1. Who we are
Symbiotic is a Shopify app operated by KraftPixel Digital Solutions Pvt Ltd, 416, Dattani Prism 1, Vasai West, Mumbai, Maharashtra 401202, India ("we", "us"). The app is built to protect consumer autonomy and to avoid deceptive design patterns. This policy explains how we process personal data for merchants who install it.
2. Our role
The merchant who installs Symbiotic is the data controller for their shoppers' data. We act as the data processor, handling that data only to run the app on the merchant's behalf. Our Data Processing Agreement forms Part B of the Terms.
3. What we process
From Shopify we read product data, and — for attribution only — the order id, currency, total and discount codes on new orders, so a merchant can see what negotiating actually earned. We do not request the protected customer fields (name, email, phone, address), so Shopify redacts them before they ever reach us. We never export or resell a merchant's customer list.
We also read discount availability and the associated rollout settings, including schedules, traffic allocation and changes that activate or expire a discount. We use these settings to check whether a saved discount can be reused at checkout. This access is read-only for rollouts and does not identify a shopper’s rollout group.
The one piece of shopper contact information we hold is the email address or phone number a shopper chooses to type in to unlock a deeper discount. It is stored encrypted at rest (AES-256-GCM) next to the exact disclosure wording shown at that moment, and the merchant can view and export those sign-ups from inside the app at any time. Device fingerprints are one-way hashes used solely for abuse prevention, and the pricing engine works from the product and the cart, never from customer identity.
4. Consent
Marketing opt-in is unbundled and never a precondition: the negotiation works in full without it, so a discount is never conditioned on newsletter sign-up (the GDPR coupling ban, and DPDP unbundled consent). There is no pre-ticked box, because there is no box — the field starts empty and nothing is submitted until the shopper types their own contact details and presses the button. Accept and decline options carry equal visual weight.
5. Retention
We apply retention periods rather than keeping data until someone asks us to delete it. Negotiation sessions and their audit trail are deleted 90 days after the deal expires. Consent records are kept for 24 months as the evidence of the opt-in. Order attributions — an order id and two totals — are kept for the life of the install because they are the merchant's own reporting, and go when the app is uninstalled.
6. Where your data lives
The application and its database run on servers in Germany (Hetzner), behind Cloudflare for DNS and TLS. Our other processor is Shopify itself. Nothing else: no analytics, advertising or session-recording third party is present in the app or in the storefront widget.
7. CCPA / CPRA
We do not sell or share personal data. Where a discount is offered in exchange for contact information, merchants present a Notice of Financial Incentive with material terms and a good-faith data valuation, plus a clear opt-out.
8. Automated decisions
The offer a shopper is made is generated automatically, from the product's price and the course of the conversation. Taking part is entirely the shopper's choice — declining, or never opening the negotiator, leaves them at the store's normal price.
9. Your rights
Shopify's mandatory data-request and redaction webhooks are honoured automatically: a redaction request deletes the matching consent record immediately, and uninstalling the app deletes the store's data in full. To exercise access or deletion rights over an opt-in you gave, contact the merchant, or write to us at info@kraftpixel.com.
10. This marketing site
On this website, the demo negotiator on the homepage asks for an email address before it will haggle. If you give us one, we store it so we can email you about Symbiotic, and you can unsubscribe at any time. The contact form opens your own email client and we never store what you type into it.
11. Changes
If this policy changes materially we will update the date at the top of this page, and, where the change affects how merchant or shopper data is handled, notify merchants inside the app.