Privacy policy

Effective date: July 2026

Kept (“Kept”, “we”, “us”, “our”) is a Shopify application, operated by Foilgrass, that lets merchants run a return-prevention quiz on their storefront and route eligible returns to exchange or store credit before a refund. This policy explains what information Kept processes, why, and your choices.

1. Who this policy covers

• Merchants — Shopify store owners who install and configure Kept.
• Shoppers — a merchant's customers who interact with the returns quiz on that merchant's storefront.

For any shopper information processed through the quiz, the merchant is the data controller and Kept acts as a data processor on the merchant's behalf and under the merchant's instructions.

2. Information we process

2.1 From merchants (on install and use)

• Your store's myshopify.com domain and the basic store details Shopify exposes at install.
• A Shopify OAuth access token, stored securely and used only to operate the app — to read your theme so the storefront block can render, and to read/write the app-owned metafield that stores your quiz configuration.
• Your quiz configuration (questions, wording, themes, and policy settings you choose in the builder).
• Subscription/billing status, handled by Shopify Billing. We never receive or store your payment-card details.

Access scope requested: read_themes. Kept does not request access to your customers' personal data, orders, or products.

2.2 From shoppers (the returns quiz)

Kept collects only anonymous, non-identifying data:

• The predefined answers a shopper selects (for example, reason = “wrong size”, item condition, or timing). These are multiple-choice selections — not free text and not personal details.
• The outcome the quiz reached (for example: exchange, store credit, refund, or not eligible).
• A randomly generated “visitor ID” stored in the shopper's own browser (localStorage), used solely to de-duplicate repeat completions so merchant counts are accurate. It is first-party, is not shared across other websites, and is not linked to any personal identity.

2.3 Technical and operational data

As with any web service, our hosting and infrastructure providers may transiently process standard technical information (such as IP address and request metadata) to deliver, secure, and debug the service. We do not use this to identify shoppers or build shopper profiles.

2.4 Analytics (where enabled)

Kept may aggregate the anonymous quiz data above into merchant-facing metrics (for example, return-reason mix and deflection counts). These aggregates contain no personal information. Separately, if a merchant has Google Analytics (GA4) installed on their store, quiz-completion events may be mirrored to that merchant's own GA4 property; that data is governed by the merchant's and Google's policies, not this one.

3. How we use information

• To operate the returns quiz and render it on the storefront.
• To store and serve each merchant's configuration.
• To provide merchants with aggregate, anonymized return analytics.
• To maintain, secure, troubleshoot, and improve the service.

We do not sell personal information, and we do not use shopper data for advertising or cross-site tracking.

4. Sharing and subprocessors

We share information only with the service providers needed to run Kept:

• Shopify — the platform Kept operates on.
• Render — application hosting and data storage.
• Google Analytics (GA4) — only if a merchant has enabled it on their store (merchant-controlled).

We may disclose information if required by law or to protect our rights, users, or the public.

5. Data retention and deletion

• Merchant configuration and session tokens are retained while the app is installed and are purged when the app is uninstalled — Kept honors Shopify's app/uninstalled and shop/redact webhooks.
• Kept responds to Shopify's mandatory privacy webhooks (customers/data_request, customers/redact, shop/redact). Because Kept stores no shopper personal data, there is generally no customer-specific data to return or erase.
• Aggregate, anonymized analytics may be retained for service operation and benchmarking; it contains no personal information.
• The browser “visitor ID” lives in the shopper's own browser and can be cleared by the shopper at any time by clearing site data.

6. Your rights

Depending on where you live (for example, under the EU/UK GDPR or California's CCPA/CPRA), you may have rights to access, correct, delete, or restrict the processing of your personal information, and to object to certain processing.

• Shoppers: because the merchant is the data controller, please direct requests to the merchant whose store you used; the merchant can reach us through Shopify's privacy webhooks or at hello@foilgrass.com.
• Merchants: contact us at hello@foilgrass.com.

We do not discriminate against anyone for exercising these rights.

7. International transfers

Information is processed in the United States, where the service is hosted. Where personal information is transferred across borders, we rely on appropriate safeguards as required by applicable law.

8. Security

We protect access tokens and stored data using industry-standard measures, including encrypted transport and restricted access. No method of transmission or storage is completely secure, but we work to safeguard the information we hold.

9. Children

Kept is not directed to children and does not knowingly collect personal information from children.

10. Changes to this policy

We may update this policy from time to time. We will revise the effective date above and, for material changes affecting merchants, provide reasonable notice.

11. Contact

Foilgrass
Email: hello@foilgrass.com

This page describes Kept's data practices as built. Questions? We answer privacy mail first.