Privacy Policy

Effective October 10, 2026

Who we are, and our two roles

SuperBoom, Inc. ("SuperBoom," "we," "us") operates SuperBoom, an email marketing automation service for Shopify merchants. We play two different roles depending on whose data we're handling, and this policy is organized around that split:

• Merchant account data. When we hold information about you as a SuperBoom customer — your account, your store, your billing — we are the business making decisions about that data (a "controller" in privacy terminology).
• Shopper data processed on a merchant's behalf. When a merchant connects their Shopify store to SuperBoom, we receive information about that merchant's customers (shoppers) so we can send the marketing emails the merchant has configured. For that data, the merchant is the controller/business, and SuperBoom acts only as their service provider/processor, following the merchant's instructions.

Information we collect

From merchants (SuperBoom account data)

• Account information: your email address and sign-in credentials (a password, stored only as a secure hash by our authentication provider, or Google sign-in).
• Store information: Shopify shop domain, store name, and the Shopify OAuth access/refresh tokens needed to connect to your store (stored encrypted).
• Subscription and billing state: your plan, trial status, and payment status. Payments themselves are processed by our payment processors (such as Stripe) or, where applicable, through Shopify's own billing system — SuperBoom never holds your full card number.
• Support communications you send us.

From merchants' Shopify stores, on their behalf (shopper data)

Once a merchant connects their store, we receive and process, strictly to run the automations that merchant configures:

• Shopper contact and identity information: email address, first/last name, and the shopper's Shopify customer ID.
• Marketing consent state (whether a shopper has opted in to marketing email) and resolved timezone.
• Commerce events: cart activity, checkout/order events, and order history.
• Storefront behavioral events, collected through a Shopify Web Pixel installed on the merchant's storefront: standard commerce events such as pages, products, and collections viewed, searches, and cart and checkout activity, keyed by Shopify's pseudonymous browser identifier (its "clientId") — not by name or email. Collection is gated by Shopify's customer-privacy framework: in regions requiring consent, the pixel does not run for visitors who haven't consented. Events from visitors we haven't identified are kept anonymous and are automatically deleted within approximately 90 days. We connect a visitor's recent browsing history to their customer profile only at deterministic identification moments (such as checkout). We do not use probabilistic or cross-device matching; if that ever changes, we will update this policy first, and the change will apply only to data collected afterwards.
• Engagement traits we derive from that history and from message activity — for example order count, total spent, and last email open/click — so automations can be timed and targeted sensibly.

We do not supplement this with third-party data enrichment, and we do not purchase, rent, or scrape email lists or other data. Every shopper record we hold originates from the merchant's own Shopify store. If our practices here ever change, we will update this policy first, and the change will apply only to data collected afterwards.

From visitors to the SuperBoom website (superboom.ai)

• Waitlist signups. If you join our waitlist, we store your email address, the page you joined from, the time, and the consent sentence shown beside the form. We send you one welcome email right away and, later, emails about our launch. Every one of those emails includes a one-click unsubscribe link, honored instantly.
• Site analytics, only if you allow it. Our cookie banner asks before anything that is not strictly necessary runs, with three equal choices: "Allow all", "Analytics only", and "Decline". Nothing loads until you choose. If you choose "Analytics only" or "Allow all", your browser stores a random identifier we generate, and each time you open one of our pages it sends us that identifier, the page's address without any query string, and the name of the website that linked you to us (the site name only, never the full link). We also record which version of the banner wording you agreed to, so we can show what you consented to. Our own page counter does not record your IP address, your browser or device details, or anything about other websites you visit, and no third party receives any of it. If you decline, or your browser sends a Global Privacy Control signal, we record nothing. If you allow analytics and also join the waitlist, we connect your page views to your signup so our launch emails can reflect what you were interested in.
• Third-party analytics and advertising tags, only if you allow them. On our marketing pages (the superboom.ai home and pricing pages, our Design Studio landing page, and the public pages of our merchant app before you sign in) we also use tags from Google, Meta, and TikTok, listed with links to their policies and controls under "Advertising and analytics partners" below. "Analytics only" loads Google Analytics with its advertising features turned off and loads no advertising tag. "Allow all" additionally loads Google Ads, the Meta pixel, and the TikTok pixel. These companies set their own cookies in your browser and receive your IP address, browser and device details, the page you are on and the site that referred you, any ad-click identifiers in the page address, and the cookie identifiers they set, and they use that information under their own privacy policies — to measure how our site and our ads perform, to attribute signups to ads, and (with "Allow all") to show you SuperBoom ads on their platforms and tailor them. Under California law, the advertising tags count as "sharing" personal information for cross-context behavioral advertising; you can opt out at any time under "Privacy choices", and a Global Privacy Control signal opts you out automatically. These tags never run on the pages where a merchant works with their store after signing in, on unsubscribe pages, inside the emails or texts merchants send through SuperBoom, or anywhere shopper data appears, and we never send them merchant account data or shopper data.

You can change your choice at any time from the "Privacy choices" link at the bottom of every page. Declining analytics after you had allowed it deletes the page views our own counter recorded from your browser and removes the identifier. Declining a third-party tag after you had allowed it stops that tag on your next page load and clears the cookies it set on our site; what the partner already received is governed by that partner's policy, and the links below let you exercise your rights with them directly.

Legal basis (for visitors in the EU, EEA, or UK). We rely on your consent for site analytics, for the third-party analytics and advertising tags described above, and for connecting your page views to your waitlist signup, and on your consent for waitlist emails. You can withdraw any of these at any time, as described above and in every email, without affecting anything done before you withdrew.

Your right to object to direct marketing. You can object at any time, free of charge, to our use of your information for direct marketing, including the use of your page views to decide which launch emails or offers to send you. Use the unsubscribe link in any email, choose "Decline" under "Privacy choices", or email support@superboom.ai. Once you object, we stop.

No significant automated decisions. Using page views to choose which launch email or offer you receive is the only automated decision we make about website visitors. It does not produce legal effects or anything similarly significant for you: everyone on the waitlist receives our launch emails, and the only difference is which email or offer you get.

How we use information

• To provide the service: connect to Shopify, build and send the automations a merchant configures, and generate the AI copy and creative involved (see "AI processing" below).
• To operate, secure, and improve the service: fraud and abuse prevention, deliverability and sender-reputation management, debugging, and product analytics on our own usage.
• To communicate with merchants about their account, billing, and service changes.
• To email people who joined our waitlist about our launch, and, for those who allowed site analytics, to decide which launch emails and offers are most relevant to them based on the pages of our site they viewed.
• To meet legal obligations, including the CAN-SPAM suppression obligations described under "Data retention" below.
• To create aggregated and de-identified data as described in "Aggregated and De-identified Data" below.

AI processing

SuperBoom uses a third-party AI model provider (Anthropic) to generate email copy and creative for merchants — at setup time for template automations, and, for behavioral messages, at the moment a merchant-configured trigger fires. The generation step receives store name, product titles and prices, brand-voice inputs the merchant provides or approves, and (for behavioral messages) non-identifying context about the triggering activity, such as the product a message is about — it never receives a shopper's name, email address, or other contact or identity data. Where a message needs personalization (like a shopper's first name), the model is given a literal placeholder token (for example, {{first_name}}), not the real value; our own systems fill that token in at send time, after the AI step is complete. Content submitted to our AI provider is used only to generate the requested output and, under our agreement with the provider, is not used to train the provider's models; SuperBoom likewise does not use merchant or shopper data — in identified, de-identified, or aggregated form — to train any AI or machine-learning model.

Aggregated and De-identified Data

Beyond the uses above, SuperBoom creates and uses aggregated and/or de-identified data derived from use of the service — including sending outcomes, engagement statistics, and commerce metadata — to produce anonymized cohort statistics we may show merchants as context for their own performance, and for improving and developing our services. We build this responsibly:

• De-identification is performed before any cross-merchant aggregation — we do not combine identifiable data from one merchant with data from any other merchant or source.
• Data used this way is de-identified so that it does not identify any merchant, their store, or any individual, and we will not attempt to re-identify it.
• We do not use this data — in identified, de-identified, aggregated, or derived form — to create, develop, train, fine-tune, or improve any machine-learning or artificial-intelligence model.
• Aggregates are produced only across a minimum cohort of multiple merchants, so no single merchant's specifics are discernible to anyone else, including other merchants.
• Raw tenant data is never shared between merchants.
• This right survives termination of a merchant's account for data already aggregated or de-identified before termination.

Subprocessors

We use the following subprocessors to provide the service. All processing described in this policy takes place in the United States.

We'll update this table if that list changes, and material changes are reflected in the "Changes to this policy" section below.

SuperBoom, Inc. is established in the United States and is not established in the European Economic Area or the United Kingdom. All data we process is stored and processed in the United States and is therefore subject to United States law, including lawful requests for access by United States courts and law-enforcement authorities. Merchants outside the United States — and merchants whose customers are located outside the United States — should take this into account in their own privacy disclosures.

Advertising and analytics partners

The companies below provide the third-party tags described under "From visitors to the SuperBoom website" above. They are not subprocessors: each one decides for itself how it uses what its tag collects, under its own privacy policy, and each runs on our marketing pages only after you allow it in our banner. We do not send them merchant account data or shopper data, and we do not upload email addresses or other identifiers — hashed or not — to any of them for audience matching or conversion matching. If that ever changes, we will update this policy first, and the change will apply only to data collected afterwards.

Each partner is located in the United States or processes this data there. We will update this table before adding a partner or a purpose.

How we share information

We share personal information only in these circumstances:

• With the subprocessors above, to operate the service, under written contracts that bind them to protections consistent with this policy.
• At a merchant's direction — for shopper data, the merchant controls the relationship, and we act on their instructions (including their data-export and deletion requests).
• For legal reasons: we may disclose information where we believe in good faith it is required by law, subpoena, or other legal process, or necessary to protect the rights, safety, or property of SuperBoom, our merchants, or others. Where the law allows, we will notify the affected merchant before disclosing shopper data in response to legal process.
• In a business transfer: if SuperBoom is involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction, subject to the commitments of this policy; we will notify merchants of any such transfer and of any successor's material changes to this policy.
• With our advertising and analytics partners, only with your consent: the tags described above share website-visitor information (cookie identifiers, IP address, device and browser details, pages viewed, and ad-click identifiers) with Google, Meta, and TikTok, on our marketing pages only, after you allow them in our banner.

We do not sell personal information. With your consent, the advertising tags on our marketing pages share website-visitor information with Google, Meta, and TikTok in a way California law counts as "sharing" for cross-context behavioral advertising; you can opt out at any time under "Privacy choices", and we honor Global Privacy Control signals as an opt-out. We never sell or share merchant account data or shopper data — see our Do Not Sell or Share page.

Data retention

Anonymous storefront events (behavioral events carrying only the pseudonymous browser identifier — no name, email, or customer ID) are automatically and permanently deleted within approximately 90 days of collection. Storefront events linked to an identified customer profile (at the deterministic identification moments described above) are automatically and permanently deleted within approximately 13 months of collection — a 12-month retention schedule enforced by month-partitioned deletion cycles — or earlier under the deletion flows described below. For everything else: we keep merchant account data and shopper data for as long as the merchant's account is active and the data is needed to provide the service; if a merchant uninstalls SuperBoom from their Shopify store, we delete the shopper data we hold for that store within 30 days of uninstall, and account deletion erases data promptly as described under "Your rights" below — in each case we retain nothing beyond the carve-outs listed here. Merchants can request deletion at any time (self-serve, in-app, or by emailing us). Deletion wipes profile records, event history, and engagement data. Website visitors: page views from visitors who allowed analytics but never joined the waitlist are deleted within approximately 90 days; every page view is deleted within approximately 13 months; and unsubscribing from our waitlist emails or declining analytics deletes that browser's page views immediately. Waitlist signups are kept until you unsubscribe or ask us to delete them, and after an unsubscribe we keep only the minimal suppression record described below. We retain three narrow categories after deletion, for specific, limited reasons:

• A keyed (HMAC) cryptographic hash of the deleted email address, computed under a secret key held outside the database and kept on our suppression list solely so that address is never emailed again. Retaining this minimal record is what makes an opt-out or deletion request effective — without it we could not reliably prevent a future send to that address — and it also satisfies our CAN-SPAM obligation not to re-contact suppressed recipients. The hash cannot be reversed to recover the original address and is not used for any other purpose.
• Billing and financial records, retained as required for tax and accounting purposes.
• An append-only compliance-receipt ledger recording that a request was made, its type, its dates, and its outcome — scrubbed of contact details.

Your rights

If you're a merchant

You have self-serve access to a full export of your data (JSON) and self-serve account deletion in-app. Deletion cancels billing first, then erases your data (subject to the retention carve-outs above). You can also reach us at support@superboom.ai for any privacy request. We acknowledge privacy requests within 10 business days and complete them within 45 calendar days; where a request is complex, we may take up to an additional 45 days (90 days total) and will tell you why before the first 45 days elapse.

If you're a shopper

If you received a marketing email from a store using SuperBoom, that store is the controller of your data — please contact the store directly first for access, correction, or deletion requests. If you're unable to reach the store, or if the store has closed, we also honor requests relayed through Shopify's built-in customer-redaction system (the customers/data_request, customers/redact, and shop/redact webhooks), and you may email support@superboom.ai and we will do what we can, including forwarding your request to the merchant.

Email marketing choices

We require every merchant to obtain explicit opt-in consent before sending marketing email — placing an order is never treated as marketing consent. Every marketing email supports one-click unsubscribe directly in your mail app (the standard header mechanism used by Gmail and Yahoo), and includes an unsubscribe link in its footer that asks for a single confirming click — no login and no account needed. The confirmation step exists only so automated link-scanners can't unsubscribe you by accident. Opt-outs are honored by our systems instantly and, in every case, within 2 days. When you unsubscribe from a merchant's marketing email or report one as spam, we also record that opt-out on your customer record in the merchant's own Shopify store, as a change to your email marketing consent there, so the store's own record agrees with your choice; we never change that record in the other direction. Addresses that hard-bounce or file a spam complaint are suppressed immediately and never contacted again; addresses that bounce repeatedly are suppressed after a small number of failures. Marketing email is only sent between 8am and 9pm in the recipient's local time (quiet hours). Every message we send is classified as either marketing or transactional, and consent rules apply to marketing messages; transactional messages (like order confirmations) are not marketing and don't require opt-in. If an unsubscribe link ever fails for you, email support@superboom.ai and we will suppress the address directly.

Email engagement tracking

Marketing emails sent through SuperBoom include a small, invisible open-tracking pixel and use tracked links to record clicks. When a recipient opens a marketing email or clicks a link in one, we record only the timestamp of that open or click and the message's internal message ID for the recipient it was sent to. We do not store the IP address, browser/device ("user agent") information, the specific link clicked, or any link tags associated with that open or click — even though the underlying email-delivery event momentarily carries that information, our systems discard it and persist only the timestamp and message ID. A click is also recorded as counting toward an open, since a link can only be clicked from an opened email.

We use this engagement data for two purposes: to avoid over-messaging a shopper (send-frequency pacing) and for attribution — understanding which messages and automations are working for a merchant. It is not used for advertising, is never sold or shared, and is not combined with data from outside SuperBoom.

Open/click data is retained under the same schedule as other storefront-linked event data described under "Data retention" above (deleted within approximately 13 months of collection, or earlier under the deletion flows described there). The most reliable way to stop this tracking for yourself is to unsubscribe from a merchant's marketing email — see "Email marketing choices" above; unopened and unclicked messages naturally record nothing.

SMS marketing

Where a merchant enables SuperBoom's text message (SMS) channel, we send SMS marketing messages only to that merchant's customers who have given SMS-specific marketing consent in the merchant's Shopify store, most commonly at checkout. SMS consent is tracked as its own state, entirely separate from email marketing consent — it is never inferred from a customer's email opt-in, and providing a phone number or placing an order is never itself treated as SMS marketing consent. We record where that consent came from alongside the consent itself. You can opt out of SMS at any time by replying STOP to any message we send; we honor that instantly, before sending anything further, and — the same as for email — retain a keyed (HMAC) cryptographic hash of the phone number afterward (see "Data retention") so it is never texted again even after other data about you is deleted. We also record your STOP on your customer record in the merchant's own Shopify store, as a change to your SMS marketing consent there, so the store's own record agrees with your choice; we never change that record in the other direction. Message frequency depends on the merchant's own automations and plan; SMS marketing messages are only sent between 10:00 a.m. and 8:00 p.m. in the recipient's local time Monday through Saturday, and between 12:00 p.m. and 8:00 p.m. on Sunday. Message and data rates from your wireless carrier may apply. We store phone numbers in standard E.164 international format, and — at this time — can only send SMS to phone numbers with a United States country code.

Security

We encrypt Shopify access and refresh tokens with AES-256-GCM, with encryption keys held in AWS KMS, separate from the encrypted data. Our database enforces row-level tenant isolation, both at the database layer and again at the application layer. Backups are encrypted, and data is encrypted in transit. We maintain separate development and production environments, and development environments never hold production credentials or tokens.

Cookies

We group cookies and browser storage into three categories. Strictly necessary — always on: signing in and keeping your session working in the merchant app, and remembering your privacy choice on every page. These need no consent. Analytics — only after you choose "Analytics only" or "Allow all": the random identifier for our own first-party page counter described under "From visitors to the SuperBoom website" above, and Google Analytics cookies (such as _ga) with Google's advertising features turned off. Advertising — only after you choose "Allow all": Google Ads (_gcl_*), Meta pixel (_fbp, _fbc), and TikTok pixel (_ttp) cookies, which measure our ads and let those platforms show you SuperBoom ads and tailor them. Analytics and advertising cookies are used only on our marketing pages — the superboom.ai home and pricing pages, our Design Studio landing page, and the public pages of the merchant app before you sign in. Once you sign in to the merchant app, only strictly necessary cookies are used; no analytics or advertising tag runs on any page that shows your store's data, on unsubscribe pages, or in any email or text sent through SuperBoom. We honor Global Privacy Control signals as a decline of both analytics and advertising. You can change your choice at any time from "Privacy choices" at the bottom of every page; declining clears the cookies in that category that were set on our site. The Shopify Web Pixel on merchants' storefronts is a separate mechanism, described under "Information we collect" above.

Children

SuperBoom is a business-to-business service directed at merchants, not at children. It is not directed to anyone under 16, and we do not knowingly collect personal information from children.

California residents

California residents have rights under the CCPA/CPRA to know, delete, and correct their personal information, and to opt out of sale/sharing. SuperBoom does not sell personal information. We do share personal information for cross-context behavioral advertising in one narrow case: when a visitor to our marketing pages chooses "Allow all" in our banner, the advertising tags described above share identifiers and internet-activity information (cookie identifiers, IP address, device and browser details, pages viewed, and ad-click identifiers) with Google, Meta, and TikTok. We began doing so on the effective date of this version of the policy and had not sold or shared personal information before then. You can opt out at any time by choosing "Analytics only" or "Decline" under "Privacy choices" at the bottom of every page, and we treat a Global Privacy Control signal from your browser as a valid opt-out. We never sell or share merchant account data or the shopper data we process for merchants, and we do not have actual knowledge that we sell or share the personal information of consumers under 16 years of age. See our full Do Not Sell or Share My Personal Information page for details and how to exercise these rights. You may use an authorized agent to submit a request on your behalf; we may ask the agent for proof of your signed permission and may ask you to verify your own identity or confirm the permission directly, and we do not require a power of attorney. The response timelines above apply where SuperBoom is the business for your data (merchant account data); for shopper data, the store you interacted with is the business, and we support their response as their service provider.

Changes to this policy

We may update this policy from time to time. If we make material changes, we'll update the effective date above and, where appropriate, notify merchants directly.

Contact

Questions, privacy requests, or anything else: support@superboom.ai.

By mail: SuperBoom, Inc., 2829 N San Fernando Rd, Ste 427, Los Angeles, CA 90065, USA.