Privacy Policy

Last updated: October 12, 2026

Perkly is a points-based loyalty and rewards app for OpoShop merchants, published by Found. This policy explains what data Perkly handles, why, and how we protect it. Perkly is installed and used by merchants inside their OpoShop store admin; we act as a service provider to the merchant for the data that flows through their store's loyalty program.

Who this covers

• Merchants: store owners who install Perkly to run a points-based loyalty program.
• Customers / members: people who earn or redeem points at a merchant's store.

What we collect and store

• Store connection. When a merchant installs Perkly, we store the store's ID, subdomain, and an OpoShop access token so Perkly can act on the store's behalf: read orders and customers to award points, and create discounts to apply redemptions at checkout. We never share these tokens.
• Loyalty balances & ledger. Each member's point balance, current tier, and a points history: every entry of points earned, redeemed, taken back or adjusted by the merchant. This is kept separately for each store.
• Member identity. To key a member's points to the right person, Perkly stores the customer email (and optional name) captured from an order they placed on the store, from the merchant's action, or from Perkly's public loyalty surfaces. This is how a balance follows a customer from one order to the next.
• One-time codes and sessions. When a member asks to see or use their points, Perkly emails a one-time code to the address their points are under. Perkly keeps only a scrambled form of the code (for 10 minutes) and of the short session that follows (30 minutes), plus scrambled counters used to limit repeated attempts. An email address typed by someone who is not a member is not stored.
• Order references. The OpoShop order IDs that earned or redeemed points, used to award points, take them back on a cancelled order, and display activity.
• Merchant settings & branding. Points-earning rate, rewards, the welcome bonus, business name, colour, logo, and widget copy the merchant configures.

What we do NOT collect

• We do not collect or store payment-card numbers, bank details, or passwords. Payments are processed by OpoShop and its payment providers, not by Perkly.
• Our product analytics contain no personal information. Events are keyed to a non-identifying store ID only, never to a customer's name or email.
• We do not sell personal data, and we do not use it for advertising.

How we use data

• To provide the service: award points on orders, track balances and tiers, and apply redemptions as money off at checkout for the merchant's store.
• To display a member's balance, tier, and progress toward the next reward on the merchant's storefront, only after that member has confirmed a one-time code sent to their email.
• To email members in the store's name: a points-earned email after an order, a welcome email with their bonus, and a one-time code when a member asks to see or use their points.
• To secure the service: prevent double-redemption, over-redemption, and cross-store access, and limit how often a one-time code can be requested or tried.
• To improve the product using non-personal, aggregate usage analytics.

Sharing & processors

We share data only with the service providers needed to run Perkly, and only for that purpose:

• OpoShop: the platform Perkly runs on. It is the source of store, order, and customer data, it is where redemptions are applied at checkout, and its email service delivers the emails Perkly sends.
• Cloud hosting & database: to run the app and store loyalty records.
• Product analytics: non-personal usage data only.

We do not sell or rent personal data to anyone.

Security

Data is transmitted over HTTPS. Store access tokens and records are access-controlled and scoped so a store sees only its own members and balances. Every point earned and redeemed is recorded, and redemptions are checked against the member's balance before they are applied. The public balance-check surface is rate-limited.

Data retention

We keep loyalty records for as long as the merchant has Perkly installed, so members' point balances remain valid. Points a member has not used are something the merchant owes that customer. When a merchant uninstalls Perkly, we stop processing new activity for that store; on request we will delete a store's data, subject to any legal or financial-record obligations.

Your choices & rights

• Merchants can edit the earning rate, rewards, welcome bonus, and branding in the app, and can uninstall Perkly at any time from their OpoShop admin.
• Customers should contact the store they earned points at for requests about their balance or personal data. The merchant is the controller of that data.
• You may request access to or deletion of your data by emailing us (below); we'll coordinate with the relevant store where needed.

Children

Perkly is a tool for merchants and their customers and is not directed to children under 13.

Changes to this policy

We may update this policy as the product evolves. Material changes will be reflected here with a new "last updated" date.

Contact