Privacy Policy

Effective August 1, 2026

Who we are, and our two roles

SuperBoom, Inc. ("SuperBoom," "we," "us") operates SuperBoom, an email marketing automation service for Shopify merchants. We play two different roles depending on whose data we're handling, and this policy is organized around that split:

• Merchant account data. When we hold information about you as a SuperBoom customer — your account, your store, your billing — we are the business making decisions about that data (a "controller" in privacy terminology).
• Shopper data processed on a merchant's behalf. When a merchant connects their Shopify store to SuperBoom, we receive information about that merchant's customers (shoppers) so we can send the marketing emails the merchant has configured. For that data, the merchant is the controller/business, and SuperBoom acts only as their service provider/processor, following the merchant's instructions.

Information we collect

From merchants (SuperBoom account data)

• Account information: your email address and sign-in credentials (a password, stored only as a secure hash by our authentication provider, or Google sign-in).
• Store information: Shopify shop domain, store name, and the Shopify OAuth access/refresh tokens needed to connect to your store (stored encrypted).
• Subscription and billing state: your plan, trial status, and payment status. Payments themselves are processed by our payment processors (such as Stripe) or, where applicable, through Shopify's own billing system — SuperBoom never holds your full card number.
• Support communications you send us.

From merchants' Shopify stores, on their behalf (shopper data)

Once a merchant connects their store, we receive and process, strictly to run the automations that merchant configures:

• Shopper contact and identity information: email address, first/last name, and the shopper's Shopify customer ID.
• Marketing consent state (whether a shopper has opted in to marketing email) and resolved timezone.
• Commerce events: cart activity, checkout/order events, and order history.
• Storefront behavioral events, collected through a Shopify Web Pixel installed on the merchant's storefront: standard commerce events such as pages, products, and collections viewed, searches, and cart and checkout activity, keyed by Shopify's pseudonymous browser identifier (its "clientId") — not by name or email. Collection is gated by Shopify's customer-privacy framework: in regions requiring consent, the pixel does not run for visitors who haven't consented. Events from visitors we haven't identified are kept anonymous and are automatically deleted after at most 90 days. We connect a visitor's recent browsing history to their customer profile only at deterministic identification moments — checkout, login, or a consented email capture — and never use probabilistic or cross-device matching.
• Engagement traits we derive from that history and from message activity — for example order count, total spent, and last email open/click — so automations can be timed and targeted sensibly.

We do not supplement this with third-party data enrichment, ever, and we never purchase, rent, or scrape email lists or other data. Every shopper record we hold originates from the merchant's own Shopify store.

How we use information

• To provide the service: connect to Shopify, build and send the automations a merchant configures, and generate the AI copy and creative involved (see "AI processing" below).
• To operate, secure, and improve the service: fraud and abuse prevention, deliverability and sender-reputation management, debugging, and product analytics on our own usage.
• To communicate with merchants about their account, billing, and service changes.
• To meet legal obligations, including the CAN-SPAM suppression obligations described under "Data retention" below.
• To create aggregated and de-identified data as described in "Aggregated and De-identified Data" below.

AI processing

SuperBoom uses a third-party AI model provider (Anthropic) to generate email copy and creative for merchants — at setup time for template automations, and, for behavioral messages, at the moment a merchant-configured trigger fires. The generation step receives store name, product titles and prices, brand-voice inputs the merchant provides or approves, and (for behavioral messages) non-identifying context about the triggering activity, such as the product a message is about — it never receives a shopper's name, email address, or other contact or identity data. Where a message needs personalization (like a shopper's first name), the model is given a literal placeholder token (for example, {{first_name}}), not the real value; our own systems fill that token in at send time, after the AI step is complete.

Aggregated and De-identified Data

Beyond the uses above, SuperBoom creates and uses aggregated and/or de-identified data derived from use of the service — including sending outcomes, engagement statistics, and commerce metadata — for benchmarking, and for improving and developing our services. We build this responsibly:

• Data used this way is de-identified so that it does not identify any merchant, their store, or any individual, and we will not attempt to re-identify it.
• Aggregates are produced only across a minimum cohort of multiple merchants, so no single merchant's specifics are discernible to anyone else, including other merchants.
• Raw tenant data is never shared between merchants.
• This right survives termination of a merchant's account for data already aggregated or de-identified before termination.

Subprocessors

We use the following subprocessors to provide the service. All processing described in this policy takes place in the United States.

We'll update this table if that list changes, and material changes are reflected in the "Changes to this policy" section below.

Data retention

Anonymous storefront events (behavioral events carrying only the pseudonymous browser identifier — no name, email, or customer ID) are automatically and permanently deleted on a rolling 90-day schedule, enforced by an hourly job. Storefront events linked to an identified customer profile (at the deterministic identification moments described above) are automatically and permanently deleted within approximately 13 months of collection — a 12-month retention schedule enforced by month-partitioned deletion cycles — or earlier under the deletion flows described below. For everything else: we keep merchant account data and shopper data for as long as the merchant's account is active and the data is needed to provide the service. Merchants can request deletion at any time (self-serve, in-app, or by emailing us). Deletion wipes profile records, event history, and engagement data. We retain three narrow categories after deletion, for specific, limited reasons:

• A salted cryptographic hash of the deleted email address, kept on our suppression list solely so that address is never emailed again — this satisfies our CAN-SPAM obligation not to re-contact suppressed recipients. The hash cannot be reversed to recover the original address and is not used for any other purpose.
• Billing and financial records, retained as required for tax and accounting purposes.
• An append-only compliance-receipt ledger recording that a request was made, its type, its dates, and its outcome — scrubbed of contact details.

Your rights

If you're a merchant

You have self-serve access to a full export of your data (JSON) and self-serve account deletion in-app. Deletion cancels billing first, then erases your data (subject to the retention carve-outs above). You can also reach us at support@superboom.ai for any privacy request. We acknowledge privacy requests within 10 business days and complete them within 45 calendar days.

If you're a shopper

If you received a marketing email from a store using SuperBoom, that store is the controller of your data — please contact the store directly first for access, correction, or deletion requests. If you're unable to reach the store, or if the store has closed, we also honor requests relayed through Shopify's built-in customer-redaction system (the customers/data_request, customers/redact, and shop/redact webhooks), and you may email support@superboom.ai and we will do what we can, including forwarding your request to the merchant.

Email marketing choices

We require every merchant to obtain explicit opt-in consent before sending marketing email — placing an order is never treated as marketing consent. Every marketing email includes a one-click unsubscribe link. Opt-outs are honored by our systems instantly and, in every case, within 2 days. Addresses that bounce or file a spam complaint are suppressed automatically and never contacted again. Marketing email is only sent between 8am and 9pm in the recipient's local time (quiet hours). Every message we send is classified as either marketing or transactional, and consent rules apply to marketing messages; transactional messages (like order confirmations) are not marketing and don't require opt-in.

Security

We encrypt Shopify access and refresh tokens with AES-256-GCM, with encryption keys held in AWS KMS, separate from the encrypted data. Our database enforces row-level tenant isolation, both at the database layer and again at the application layer. Backups are encrypted, and data is encrypted in transit. We maintain separate development and production environments, and development environments never hold production credentials or tokens.

Children

SuperBoom is a business-to-business service directed at merchants, not at children. It is not directed to anyone under 16, and we do not knowingly collect personal information from children.

California residents

California residents have rights under the CCPA/CPRA to know, delete, and correct their personal information, and to opt out of sale/sharing. SuperBoom does not sell personal information and does not share it for cross-context behavioral advertising. See our full Do Not Sell or Share My Personal Information page for details and how to exercise these rights.

Changes to this policy

We may update this policy from time to time. If we make material changes, we'll update the effective date above and, where appropriate, notify merchants directly.

Contact

Questions, privacy requests, or anything else: support@superboom.ai.