PostBoost Privacy Policy

Last updated: October 12, 2026

Who we are

PostBoost is operated by Searivo. It helps Shopify merchants configure post-purchase offers and verify additional revenue against Shopify payments and refunds. Contact: support@getsearivo.com.

Data and purposes

We process store domains, installation and subscription identifiers, encrypted API credentials, product and variant details, merchant offer settings, order and line-item identifiers, opaque purchase references, offer impressions, added-item amounts, currencies, payment status and refund amounts. We use these to authenticate the store, show relevant offers, append an accepted offer to the original order, verify payments, deduct refunds, and report performance to that merchant.

Order-related data is protected customer data even when it does not include a customer's name or contact details. Our app does not request customer name, email, phone or address fields for offers or analytics, and does not store card numbers or payment authentication details. Shopify handles payment collection. Mandatory privacy notices may contain contact details; we validate the notice but do not retain those fields.

Sharing and choices

We do not sell customer or merchant data or use it for advertising audiences. Data is processed through Shopify and Vultr hosting in Seattle, United States. International transfers may require additional safeguards under the merchant’s applicable law; contact support before using the service where a separate transfer agreement is required. The embedded merchant dashboard does not load our optional advertising, third-party analytics or customer-chat integrations. We do not perform decisions with legal or similarly significant effects on customers. Customers can decline an offer and continue to their order.

Merchants determine the lawful basis for the processing they request and must provide appropriate customer notices. PostBoost processes store order data on the merchant's instructions for the purposes above. It does not use that data to contact customers or build cross-store profiles.

Retention and deletion

Order-level offer events and verification receipts are retained for 60 days, with expired records removed by daily maintenance. Dashboard totals cover this retention window. Customer-request export files are encrypted and retained for up to 30 days. Offer configurations, installation records and merchant agreement records remain while the app is installed. Encrypted disaster-recovery backups are kept for up to seven days; deleted data may remain in restricted backups until they expire and is not used for live operations.

After uninstall, the app stops using the store's API credentials. Shopify normally sends a shop deletion notice 48 hours after uninstall. On a valid notice, we delete the store's PostBoost configurations, receipts, analytics, exports, agreement records, app subscription records and stored connection credentials. A delayed notice for an earlier uninstall must not delete an active new installation.

On a valid customer deletion notice, we delete stored records for the specified orders and related purchase references, and remove those order records from outstanding export copies for that store. On a customer data request, we generate an encrypted export for the authenticated merchant to download under Data & Privacy and provide to the customer. We do not retain the notice's customer email or phone. Contact support if a request needs assistance. Deletion from the app does not delete the merchant's original Shopify orders.

Security and incidents

HTTPS protects app traffic. Stored API credentials and generated privacy export payloads use AES-256-GCM with server-managed encryption keys. Access to merchant exports requires authenticated store ownership. We restrict administrative access and do not log webhook bodies or API credentials. Contact support to report a suspected security incident.

Your rights

Merchants and customers may request access, correction or deletion, subject to applicable legal requirements. Customers should contact their merchant first so that Shopify can identify the relevant orders. Support can assist with the app's records. We may update this policy and will identify the current version on this page.