OUR DOCUMENTS
Privacy policy
Version 2026-11-06 — effective 6 November 2026. A professional legal review is planned; any changes will be published here as a new version, with notice as described under "Changes".
This policy covers the Momentburst: Football Sales Shopify app ("the app"). The Momentburst website and its beta-request form have their own website privacy notice, described under "Website and beta requests" below.
Who we are
The app is provided by Ted Cane trading as Momentburst, a sole trader based in London, United Kingdom ("we", "us"). We are contactable by email only: write to support@momentburst.com for privacy questions, data requests, notices and support. We have not appointed a data protection officer and are not required to.
Our two roles
Processor for your customers' order data. When a merchant installs the app, the merchant is the controller of its customers' personal data. We process the limited order data described below only on the merchant's behalf and under our data processing agreement (DPA). Shoppers who want to exercise their rights over order data should contact the merchant; requests Shopify passes to us are handled as described under "Requests and your rights".
Controller for merchant account data. We are the controller of the business contact and account information we hold about merchants (for example the store's contact email address, plan status, Klaviyo connection details and agreement acceptance records), and of our own security and support records.
What we collect, why, and our lawful basis
The table summarises every category the app stores. Retention periods are set out in the next section.
| Data | What exactly | Source | Purpose | Role and lawful basis (UK GDPR) |
|---|---|---|---|---|
| Store profile | Shopify store domain, store name, store contact email, currency, timezone, install and uninstall dates, plan and Shopify subscription identifier, store status | Shopify, at install and when the store's details change | Run the service, apply plan limits, contact the merchant about the service and data requests, and send the post-match results email the merchant can turn off in Settings | Controller. Contract (Art. 6(1)(b)); legitimate interests in running and supporting the service (Art. 6(1)(f)) |
| Shopify access credentials | Expiring offline access token and refresh token, granted scopes | Shopify OAuth at install | Create and remove discounts, read order history, read products and collections for the merchant | Controller (security of the service). Contract |
| Merchant settings | Selected teams, rules, reward settings, eligible collection IDs, banner text and style, daily caps, the alcohol attestation and its timestamp, notification preference | Entered by the merchant | Configure and run moments within the guardrails | Controller. Contract |
| Agreement acceptance records | The store, the versions of the merchant terms, DPA and privacy policy presented, the time of acceptance and the accepting staff member's Shopify user ID (a number, not a name or email address) | Recorded when a staff member ticks the acceptance checkbox in the app | Show which documents a store accepted, when and by whom | Controller. Contract; legitimate interests in being able to show what was agreed (Art. 6(1)(f)) |
| Moment records | Moment start and end times, status and skip reasons, Shopify discount ID and title, rendered banner and email text, Flow trigger status, test-moment flag | Generated by the app | Run moments, prevent duplicates, show history and results | Controller for the record of our service; processor where it is linked to orders. Contract |
| Attributed order data | Shopify order ID, order number (for example #1001), order total and currency, order creation time, and which moment's discount the order used | Shopify orders/create webhook | Measure which orders used a moment's discount and show results | Processor for the merchant. The merchant determines the lawful basis |
| Baseline order totals | Order IDs, creation times and totals for comparable past periods, read from Shopify on demand | Shopify Admin API (read_orders) | Estimate normal sales to compare with a moment; only the aggregate estimate is stored | Processor for the merchant |
| Klaviyo connection | The merchant's Klaviyo private API key, Klaviyo account ID, sender email address and sender name (all encrypted), Klaviyo account name, connection status | Entered by the merchant | Create and send the merchant's moment emails from the merchant's own Klaviyo account | Controller (merchant account data). Contract |
| Email send records | Klaviyo campaign and template IDs, the IDs of the Klaviyo lists the merchant chose for the rule, rendered subject and content, send status and times | Generated by the app | Send each moment email once, within its time window, and show the outcome | Processor for the merchant |
| Founding Pro record | Store domain, Shopify shop ID, place number, approval and status dates, offer terms version | Our invitation process and Shopify plan status | Enforce the 50-store cap and the one-time nature of the founding price | Controller. Legitimate interests in administering a limited offer fairly |
| Audit and retry records | Timestamped records of actions (for example rule saved, moment fired, email sent), the actor type (system, merchant or operator, not an individual's name) and minimal identifiers to prevent duplicate actions | Generated by the app | Security, troubleshooting, preventing duplicate discounts or emails, and evidence of data-request handling | Controller. Legitimate interests in security and reliability; legal obligation where we must evidence privacy-request handling |
| Privacy request records | Shopify data-request ID, order IDs named in the request, due date, fulfilment status | Shopify customers/data_request webhook | Answer the request within Shopify's deadline | Processor for the merchant |
| Sports data | Fixtures, scores and match events, including a goal scorer's name where the provider gives it. The provider's full match responses, which we keep for 14 days, can also name other players, for example in assists, cards, substitutions, line-ups and player statistics | API-Football | Detect goals, wins and clean sheets. Player names are never used as triggers | Controller. Legitimate interests in operating the service from published match data |
| Web request and application logs | Request logs: method, path without its query string, response status, response size and response time. Application logs: events and errors from the app and its background worker, with tokens, keys, passwords, authorisation headers and email fields redacted | Generated by the app's web server and worker | Operate and secure the service and diagnose faults | Controller. Legitimate interests in security and reliability |
| Support and privacy correspondence | Emails you send to support@momentburst.com and our replies, including data-request exports we send to merchants | You, and us | Answer questions, provide support and handle data requests | Controller for our correspondence; processor for the order data in data-request exports. Legitimate interests in answering enquiries and supporting the service |
What we do not collect. The app does not request or store customer names, email addresses, phone numbers or postal addresses. When Shopify sends an order webhook, the app extracts only the order ID, order number, total, currency, creation time and discount titles, and discards the rest without storing or logging it. The app does not copy Klaviyo profiles or list members into its database. It does not collect card or bank details: Shopify handles all billing. It does not process special-category data, and merchants must not put such data in rule or template text.
Storefront banner. The countdown banner script runs on the merchant's storefront and asks the app, through Shopify's signed app proxy, whether a moment is live. The response contains only the moment's banner text, end time and style. The script sets no cookies and uses no tracking or analytics. It stores one value in the shopper's browser session storage, "fm-dismissed:" followed by a moment ID, so that a dismissed banner stays dismissed; this is cleared when the browser session ends. Shopify adds standard parameters to app proxy requests, including a logged-in customer's Shopify customer ID. The app does not read, store or log that ID. Since 5 October 2026 our web server's request log records only the method, the path without its query string, the status, the response size and the response time, so customer IDs and the short-lived Shopify session tokens carried in the addresses of the app's admin pages are not logged. Request logs written before that change could include those parameters for our development store only; they expire under the 7-day log retention below.
Merchant staff. The app uses Shopify offline access and does not store the names or email addresses of individual staff users. When a staff member accepts the merchant terms and DPA in the app, the acceptance record includes that staff member's numeric Shopify user ID.
Automated decisions. Moments are triggered by match events and apply the same timed discount to every qualifying shopper. The app makes no decisions about individuals with legal or similarly significant effects, does no profiling, and does not sell or share personal data for advertising.
How long we keep data
The app runs a cleanup job daily at 03:30 UK time. Retention periods come from the app's code.
| Data | Retention |
|---|---|
| Shopify access and refresh tokens | Deleted immediately when the app is uninstalled |
| Store profile, settings, rules, moment records and daily counters | While the app is installed. Deleted when Shopify sends its shop redaction request, 48 hours after uninstall; the app processes it automatically on receipt |
| Agreement acceptance records | While the app is installed, the full record described above. On shop redaction it is replaced by a minimal record: a keyed hash (HMAC) of the store's domain, the document versions, the acceptance time and the time the minimal record was written. The staff user ID is deleted. The minimal record is kept for 6 years from when it was written, as evidence of what was agreed, and then deleted by the daily cleanup |
| Attributed order data and moment results | While the app is installed (a plan's history limit hides older results but does not delete them). Deleted for specific orders when Shopify sends a customer redaction request, and for the whole store on shop redaction |
| Order data waiting in the job queue | Processed within seconds; queue entries are deleted 7 days after completion, and unprocessed entries expire after 30 days |
| Markers for redacted orders (a one-way hash, not the order ID) | Until shop redaction, to stop delayed webhooks recreating erased orders |
| Klaviyo connection | Until the merchant disconnects, or until uninstall cleanup, which first cancels any unsent campaign and then deletes the encrypted key |
| Email send records | Until shop redaction |
| Shopify discounts created by the app | Each discount expires at its fixed end time and the app deletes it from Shopify 24 hours later. If the app is uninstalled first, access ends and the discount still expires at its end time |
| Audit records | 180 days, then deleted by the daily cleanup; a store's audit records are deleted earlier on shop redaction |
| Retry records | Until shop redaction |
| Privacy request records | Kept until the request is fulfilled; fulfilled records are deleted by the first daily cleanup at least 30 days after the request arrived. Exports are generated on demand and not stored in the app |
| Founding Pro record | Kept after cancellation or uninstall so the one-time offer is not reused; the store identity is erased on shop redaction, leaving an anonymous occupied place |
| Raw sports-data responses | Cleared by the daily cleanup 14 days after the fixture was last polled: both the latest response stored for the fixture and the copy kept with each match-event record. The production worker's match recordings are deleted by the same cleanup 14 days after they were last written. Structured fixture and event records, including a goal scorer's name, are kept as match history and contain no merchant or customer data. Recordings of a small number of matches are kept in the app's source code as test data for the match engine |
| Database backups | Render keeps continuous point-in-time recovery for 3 days, so deleted data can remain in backups for up to 3 days |
| Web request and application logs | 7 days. Our hosting provider, Render, keeps logs for 7 days on our workspace plan, after which they expire. Render's own HTTP request logs are not available on that plan, so the only request logs are the app's own |
| Support and privacy correspondence, including data-request exports sent by email | Kept while needed to handle the enquiry, then for up to 2 years for our records, unless the law requires us to keep it longer |
Who receives data
We do not sell personal data. We use these providers:
| Provider | What it does for us | Data involved | Location |
|---|---|---|---|
| Render Services, Inc. | Hosts the app's web service, background worker and PostgreSQL 17 database. Render uses its own sub-processors under its Data Processing Addendum, currently Amazon Web Services, Google Cloud Platform, Cloudflare and ClickHouse (Render's list) | All app data listed above, and logs | Frankfurt, Germany (EU). Render is a US company and may access data from the US for support; Render's sub-processors are US companies |
| Cloudflare, Inc. | From our own Cloudflare account: hosts the Momentburst website, provides DNS for momentburst.com and app.momentburst.com (DNS only: our account does not proxy app traffic), and, through Cloudflare Email Routing, forwards email sent to support@momentburst.com to our mailbox. Separately, Render delivers requests to the app, and the app's responses, through its network edge, which uses Cloudflare as Render's sub-processor under Render's terms | Through our account: no app data; support and privacy emails pass through Email Routing on their way to our mailbox. As Render's sub-processor: requests to the app and its responses in transit, including Shopify webhooks, storefront banner requests and admin pages | Global |
| Google LLC (Gmail) | Our mailbox: stores the support and privacy email forwarded to us, and sends our replies and data-request exports | Correspondence, and data-request exports we email to merchants | Google operates globally, including the US |
| Resend (Plus Five Five, Inc.) | Sends the app's post-match results email from momentburst.com to the store contact email. It is off unless enabled, and the merchant can turn it off in Settings | The store contact email address, store domain, the match score, and each moment's order count and revenue. Resend keeps each email and its delivery log for up to 30 days | Sent from Ireland (EU); Resend stores account data, email records and logs in the US |
| GitHub | Stores the app's source code | No merchant or customer data | US |
| API-Football (API-Sports) | Supplies live match data | We send only fixture and team requests and our API key; no merchant or customer data | Not applicable: no personal data is sent |
Shopify and Klaviyo are the merchant's own services. Shopify is the platform the app is installed on: it sends us the order and store data described above, receives the discounts and Flow triggers we create, and manages billing. If a merchant connects Klaviyo, the app uses the merchant's own Klaviyo account, with the merchant's key, to create and send each moment's campaign only to the lists the merchant selects for that rule. The app never emails anyone outside those lists and never copies list members into its own database. The merchant is the controller of that email and its recipients, and Klaviyo is the merchant's own provider under the merchant's agreement with Klaviyo. Outside production, our development and staging environments can send only to our own internal test list in our own Klaviyo test account, never to a merchant's Klaviyo account. Shopify and Klaviyo may process data outside the UK and EU under their own terms with the merchant.
We do not use Sentry or any other external error-tracking or alerting service. We may disclose information where the law requires it.
International transfers
The app's database and servers are in the EU (Frankfurt), which the UK recognises as providing adequate protection. Render Services, Inc. is a US company that may access data from the US for support. Our use of Render is covered by Render's standard Data Processing Addendum, which forms part of Render's terms of service. Under it, transfers from the UK and EU to Render rely on the EU-U.S. Data Privacy Framework, including its UK Extension, and, if the Framework does not apply, on the EU Standard Contractual Clauses with the UK Addendum. Render's own sub-processors, including Cloudflare for its network, are engaged under Render's Data Processing Addendum (Render's list).
Resend's processing is covered by Resend's Data Processing Addendum, which forms part of its terms. Resend stores data in the US; transfers from the UK and EU rely on the EU-U.S. Data Privacy Framework, including its UK Extension, and on the EU Standard Contractual Clauses with the UK Addendum (Resend's sub-processors).
Cloudflare's processing is covered by Cloudflare's Data Processing Addendum, which includes its safeguards for international transfers. Our mailbox is a Gmail account, which Google provides under its standard terms and privacy policy rather than business data processing terms; Google stores it on its global infrastructure, including in the US, and Google LLC is certified under the EU-U.S. Data Privacy Framework, including its UK Extension. Contact us for more information about the safeguards that apply to your data.
Security
The database and its backups are encrypted at rest (AES-256, managed by Render) and have no public network access; the app connects to it over TLS on Render's private network. All connections to the app, Shopify, Klaviyo and API-Football use HTTPS. Klaviyo keys and sender details are additionally encrypted by the app (AES-256-GCM) with a key held only in the hosting environment. Every Shopify webhook and storefront proxy request is signature-checked before use, admin pages require a valid Shopify session, and the operator console requires a long secret token. Application logs redact tokens, keys, passwords and email fields, and the web server's request log does not record query strings. Development and production use separate databases and keys. Only Ted Cane has access to the production systems.
Requests and your rights
Shoppers. Contact the store you bought from. When a store owner submits a request through Shopify, Shopify sends it to us automatically. For a customer data request we compile the order data we hold for the order IDs Shopify names and send it to the merchant's store contact email within 30 days of receiving the request. A customer redaction request is processed automatically on receipt: the named orders are deleted, the affected results are recalculated, and pending queue entries for those orders are removed. Shopify sends a store's redaction request 48 hours after uninstall, and the app deletes that store's data automatically on receipt, apart from the minimal agreement record described above. Shopify requires both to be completed within 30 days.
Merchants and other individuals. You have rights under UK data protection law to access, correct and erase your personal data, to restrict or object to processing, and to data portability. These rights have conditions and exceptions. Email your request to support@momentburst.com; we handle requests by email. We may ask for proportionate information to verify your identity, and we normally respond within one month. You can complain to the Information Commissioner's Office, and if you are in the EU, to your local supervisory authority. Please contact us first so we can try to help.
Website and beta requests
The Momentburst website (momentburst.com) and its beta-request form are covered by a separate website privacy notice. It explains what the form collects, that Cloudflare stores the requests, and that each request is deleted about 90 days after it was submitted. The form does not connect to a Shopify store or collect shopper order data.
Changes
We will publish any change here as a new version with a new effective date, and tell installed merchants by email to their store's contact email address, and also in the app, at least 30 days before a material change takes effect, unless the change is needed sooner for legal or security reasons.
Version 2026-11-06 adds Resend, which sends the new post-match results email to merchants. It is not a material change: it uses the store contact email we already hold, for the purpose already stated (contacting the merchant about the service), and the email can be turned off.