Symbiotic
Symbiotic
Last updated September 2026. These terms apply to every merchant who installs Symbiotic, and are accepted on installation. They incorporate the Data Processing Agreement in Part B.
Symbiotic is operated by KraftPixel Digital Solutions Pvt Ltd, 416, Dattani Prism 1, Vasai West, Mumbai, Maharashtra 401202, India — info@kraftpixel.com.
Symbiotic is a Shopify app that lets a shopper negotiate a discount on a product page inside limits the merchant sets, and mints a Shopify discount code for the agreed price. The merchant configures every limit that matters — which products are negotiable, the floor beneath which the app will not go, and the rewards attached to optional actions. Symbiotic never issues a discount outside those limits.
The merchant is responsible for the accuracy of its product pricing, for the disclosure text shown at any opt-in, and for the legality of the discounts it configures in its own market. The merchant must not use Symbiotic to present a reference price that is not a genuine selling price.
Plans and usage allowances are shown on the pricing page and billed through Shopify's billing system. Charges appear on the store's Shopify invoice, and cancelling the app in Shopify ends the subscription.
The app is provided as-is, without warranty of uninterrupted availability. It is designed to fail safe: if the backend is unreachable the storefront widget removes itself and the store's normal checkout is untouched, so a Symbiotic outage never blocks a sale. To the extent permitted by law, our aggregate liability is limited to the fees paid for the app in the twelve months before the claim.
Either party may terminate at any time; a merchant does so by uninstalling the app. On uninstall, Shopify sends a shop redaction request and all of that store's data is deleted, as described in Part B §8.
These terms are governed by the laws of India, without regard to conflict-of-law rules. The courts of Mumbai, Maharashtra have exclusive jurisdiction over any dispute.
The merchant is the controller of personal data relating to its customers and store visitors. KraftPixel Digital Solutions Pvt Ltd, operating Symbiotic, is the processor, and processes that data only on the merchant's documented instructions — which, for the avoidance of doubt, are given by installing the app and configuring its campaigns.
Processing lasts for as long as the app is installed, plus the retention periods in §7. Its subject matter is running a price negotiation on the merchant's storefront and reporting on its outcome.
Data subjects are the merchant's store visitors and customers. The categories processed are:
No special-category data is processed. Symbiotic does not sell or share personal data, and does not use it to train models.
The list is short and complete. There are no analytics, advertising, or session-recording third parties in the app or the storefront widget.
Merchants will be notified before any new sub-processor is added.
Merchant and shopper data is stored on servers in Germany, so data originating in the EEA and UK stays there in normal operation. Administration and support are carried out from India by KraftPixel Digital Solutions Pvt Ltd under this agreement, which is the only routine transfer outside that region.
Shopify's mandatory privacy webhooks are implemented and act for real. A customer data request returns what is held; a customer redaction deletes the matching consent records immediately, whatever their retention period; a shop redaction deletes the store and everything belonging to it. Merchants who need help with a rights request beyond this can write to info@kraftpixel.com.
| Negotiation sessions and their audit trail | 90 days after expiry |
| Consent records (opt-in evidence) | 24 months from capture |
| Order attributions (merchant reporting) | Life of the install |
These periods are enforced by an automated daily sweep, not on request.
When a merchant uninstalls, Shopify sends a shop redaction request and the store's record and every row belonging to it — campaigns, sessions, audit logs, consent records and attributions — are deleted. Access tokens are deleted at uninstall.
We will notify affected merchants and Shopify without undue delay, and in any event within 72 hours of becoming aware of a personal data breach affecting their data, with what we know about its nature, likely consequences and remediation.
On reasonable written request, and no more than once a year, we will provide the information needed to demonstrate compliance with this agreement.
See also our privacy policy.