Make an Offer: privacy policy
Effective: October 2026
This policy explains what the Shopify app Make an Offer (listed as "Kavio Make an Offer: Best Offer", "the app") does with data. The app is made by Kavio Labs Software Limited ("Kavio Labs", "we"), 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom (company number 17532441). Questions: privacy@kaviolabs.com.
Summary
- When a shopper makes an offer, the app stores the offer with the shopper's email address, and the name and message if the shopper gives them. The merchant uses them to answer the offer.
- The app does not read customer or order data from Shopify. It requests no customer or order access scopes.
- The merchant ("you") is the controller of the shoppers' data; Kavio Labs processes it on your behalf to run the app.
What the app accesses and stores
| Data | Why | Where it is kept |
|---|---|---|
| Offers: product and variant (ID, title, handle, image URL), list price, offered amount, quantity, counter-offer, agreed price, status, dates, the rule that applied | To answer offers, create the discount code, show analytics | Our server |
| Shopper's email address, optional name and message | So you can answer, and the app can email the shopper about their offer | Our server |
| Your reply message (optional) | Shown to the shopper in the email and on their offer page | Our server |
| Discount code and its Shopify ID for an accepted offer | To check whether it was used and to delete it when it expires unused | Our server and your Shopify discounts |
| A one-way hash of the shopper's IP address (keyed with a secret, the IP itself is never stored) | Spam protection: at most 10 offers per hour from one address | Our server, with the offer |
| Products: price, status and collections of the variant an offer is for | To check the price and apply your rules (prices are never taken from the browser) | Read when the offer arrives |
| Store name, contact email, currency, primary domain | Sender name and reply address of emails, prices, links | Our server |
| Your settings, rules and email texts | To run the app | Our server; storefront settings also in an app metafield in your store |
| Access token for your store (encrypted) | To call the Shopify API for you | Our server, deleted when you uninstall |
| Webhook notifications from Shopify (app uninstalled, plan changes, privacy requests) | To clean up and answer privacy requests | Our server, deleted within 30 days |
Access scopes requested: read_products (variant price, product status and collections) and write_discounts
(create the code of an accepted offer and delete expired, unused codes).
Shoppers
The offer form on your product page loads from Shopify's CDN and sends nothing until the shopper presses Send offer. The offer then goes through your store's own domain (Shopify's app proxy) to our server. The form tells the shopper that your store receives their email to answer the offer. The app sets no cookies and uses no tracking or analytics scripts on your storefront.
Shoppers receive emails only about their own offer: received, accepted (with the code), counter-offer and declined. The emails are sent in your store's name from our mail server; replies go to your store's contact email. There is no marketing email and no newsletter sign-up.
The shopper's offer page (/apps/kavio-offer/o/<link id> on your store) can only be opened with the random link id
from the email.
Privacy requests and deletion
customers/data_request: the app prepares a file with that customer's offers (matched by email) in the app under Settings → Customer data requests, available for 30 days, so you can answer the customer.customers/redact: the app deletes that customer's offers (matched by email).app/uninstalled: we delete the access token immediately.shop/redact(48 hours after uninstall): we delete every record about your store, including all offers, rules and settings. If it never arrives, an automatic job deletes the data 30 days after the uninstall.- While the app is installed, offers older than 24 months are deleted automatically.
Discount codes created by the app live in your Shopify store. Expired, unused codes are deleted by the app; used codes stay in your discounts.
Processors and hosting
The app's server runs at apps.kaviolabs.com with our web hosting provider, and emails are sent through that provider's mail server. Billing is done by Shopify; we never see card details. We do not sell or share data with anyone else and do not use it for any other purpose.
Your rights
You can ask for a copy of the data we hold about your store, or for its deletion, at privacy@kaviolabs.com. Shoppers should contact the store they made the offer to; we help the store answer. We answer within one month. You can also contact your local data protection authority (in the United Kingdom, the Information Commissioner's Office, ico.org.uk).
Changes
We will post any change on this page and update the date at the top.
Need help? Write to support@kaviolabs.com with your store's .myshopify.com address.
Make an Offer is coming to the Shopify App Store. Notify me at launch.