Fasel — Privacy Policy

Last updated: July 22, 2026 · Contact: rafikadel66@gmail.com

Fasel ("the app") lets shoppers negotiate a price with a merchant-configured virtual agent on Shopify storefronts. This policy explains what data the app processes, why, and how it is protected. Fasel is designed to work with as little personal data as possible.

Data we collect from merchants

• Store identity: your myshopify.com domain and store currency, to run the app for your store.
• App settings: your popup theme, colors, dialect, sentences, triggers, pricing floors and plan state.
• Access tokens: the OAuth token Shopify issues the app, used only for the permissions you approved. Tokens and all other stored data are encrypted in transit via TLS and encrypted at rest at the infrastructure level (managed database volume encryption on our hosting provider).

Data we process about shoppers

• Haggle sessions: the negotiated product or cart subtotal, offers made, the outcome, and the discount code issued. Sessions are keyed by a random token — no shopper name, email, address, phone or payment data is collected or stored.
• Order confirmation: when an order is placed or paid, Shopify notifies the app (orders/create / orders/paid webhooks). From those notifications the app persists exactly: the order id, the link to the Fasel discount code used, the redemption status, and timestamps — nothing else. Purpose: counting successful bargains, enforcing the plan's billing quota, and cart-recovery analytics. The order's customer details (name, email, phone, address) are never stored, and raw webhook payloads are not retained.
• Browser storage: the popup uses localStorage/sessionStorage on the shopper's device to remember "already shown" and "don't show again" choices, and cached display settings. No tracking across sites, no advertising identifiers, no fingerprinting.

What we never do

• No sale or sharing of data with third parties for marketing.
• No advertising networks, no cross-site tracking.
• No storage of shopper personal information or payment details.

Where data lives

The app is hosted on Railway (cloud infrastructure) with data stored in a PostgreSQL database. Data is encrypted in transit via TLS and encrypted at rest at the infrastructure level (managed database volume encryption on our hosting provider). Discount codes are created as native Shopify discounts; checkout runs entirely on Shopify.

Data retention & deletion

• Retention period: haggle-session and order-reference records are kept for a maximum of 12 months, then deleted automatically by a daily sweep.
• Uninstalling the app deletes its access tokens immediately.
• Shopify's GDPR webhooks are honored: customers/data_request, customers/redact and shop/redact. On shop/redact (48 hours after uninstall) the store's configuration and session records are removed.
• Merchants can request earlier deletion at any time via the contact email above.

GDPR / CCPA

For shoppers, Fasel acts as a processor on behalf of the merchant. Because no shopper personal data is stored, data-subject requests can usually be satisfied immediately; where a haggle session must be linked to an order for deletion, we honor Shopify's redaction webhooks as described above.

Changes

We may update this policy as the app evolves; the "Last updated" date above reflects the current version. Material changes will be announced in the app.