Stop Overpaying

Stop Overpaying

Privacy policy

Last updated: August 21, 2026

Stop Overpaying provides optional commerce modules to Shopify merchants. This policy explains how we process information when a merchant installs or uses the Service and when a shopper interacts with an enabled module on that merchant’s store.

1. Roles and scope

A merchant generally decides why and how information about its shoppers is used in its store. In that context, the merchant is responsible for its customer notices and instructions, and Stop Overpaying processes information to provide the requested module. Stop Overpaying independently controls limited website, support, security, and service-administration information needed to operate and protect the Service.

2. Information we process

  • Merchant and installation information: Shopify shop identity, installation generation, granted scopes, merchant settings, module state, support communications, and operational audit records.
  • Catalog and inventory information: product, variant, publication, location, and availability facts needed by an enabled module. Shopify remains the source of truth for these facts.
  • Back in Stock information: a shopper’s email address, confirmation and consent history, selected product or variant, waitlist request, unsubscribe and suppression state, and delivery outcomes.
  • Attribution information: limited click and order facts, including opaque attribution identifiers, order and variant identifiers, currency, discounted line revenue, order time, and attribution time. We do not retain the full Shopify order or customer webhook payload for attribution.
  • Security and reliability information: pseudonymous keyed fingerprints, event identifiers, payload digests, rate-limit buckets, job state, and error reason codes.

3. Where information comes from

We receive information from the merchant’s Shopify store, Shopify APIs and webhooks, a shopper’s interaction with an enabled storefront module, the merchant’s settings, and the delivery or service providers used for the module. We do not purchase shopper data or build advertising audiences from merchant data.

4. How we use information

We use information to:

  • authenticate the store and operate the merchant’s enabled modules;
  • confirm shopper consent and process requested availability notices;
  • prevent duplicate, unsafe, unauthorized, or suppressed messages;
  • reconcile provider outcomes, diagnose service issues, and maintain security;
  • provide merchant demand, notification, click, and attribution reporting; and
  • respond to privacy, security, legal, and platform obligations.

Where a law requires a legal basis, processing can be necessary to provide the Service, follow merchant instructions, satisfy a legal obligation, protect the Service and its users, or support legitimate interests such as security and fraud prevention. A shopper’s confirmation and unsubscribe choices are respected within the Back in Stock module.

5. Service providers and sharing

We share information only with providers that help operate the Service, subject to appropriate access controls and contractual or platform safeguards. These include Shopify for commerce-platform access and installation identity, Postmark for enabled email delivery and delivery feedback, and Cloudflare for public website delivery and security. Hosting, database, logging, and support providers process information only as needed to operate and secure the Service. We do not sell or share personal information for cross-context behavioral advertising.

6. Email, unsubscribe, and provider feedback

Back in Stock email requires a confirmed address and is checked again immediately before delivery. Every availability notice offers an unsubscribe method. Hard bounces, spam complaints, and provider subscription changes can create or update suppression controls. We retain only normalized operational event facts and a digest of provider payloads rather than keeping complete provider payloads or recipient addresses in metadata.

7. Retention and deletion

We keep information only for as long as needed to provide the enabled module, reconcile security or delivery outcomes, meet legal obligations, or follow a documented bounded retention schedule. Stop Overpaying receives and processes Shopify’s mandatory customers/data_request, customers/redact, and shop/redact events. Relevant lifecycle workflows delete, redact, or de-identify tenant data while preserving only information we are legally required to retain.

8. Security

Shopper email destinations are encrypted at rest. Jobs and provider metadata use opaque identifiers rather than recipient addresses or message content. Tenant-owned records are isolated by shop, workers use narrowly scoped database credentials, and critical message transitions use authorization and concurrency safeguards. No system is perfectly secure, so merchants should also protect their Shopify accounts and access credentials.

9. International processing

The providers used to operate the Service may process information in countries other than the merchant’s or shopper’s country. We use appropriate safeguards required by applicable law when transferring personal information internationally.

10. Rights and requests

Shoppers should first contact the relevant merchant for questions about their customer relationship. A shopper can use the unsubscribe control in a message to stop Back in Stock alerts. Merchants and shoppers can also contact us using the details below. We will route or address requests according to our role, applicable law, and Shopify’s privacy process. Stop Overpaying responds to Shopify privacy events within the timelines required by Shopify.

11. Children

The Service is designed for merchants and is not directed to children. Merchants must not use the Service in violation of laws that protect children’s information.

12. Changes to this policy

We may update this policy as the Service, suppliers, or legal requirements evolve. We will post the updated version here and revise the “Last updated” date.

13. Contact

Questions, privacy requests, or requests for the current subprocessors list can be sent to [email protected].