Privacy policy
Enigma Play (“the App”) is a Shopify app published by Enigma 101 global j.d.o.o., Gajeva ulica 42, 10000 Zagreb, Croatia (“we”). It shows a gamified popup on a merchant’s online store: visitors enter their name and email, play a short game and can win a discount code. This policy explains what data the App processes, why, and for how long.
1. Roles
For data about a store’s visitors and customers, the merchant who installs the App is the controller and we act as a processor on the merchant’s behalf. For data about the merchant’s own account (store domain, settings, billing), we are the controller.
2. Data we process
| Merchant & store | Store domain, Shopify access token (to call the Shopify API on the store’s behalf), popup settings, subscription plan. |
| Visitor name & email | Sent directly to the merchant’s Shopify store as a customer (with email-marketing consent only if the visitor ticks the consent box). The App does not store names or email addresses on its own servers. |
| Email hash | A salted SHA-256 hash of the email, to make sure each email receives at most one discount code per popup. The hash cannot be turned back into the email. |
| Popup statistics | Anonymous counts of popup views, form submissions, games played and wins. No IP addresses, device fingerprints or cookies are used for statistics. |
| Orders using a Enigma Play code | Order ID, order total, currency and the discount code used — to show the merchant the revenue the popup generated and to determine the plan. No customer names, addresses or payment data are stored. |
| Discount codes | Codes the App creates in the merchant’s store for winners, and their usage counts. |
3. In the visitor’s browser
The popup stores a few values in the browser’s localStorage/sessionStorage (for example whether the popup was already shown or closed, the number of attempts, and a won code with its expiry) so it doesn’t reappear unnecessarily. These values never leave the browser. If “auto-apply code” is enabled, Shopify sets its standard discount cookie so the code is applied at checkout.
4. Why we process it
Only to provide the App’s features to the merchant: showing the popup and game, creating the customer and discount code in the merchant’s store, preventing abuse (one code per email), statistics and billing. We do not sell data, use it for advertising, or combine data between stores.
5. Where data is stored & sub-processors
- Shopify — customers, discount codes and orders live in the merchant’s Shopify store.
- Fly.io — hosts the App and its database (region: Frankfurt, Germany, EU).
All connections are encrypted (HTTPS/TLS).
6. Retention & deletion
- When a merchant uninstalls the App, access tokens are deleted immediately.
- All remaining store data (settings, statistics, email hashes, order records) is deleted when Shopify sends the
shop/redactrequest (48 hours after uninstalling). - When Shopify sends a
customers/redactrequest, the email hash for that customer is deleted. - Statistics and order records are kept while the App is installed so the merchant can see historical analytics.
7. Your rights
Visitors and customers should contact the store where they used the popup — the merchant controls their customer data in Shopify and can export or delete it. We support merchants with such requests, including Shopify’s customers/data_request and customers/redact privacy webhooks. Under the GDPR you may also lodge a complaint with your data protection authority.
8. Contact
Enigma 101 global j.d.o.o., Gajeva ulica 42, 10000 Zagreb, Croatia
MBS 081673164 · MB 06171923 · VAT ID HR03945849423
Email: info@enigma101.com
We may update this policy; the date at the top shows the latest version.