Boomrrang Privacy Policy

Effective date: 2 September 2026 Last updated: 2 September 2026 Applies to: the Boomrrang subscriptions application for Shopify and the websites at boomrrang.com, auth.boomrrang.com, hooks.boomrrang.com and {shop}.boomrrang.com.

1. Who we are, and the role we play

Boomrrang is a subscriptions application for Shopify, operated by Leds Get It LLC, a United States limited liability company formed under the laws of Wyoming, with registration details available on request from legal@boomrrang.com ("Boomrrang", "we", "us").

Understanding who decides what happens to personal data is the most important thing in this policy, because it determines whom you should contact and whose rules apply.

When a Shopify merchant installs Boomrrang, the merchant is the data controller and Boomrrang is the data processor. The merchant decides which subscribers exist, what they are billed, and what happens to their data. We process that data only on the merchant's documented instructions — which, in practice, means the actions the merchant's staff take inside the app, the configuration they choose, and the terms of our agreement with them. We do not decide the purposes of that processing, we do not use subscriber data for our own purposes, and we do not sell it.

There is one narrow exception. For the merchant's own staff accounts, and for our marketing site, we act as a controller — we decide, for example, how long to keep an app session, how to authenticate a staff member, and how to secure our own service. Those decisions are ours, and this policy is our disclosure of them.

If you are a shopper with a subscription: your relationship is with the store you bought from, not with us. The fastest way to exercise your rights is to contact that store directly — it can act immediately, and Shopify's own privacy tooling will reach us automatically. You can also write to us at privacy@boomrrang.com and we will route your request to the merchant and support them in answering it, but we cannot act on subscriber data without the merchant's instruction except where the law requires us to.

2. What this policy covers

This policy covers personal data processed by the Boomrrang application and its supporting infrastructure. It does not cover:

• Shopify itself. Shopify is an independent controller of the data in a merchant's store. See Shopify's own privacy policy.
• The merchant's storefront, checkout, or customer accounts. Those are the merchant's and Shopify's, not ours.
• Payment processing. We never touch it (see §4).

3. What we collect, and why

We hold three distinct populations of data. They are listed separately because they have different sources, different legal bases and different retention.

3.1 Merchant shop data (we are a processor)

Collected when a merchant installs the app, and kept current from Shopify webhooks and API reads.

3.2 Merchant staff data (we are the controller)

Collected when a member of the merchant's Shopify staff opens the app. We never collect or store a password — see §10.2.

3.3 Subscriber data (we are a processor for the merchant)

This is the data of the merchant's customers who hold a subscription. We hold deliberately little of it. See §4 for what we refuse to hold and why.

Read on demand, not stored. To display a subscriber's name and shipping address, the app fetches them from Shopify at the moment they are needed and discards them when the page is rendered. They are never written to our database. Every such read writes an entry to our PII access log (§10.6) recording who read what, when, and why.

3.4 Operational and security data (we are the controller)

• Event ledger. Every state-changing operation appends an immutable record: which shop, who acted, what kind of thing changed, which record, and a request id. This ledger is required by design to be free of personal data — it stores identifiers, never names, emails or addresses.
• PII access log. Every read of subscriber personal data: shop, acting user, what was read, which fields, and the stated reason.
• Webhook receipts. For each webhook Shopify sends us: its id, topic, shop domain, API version, a hash of the payload, and processing state. The hash lets us prove we handled a specific message and detect duplicates without retaining its contents.
• Application logs and error reports. Structured logs and crash reports, passed through a redaction layer before they leave the process (§10.5).

3.5 Website visitors

boomrrang.com is a static marketing site served separately from this application. Any analytics or cookie use there is disclosed on that site. The application hosts (auth., hooks. and the per-shop tenant hosts) set no advertising or analytics cookies at all — the only cookie the application sets is the strictly necessary session cookie described in §3.2.

4. What we deliberately do not collect

Data minimisation is a design constraint here, not an aspiration. Specifically:

• We never receive, process or store payment card numbers, CVVs, bank account numbers, or any other payment credential. Payment instruments are vaulted by Shopify and its payment providers. Where a charge must be made, we reference Shopify's own stored payment method by its Shopify identifier through the Admin API; the card itself never enters our system, our logs, or our backups. We are consequently not a card-data environment.
• We do not store subscriber names, shipping addresses, billing addresses or phone numbers. We fetch them from Shopify on demand and discard them (§3.3).
• We do not store full customer profiles, order histories, or browsing behaviour.
• We do not store Shopify staff passwords or any password — the app has no password field, no password reset flow, and no credential store, because authentication is entirely mediated by Shopify (§10.2).
• We do not store raw IP addresses against staff sessions — only a hash.
• We do not build advertising profiles, run behavioural advertising, or sell or share personal information as those terms are defined under CCPA/CPRA (§12).

5. Legal bases for processing

Where we act as processor, the merchant is responsible for establishing the legal basis for the processing it instructs. Our agreement with the merchant requires it to have one.

Where we act as controller (merchant staff data, security and operational data), our bases under Article 6 GDPR are:

Where we process data revealing anything more sensitive than the above, we do not — the system is not designed to hold special-category data, and merchants are contractually asked not to place it in free-text fields.

We have documented a legitimate interests assessment for each 6(1)(f) basis above; it is available to merchants on request.

6. How we use personal data

We use the data in §3 to:

1. Install the app, connect it to a merchant's Shopify shop, and keep that connection working.
2. Authenticate the merchant's staff and decide what each of them is allowed to do.
3. Display, create, edit, pause, resume and cancel subscription contracts at the merchant's direction, through Shopify's APIs.
4. Schedule and execute recurring billing at the merchant's direction, exactly once per cycle.
5. Send transactional subscription email on the merchant's behalf — upcoming charge notices, payment failure and dunning notices, and confirmations.
6. Respond to privacy requests received through Shopify's privacy webhooks (§11.3).
7. Keep the service secure, available and correct: monitoring, error diagnosis, abuse prevention, and reconstructing the sequence of events after an incident.
8. Meet our legal and regulatory obligations.

We do not use subscriber data to train machine-learning models, to build products for other merchants, for advertising, or for any purpose the merchant has not instructed. Where we produce aggregate statistics about the service (for example, total contracts processed), those statistics contain no personal data and cannot be re-identified.

7. Who we share personal data with

We share personal data with three categories of recipient, and no others.

7.1 Shopify

Shopify is not our sub-processor — it is the source and the destination of most of this data, and an independent controller in its own right. We read from and write to the merchant's Shopify shop using the scopes the merchant granted at install:

read_products, write_products, read_customers, read_orders, read_own_subscription_contracts, write_own_subscription_contracts, write_customer_payment_methods.

read_customers and read_orders are what allow the app to show a subscriber's name and shipping address on demand without storing them (§3.3); read_customers is also what the app's background process uses to read a subscriber's email address once when a contract is first recorded (§3.3), and what the mailer uses to address a notice at the time of sending. write_customer_payment_methods allows a subscriber to update the payment method on a subscription; it moves a token reference, never a card number.

7.2 Sub-processors

Each of the following processes personal data on our behalf, under a written contract containing the obligations required by Article 28 GDPR, with confidentiality obligations and appropriate technical and organisational measures.

The job queue is a vendor service, and is listed above. The background job queue runs on Upstash's managed Redis, provisioned through Fly.io, so Upstash is a sub-processor in its own right. The queue holds only transient job state — including raw webhook payloads in transit to the worker, removed on completion — and no durable personal data; the billing schedule of record lives in the database, never in the queue.

Changes to this list. We will publish an updated list here before adding or replacing a sub-processor, and give merchants at least 30 days notice so they can object. This commitment must be mirrored in the Data Processing Addendum.

7.3 Others

• Professional advisers (lawyers, accountants, auditors) under confidentiality.
• Law enforcement, regulators or courts, where we are legally compelled. Where we are legally permitted to, we will notify the affected merchant before disclosing, so it can seek relief.
• A successor entity, in the event of a merger, acquisition or asset sale — subject to this policy continuing to apply, and to merchants being notified in advance.

We do not sell personal data, and we do not share it for cross-context behavioural advertising. We have never done so.

8. International transfers

All application hosting, processing and storage occur in the United States: application compute on Fly.io in iad (Ashburn, Virginia), the primary database and encrypted backups on Supabase in AWS us-east-1 (N. Virginia), the job queue on Upstash in iad, transactional email via Postmark, and error monitoring in Sentry's US data region. Personal data originating in the EEA, the United Kingdom or Switzerland is therefore transferred to the United States for all of the processing described in this policy, with Leds Get It LLC itself acting as the data importer.

The United States has no general adequacy decision, and we have not certified under the EU–US Data Privacy Framework, so these transfers rely on:

• the European Commission's Standard Contractual Clauses (2021/914), Module Two (controller → processor) between the merchant-controller as data exporter and us as data importer, and Module Three (processor → processor) where the merchant itself acts as a processor for another controller. Our own sub-processors are US vendors, so passing data to them is not a further restricted transfer — their obligations flow down contractually through each vendor's data processing agreement;
• the UK International Data Transfer Addendum to those SCCs for UK transfers;
• the Swiss addendum recognised by the Swiss FDPIC for Swiss transfers;

together with a transfer impact assessment covering the destination country's laws, and the supplementary technical measures described in §10 — in particular encryption of tokens at rest, TLS in transit, and the deliberate absence of card data and customer profiles from our systems, which materially limits what any compelled disclosure could reach.

A copy of the SCCs as executed is available to merchants on request.

9. How long we keep data

Retention periods are defined authoritatively in our internal retention policy at our internal retention policy, which the deletion jobs implement. The periods are:

Three consequences worth stating plainly:

• Uninstall deletion is fast, not leisurely. Because Shopify sends shop/redact about 48 hours after an uninstall, a merchant's data is normally gone two days later, not thirty. The 30-day figure is an outer bound for the case where no webhook arrives. Merchants should export what they need before uninstalling (Terms of Service §12.5).

• Backups lag deletion. When we erase data from the live database, copies persist in encrypted backups until those backups age out at 35 days. We do not restore deleted data from a backup to circumvent an erasure request; if a backup is ever restored, the erasure is re-applied.

• The event ledger survives erasure by design — but only because it contains identifiers and no personal data. It is what lets us prove a deletion actually happened.

Where a legal hold, an unresolved dispute, or a statutory obligation requires it, we may retain specific records beyond these periods, and only for as long as that reason lasts.

10. How we protect personal data

A fuller technical description is published at boomrrang.com/security. In summary:

10.1 Tenancy isolation

Each merchant is served on its own origin ({shop}.boomrrang.com), separate from the authentication host and the webhook host. Every route asserts which host role it is allowed to be reached on and returns 404 otherwise. Sessions are bound to a single shop; a session issued for one tenant cannot be replayed against another.

10.2 Authentication — no passwords

Boomrrang has no password of its own. Identity comes entirely from Shopify OAuth: a staff member proves who they are to Shopify, and we receive the result. We therefore have no password database to breach, no credential-stuffing surface, and no password reset flow to abuse. Shopify's own multi-factor authentication protects the account.

Session cookies use the __Host- prefix and are Secure, HttpOnly, SameSite=Lax, and carry no Domain attribute — which is what keeps a cookie from leaking sideways between tenant subdomains. Only a hash of the session token is stored; the token itself exists only in the browser.

10.3 Authorization — least privilege

Shopify authenticates; we authorize. Permission is expressed as fine-grained grants bundled into roles, and every state-changing action checks its specific grant. Actions that move money (charging now, changing dunning policy, refunding), actions that export data, and actions that reveal subscriber personal data each require their own separate grant — none of them is implied by ordinary read access. The default read-only role cannot see subscriber personal data at all.

10.4 Encryption

Shopify access tokens are encrypted at rest with AES-256-GCM — an authenticated cipher, so tampering with the ciphertext is detected rather than silently decrypted. All data in transit uses TLS 1.2 or higher. Database storage and backups are encrypted at rest by the managed provider.

10.5 Logging with personal data scrubbed

All application logging passes through a redaction layer before anything is emitted; tokens, request bodies and customer fields are never logged. Error reports sent to Sentry are scrubbed of personal data before transmission.

10.6 Audit logging

Two immutable records back everything above: an append-only event ledger written in the same database transaction as the change it describes — so a change cannot exist without its audit record — and a PII access log that records every read of subscriber personal data, including which fields were read and why. These are the records we use to answer "who saw this customer's data?"

10.7 Our own staff access

Access to production data is restricted to named personnel who need it, is granted for a specific reason, and is logged. See boomrrang.com/security.

No system is perfectly secure, and we do not claim otherwise. We commit to the measures above and to notifying merchants of a breach as described in §13.

11. Your rights

11.1 If you are a subscriber (a shopper)

Under GDPR, UK GDPR and comparable laws, you have the right to:

• access the personal data held about you, and receive a copy;
• rectify data that is inaccurate or incomplete;
• erase your data ("right to be forgotten");
• portability — receive your data in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible;
• restrict processing while a dispute about accuracy or legitimacy is resolved;
• object to processing based on legitimate interests, and to direct marketing at any time;
• withdraw consent where consent was the basis, without affecting prior processing;
• not be subject to a decision based solely on automated processing with legal or similarly significant effects — we do not make such decisions (§14);
• complain to a supervisory authority — in the EEA, the authority of the member state where you live or work, or where the issue arose (we have no EU establishment, so no single lead authority applies — the authority of each affected member state is competent); in the UK, the Information Commissioner's Office.

How to exercise them: contact the store you subscribed with. The merchant is the controller and is the one who can act. If you contact us at privacy@boomrrang.com instead, we will acknowledge you, tell you which merchant holds the relationship where we can identify it, and forward the request — we cannot act on a merchant's data without its instruction.

11.2 If you are merchant staff

The same rights apply to your own staff account data, for which we are the controller. Write to privacy@boomrrang.com. Note that some records — the event ledger, the PII access log — exist to prove what happened in a shop and are retained for the periods in §9 for security and legal reasons even after your access is removed; they contain identifiers, not personal profiles.

11.3 How Shopify's privacy webhooks actually implement this

Shopify sends every app three mandatory privacy webhooks. This is the mechanism by which a subscriber's rights reach us in practice, and here is exactly what each one does in our system:

Every one of these requests is recorded with its status and completion time, and every action taken is written to the event ledger in the same transaction that performs it. We commit to completing any request under this section within 30 days.

11.4 Verification

We verify requests before acting on them. For requests arriving through Shopify's webhooks, verification is cryptographic — we check the HMAC signature on every webhook and reject anything unsigned or altered. For requests arriving by email we may need to confirm identity through the merchant, precisely so that we do not disclose one person's data to another.

We do not charge for exercising these rights, unless a request is manifestly unfounded or excessive, in which case the law permits a reasonable fee or a refusal — and we will explain why.

12. California privacy notice (CCPA/CPRA)

This section applies to California residents. Under the CCPA as amended by the CPRA, we are a service provider to merchants for subscriber data, and a business in respect of merchant staff data.

12.1 Categories of personal information collected

In the preceding 12 months we have collected the following categories, all from the merchant's Shopify shop or from the staff member themselves:

Purposes, sources, and retention for each category are as set out in §3, §6 and §9.

12.2 No sale, no sharing

We do not sell personal information, and we have not sold personal information in the preceding 12 months. We do not share personal information for cross-context behavioural advertising. We do not knowingly sell or share the personal information of consumers under 16 — we do not knowingly collect it at all (§13).

As a service provider, we are contractually prohibited from retaining, using or disclosing subscriber personal information for any purpose other than performing the services for the merchant, and from combining it with information from other sources except as CCPA permits.

12.3 Your California rights

You have the right to know what personal information is collected, used, disclosed and to whom; to delete personal information; to correct inaccurate personal information; to opt out of sale or sharing (there is nothing to opt out of — see §12.2); to limit the use of sensitive personal information (we collect none); and to non-discrimination for exercising any of these rights. We do not offer financial incentives.

To exercise these rights as a shopper, contact the store you subscribed with — as service provider, we act on the business's instruction. You may also write to privacy@boomrrang.com and we will route the request. An authorised agent may submit a request on your behalf with written proof of authorisation. We will respond within 45 days, extendable by a further 45 days with notice, as CCPA permits.

13. Children's data

Boomrrang is a business tool sold to merchants. It is not directed at children, and we do not knowingly collect personal data from anyone under 16 (or under 13 in the United States). We have no way to identify the age of a subscriber, because we do not collect date of birth or any age signal. If a merchant informs us that data belonging to a child has been placed in our system, we will delete it promptly on the merchant's instruction. If you believe a child's data has reached us, contact privacy@boomrrang.com.

14. Automated decision-making

We do not make decisions about individuals based solely on automated processing that produce legal or similarly significant effects. Recurring billing runs on the schedule the merchant configured and the subscriber agreed to; a failed payment triggers the retry sequence the merchant configured. Neither involves profiling or an evaluation of the person.

15. Security incidents and breach notification

If we become aware of a personal data breach affecting a merchant's data, we will notify that merchant without undue delay and in any event within 48 hours of becoming aware, with the information the merchant needs to meet its own Article 33 obligation to a supervisory authority within 72 hours. Because the merchant is the controller, it is the merchant who notifies regulators and affected individuals; we support that with facts, scope and remediation status. Our full incident response process is summarised in boomrrang.com/security.

16. Changes to this policy

We will update this policy when the service or the law changes. The "Last updated" date at the top always reflects the current version. For changes that materially affect how we handle personal data — a new category of data, a new purpose, a new sub-processor — we will notify merchants in advance, by email to the shop contact and in the app, giving at least 30 days before the change takes effect. Prior versions are retained and available on request.

17. Contact

You always have the right to complain to a supervisory authority. In the EEA that is the authority of the member state where you live or work, or where the issue arose; in the UK it is the Information Commissioner's Office (ico.org.uk). We would appreciate the chance to resolve it with you first.