimited historical reporting. When a merchant uninstalls the App, we stop syncing immediately. Shopify then sends us a shop/redact request 48 hours after uninstall, and we delete that store’s data, including its access tokens, cost settings and synced orders, products and customers.

We also respond to Shopify’s mandatory privacy webhooks: customers/data_request (a store’s customer asks for their data) and customers/redact (a store’s customer asks for their data to be deleted). We complete these requests within 30 days, as Shopify requires.

We keep early-access and contact-form details until you ask us to delete them, or until they are no longer needed for the reason you gave them. We may keep limited records longer where the law requires, for example for tax or billing.

10. Your rights

Depending on where you live (including under the EU and UK GDPR and California law), you may have the right to access, correct, delete or export your personal data, to object to or restrict some processing, and to withdraw consent. You also have the right to complain to your local data protection authority.

Merchants and Website visitors: email support@nexretain.com and we will reply within 30 days.

Customers of a store that uses NexRetain: please contact the store directly. The store is the controller of your data and can make the request through Shopify, which forwards it to us. If you contact us, we will pass your request on to the store.

11. International transfers

We and our service providers may process data in countries other than yours, including the United States. Where the law requires it, we rely on safeguards such as the European Commission’s Standard Contractual Clauses for these transfers.

12. Cookies and analytics

The Website does not use advertising or tracking cookies. Where we measure Website traffic, we use a privacy-friendly analytics service that works without cookies and does not identify individual visitors. Inside Shopify admin, the App uses the session mechanism Shopify provides to keep you signed in.

13. Children

NexRetain is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 16.

14. Changes to this policy

We will update this page when our practices change and revise the “Last updated” date. If a change is significant, we will tell merchants by email or in the App before it takes effect.

15. Contact

Questions about this policy or your data: support@nexretain.com.