--- title: "Privacy" description: "What Offer Suite collects, why, how long it keeps it, where it is processed, and how to reach us." url: https://offersuite.io/privacy updated: 2026-10-24 --- # Privacy Last updated 24 October 2026 Offer Suite is a Shopify app operated by Blackout Media, a company established in Brazil. It lets a brand build offers in its Shopify store, check that a real cart charges what each offer promises, and see the profit each offer earns. This page says what we collect, why, for how long, and where it is processed. ## What we collect through Shopify's APIs - The store's products, variants, prices and selling plans, to build offers and check their carts. - What Offer Suite sets up in the store: its discounts and discount codes, its web pixel, the checkout pricing and settings each offer needs, the public key the theme block uses, and the access Shopify grants it to build and check carts. - Orders: line items, quantities, prices, discounts, taxes, the shipping charged, refunds and edits, fulfilments (parcels shipped), the order's payment transactions (to read the payment processing fee), order tags, the cart attributes Offer Suite adds, the order's source, the order's number (such as #1035), and its checkout and cart tokens, which link the order to the checkout and cart it came from. We receive them when the store sends them and also read them from Shopify ourselves: an import of past orders when the brand asks for one (a year back by default, or from a date it chooses; only the last 60 days until the store grants Shopify's permission to read all orders), and a daily check that we have every order. - The title, image, status and the first 300 characters of the description of each product an offer uses, and the shop's plan, currency and time zone. - About the buyer of an order: Shopify's customer id, the order's place in that customer's order history, the checkout's language, the shipping country and state or province, and the kind of device and browser used (for example "mobile, Safari"), so a brand can tell new customers from returning ones and compare profit by market and device. - Shopify's record of the visits an order came from (the landing page, the referring site and the campaign parameters in the landing page's address), when the cart did not already carry where the buyer came from. Never an ad click id from this record. - When a store turns on the Offer Suite post-purchase page, the purchase the buyer has just paid for, as Shopify passes it to that page: the store, the checkout's token, the shipping country, and the products, quantities and amounts bought, to choose which upsell to show. Shopify's customer id in it is only compared with the orders we already hold, to count the buyer's earlier orders, and is never stored from that page. We record which upsell the checkout was shown and at what price, and, when the buyer accepts it, the change to the order. Shopify then adds those products to the order and charges for them; Offer Suite does not edit orders itself. **We never store a buyer's name, email, phone number, street address, city, postal code, IP address, browser user agent or payment details.** They are removed from every order before it is saved. When Shopify asks us to redact a customer, we remove the customer id, the visitor id, the cart and checkout tokens, the ad click ids, the campaign labels (utm_source, utm_medium, utm_campaign, utm_content, utm_term) and the landing page's original parameters from every order of that customer and from the events and profit records linked to them. We also delete the record of their checkout and remove the checkout's token from any upsell it was shown. What stays on those orders describes the sale and no longer leads to the person: its money and products, the offer it came from, the ad platform, ad ids and landing page it was labelled with, the checkout's language, the shipping country and state or province, the kind of device and browser, and the order's place in that customer's order history. ## What we collect from merchants - The email addresses of the people a brand invites to its Offer Suite dashboard, to send sign-in links. - API keys, which we never store in readable form, and the store's Shopify access token, which we store encrypted. - The offers, post-purchase placements and saved simulator scenarios the brand or its agents write, the product costs the brand enters, and the ad spend it records for each offer and day, with the ad platform and campaign when it gives them. ## What we collect from merchants' customers When a brand's page uses the Offer Suite theme block or script, or its checkout runs the Offer Suite web pixel, we receive: - A random visitor id (v_ followed by a random UUID). The theme block and script keep it in the browser's local storage. When the brand's page shows offers rendered on its server, we ask the brand's server to keep the same id in a first-party cookie named os_visitor (the example page we run keeps it for one year). The id is not linked to a name, email or account. - Which offer was viewed, which option was selected, when it was added to the cart, when checkout started, and when the order was placed, with the cart id, the checkout's token, the order id and the amount. - Where the visitor came from, for their first visit and for their latest visit from a campaign or another site: the path of the page they landed on, the host of the site that referred them, and the campaign parameters in the landing page's address (such as utm_source and utm_campaign, the ad platform's campaign, ad set and ad ids, and the parameters of attribution tools such as Northbeam and Triple Whale). Any other parameter is dropped, and any value that holds an email address is dropped, in every one of these fields and in the copy of the original parameters we keep. The theme block and script keep this beside the visitor id in the browser's local storage, and it travels with the cart to the order. We also record the kind of device and browser that sent each event, never the browser's full user agent. - The ad click id in the landing page's address (such as fbclid, gclid, ttclid or msclkid), so a brand can join its orders to its ad platforms, stored according to the merchant's consent settings: when the store's consent setup says the visitor declined marketing, we record only which kind of click id it was, never its value, and erase any value stored in their browser. On a Shopify store the theme block, script and web pixel read those settings from Shopify's customer privacy settings; elsewhere the brand passes its own. - From the web pixel, a record of each checkout that started with an Offer Suite offer in the cart: the checkout's token, the offer and option, the visitor id, and where the visitor came from (without the ad click id or the landing page's original parameters), so the post-purchase page can choose an upsell before the order exists. The web pixel follows the store's cookie consent: it runs only when the buyer allows analytics. A visitor's IP address is used for a moment to limit request rates and, when a brand's server builds a cart, is passed to Shopify with that cart request; we do not store it. ## The waitlist and profit audit forms When you join the waitlist or request a free profit audit on this site, the form sends your work email, your store's address, your monthly revenue band, your subscription app and your role to Blackout Media by email, so that we can invite you when Offer Suite opens to a store like yours, or set up the audit you asked for. With them it sends where you arrived at the form from: the name of the website whose link you followed to the form's page, when it is another site (the name only, never the page), and the campaign tags (utm_source, utm_medium, utm_campaign, utm_term, utm_content) in the address of the form's page or, when it has none, in the address of the page of ours whose link you followed to it, so we can count which links bring requests. Any value holding an email address is dropped. Nothing is kept in your browser for this: no cookie and no storage. We do not keep the answers anywhere else: not in a database, not in our logs. We don't add you to a mailing list; we email you only to invite you or about the audit you asked for. To have your answers deleted, email [privacy@offersuite.io](mailto:privacy@offersuite.io) from the address you gave, and we delete the email. The forms use Cloudflare Turnstile, which runs a check in your browser to tell people from bots before the form is sent. ## Install links When you follow one of our links to install Offer Suite on Shopify, we keep, for 30 days, a cookie on offersuite.io that holds only the name of the website you came from (not the page) and the campaign tags in the link. When you then open Offer Suite in your Shopify admin for the first time, the workspace it creates records that website and those tags, so we can count which links brought new stores. The cookie holds no id, no address and nothing about you. ## Visits to this site We count visits to offersuite.io without cookies: for each page viewed we record the page, the site that linked to it, the visitor's country, the kind of device and browser, and how long the page took to load. No cookie is set, and nothing we record identifies you or links one visit to the next. ## How we use it Only to provide Offer Suite to the brand: to build and check offers, to attribute each order to the offer that made it, and to report revenue, costs, profit and the steps from view to purchase. We do not sell data, share it with advertising networks, profile buyers, or make automated decisions about them. ## How long we keep it - Order records are kept while the store is connected, because they are the brand's record of what its offers earned. - Browser events are deleted 37 months after they happen. - A checkout's record is deleted by a daily job once it is 30 days old, unless the buyer accepted an upsell from it on the post-purchase page. - When a brand uninstalls Offer Suite, Shopify tells us 48 hours later, and we then delete that store's orders, offers, events, ad spend, post-purchase records and connection. We keep the brand's account, its members and the costs it entered, until the brand asks us to delete them. - When a buyer asks the store to erase their data, Shopify tells us which orders are theirs, and we remove every link between those orders and a visitor or a session. The order amounts and the order's number (such as #1035) stay, without anything that identifies the buyer. - A record of each privacy request and what we did about it is kept for as long as the brand's account exists. ## Where it is processed Data is stored in the United States (Ohio) and is encrypted in transit and at rest. These sub-processors handle it for us: - Cloudflare: hosting, the forms' human check, and delivery of waitlist and profit audit emails to us. - Neon: data storage. - ClickHouse: data storage for reports. - Amazon Web Services: the data centre in Ohio where that storage runs. ## Requests and questions Buyers who want to see or erase their data should ask the store they bought from; Shopify passes the request to us, and we answer it within 30 days. Brands can see every request we received for their stores, and what we did, on the Privacy page of the Offer Suite dashboard or through the API. For anything else, email [privacy@offersuite.io](mailto:privacy@offersuite.io).