Privacy Policy
Lusus ("Lusus", "we", "us") is a Shopify app that helps stores run discounts with rules, unique discount codes and prize games such as a spin-to-win wheel and a slot machine. This policy explains what data Lusus handles, why, how long we keep it and the choices you have.
It applies to merchants who install Lusus on their Shopify store ("merchants") and to the shoppers who play a Lusus game on those stores ("shoppers").
1. Who is responsible for the data
- Shopper data: the store where the shopper plays decides how that data is used, so the merchant is the controller (in Colombia, the responsable). Lusus processes it on the merchant's behalf and only to provide the app (as a processor, or encargado).
- Merchant account data: Lusus is the controller of the data it keeps about the stores that use the app.
You can reach us about anything in this policy at support@lusus.app.
2. What data we handle
About shoppers who play a game
- The email address they enter to play.
- The prize they won, its discount code and when they played.
- Whether, and when, they ticked the box to receive marketing emails from the store (it's never ticked for them).
- The ID of the customer record that Lusus creates or updates for them in the merchant's Shopify store, with the tag "Lusus".
On the shopper's device, the game also keeps two small items in the browser's local storage: their result (so they can see their code again) and when the game window last opened by itself (so it doesn't keep opening). Lusus doesn't use tracking or advertising cookies.
About merchants
- The store's Shopify domain and ID, and the access credentials Shopify gives the app when it's installed.
- The store's Lusus settings: games, prizes, texts, discount rules and the discount codes Lusus creates in the store.
- The store's plan and how much of its monthly allowance it used (plays and unique codes).
- Customer data requests Shopify sends us about the store, until the merchant handles them.
- Messages the merchant sends us for support.
Payments for Lusus plans are handled by Shopify. We never receive card or bank details.
Technical logs
Our hosting provider keeps standard technical logs (such as IP address, time and the address requested) to keep the service secure and fix problems. They are deleted after at most 30 days.
3. How we use it
- To run the games: allow one play per email, draw the prize, hand out a working discount code and show the result again to the same shopper.
- To save players as customers of the store, with the "Lusus" tag and the marketing consent they gave, so the merchant can contact them as the shopper agreed.
- To apply the merchant's discount rules and create unique codes.
- To apply the limits of each plan and show the merchant their usage.
- To answer privacy requests, provide support and keep the service secure.
We don't sell personal data, we don't share it for advertising and we don't use it to build profiles. Lusus doesn't make automated decisions with legal or similarly significant effects: the prize is drawn at random among the prizes the merchant set up.
4. Who we share it with
Only with the service providers we need to run Lusus, under contracts that oblige them to protect it:
- Shopify: the platform where the app runs. Customer records, discounts and codes live in the merchant's Shopify store.
- Neon: our database, hosted on Amazon Web Services in the United States (Virginia).
- Google Cloud: where the app runs, in the United States (Virginia).
If we add a provider that handles personal data, we'll update this list. We may also disclose data when the law requires it.
5. Where it's stored
Lusus data is stored in the United States. When data comes from other countries, we rely on our providers' safeguards for international transfers, such as standard contractual clauses where they apply.
6. How long we keep it
- Plays (email, prize, code, consent and customer ID) are kept while the merchant uses Lusus, until the merchant deletes them from the app's Privacy page, or until a deletion request for that shopper arrives from Shopify, whichever comes first.
- Uninstalling Lusus deletes everything about the store: Shopify tells us 48 hours after the app is uninstalled, and we delete the store's data then.
- Customer data requests are kept until the merchant handles them, and are deleted with the shopper's or the store's data.
- Backups kept by our database provider are overwritten within a few days.
Discount codes that were already won are not personal data on their own, so they can keep working after a play is deleted.
7. How we protect it
- All connections use encryption (HTTPS/TLS), and the database encrypts the data it stores (AES-256), including its backups.
- Requests from Shopify are checked with Shopify's signatures before Lusus acts on them.
- Passwords and keys are kept in secret stores, never in the app's code.
- Access to production data is limited to the people who run Lusus and need it.
8. Your choices and rights
Shoppers
Because the store you played on is in charge of your data, the fastest way to see, correct or delete it is to contact that store. Stores can download or delete your Lusus data from the app, and requests you make to the store through Shopify reach Lusus automatically. You can also write to support@lusus.app and we'll help, working with the store.
You can stop marketing emails at any time with the unsubscribe link in those emails or by asking the store.
Merchants
Write to support@lusus.app to access, correct or delete the data we keep about your store. Uninstalling the app deletes it as described above.
Depending on where you live
- Colombia (Law 1581 of 2012): you may know, update, correct and delete your data, revoke your authorization, ask for proof of it, and file a complaint with the Superintendencia de Industria y Comercio.
- European Economic Area and United Kingdom: you may access, correct, delete, restrict or object to the processing of your data, ask for a copy, and complain to your data protection authority.
- California and other US states: you may know, correct and delete your data. Lusus doesn't sell or share personal information for advertising.
We answer requests within 30 days, or sooner when the law requires it.
9. Children
Lusus is a tool for businesses and is not directed to children. Lusus games are not meant for people under 16; if you believe a child has given us data, contact us and we'll delete it.
10. Changes to this policy
We'll publish any change on this page with a new date. If a change is important, we'll also tell merchants in the app or by email before it applies.
11. Contact
Lusus · support@lusus.app