Privacy Policy
The short version
Scroll Up Pro does not collect personal data from your shoppers. No cookies, no IP address storage, no customer records, no order data, and nothing Shopify classifies as protected customer data.
The only shopper-related information Scroll Up Pro records is a set of daily counters — how many times a button was shown, clicked, or used to load another page — grouped by page type and device category. Nothing in those counters can be traced back to a person.
From you, the merchant, we store what we need to run the app: your store domain, your Scroll Up Pro settings, and an access token issued by Shopify.
This policy explains what the Scroll Up Pro Shopify application ("Scroll Up Pro", "the app", "we", "us") collects, why, how long it is kept, and what rights you have. It applies to merchants who install Scroll Up Pro and to visitors to stores where Scroll Up Pro is active.
1. Who is responsible for your data
Scroll Up Pro ("we") is the data controller for merchant data processed through Scroll Up Pro.
| Entity | Scroll Up Pro |
|---|---|
| Address | Karnataka 560038, India |
| Contact | infinitescrolltotop@gmail.com |
Where Scroll Up Pro processes information on behalf of a merchant in connection with their store, we act as a data processor and the merchant is the controller.
2. Information we collect from merchants
When you install Scroll Up Pro, Shopify provides, and we store:
| Data | Why we need it |
|---|---|
Store domain (your-store.myshopify.com) |
To identify which store a set of settings belongs to |
| Shopify access token | To authenticate requests to Shopify's API on your behalf. Stored server-side and never exposed to a browser |
| Session details issued by Shopify | To keep you signed in to the embedded admin |
| Your Scroll Up Pro settings | Colours, position, visibility rules and similar configuration. This is the app's core function |
| Install and uninstall timestamps | To know whether the app is active and when to purge data |
Scroll Up Pro requests no Shopify access scopes. It cannot read your products, orders, customers, or any other store data, because it has never been granted permission to.
3. Information collected from store visitors
If you enable analytics (on by default, and switchable off at any time in the app under Advanced), Scroll Up Pro records four counters:
- how many times the button was displayed,
- how many times it was clicked,
- how many additional pages were loaded by infinite scroll,
- how many times the action dock was opened.
Each counter is grouped only by date (UTC), page
type (for example "collection"), and device category
(desktop, tablet or mobile). A stored record looks like:
2026-10-03 · collection · mobile · 412 shown · 37 clicked.
What is deliberately not collected
Scroll Up Pro does not set, read, or write any cookie. It does not use
localStorage, sessionStorage, fingerprinting, or any
other identifier. It does not log or store IP addresses. It does not record
individual sessions, user agents, referrers, screen recordings, mouse movement,
or page URLs. It does not read customer names, email addresses, cart contents,
or orders. It does not build profiles, and it does not track anyone across
pages, sessions, or sites.
Because no identifier is ever created, the records above are not personal data, and Scroll Up Pro has nothing it could hand over or erase in response to an individual shopper's request.
4. Protected customer data
Under Shopify's Protected Customer Data requirements, Scroll Up Pro:
- requests no access scopes, and therefore has no access to customer data at any level;
- processes no protected customer data, and so is not required to apply the additional protections that apply to apps that do;
- stores nothing that could be used to identify a customer.
5. How information is collected
Merchant data reaches us through Shopify's OAuth flow and through your use of the app's admin screens.
Analytics counters are sent from the storefront to an endpoint on your own
store's domain (/apps/scroll-up-pro/events) using Shopify's app proxy.
The request is same-origin from the shopper's point of view, is signed by
Shopify so the store identity cannot be forged, and carries only the event name,
page type and device category described above.
Your Scroll Up Pro settings are delivered to your storefront by Shopify itself, as part of the page, so your shoppers' browsers make no request to our servers to display the button.
6. Legal basis for processing (UK and EU GDPR)
| Purpose | Basis |
|---|---|
| Operating the app for a merchant who installed it | Performance of a contract — Article 6(1)(b) |
| Aggregate usage counters | Legitimate interests — Article 6(1)(f): understanding whether the product works. No personal data is involved, and the interest is balanced by the absence of any identifier |
| Security, fraud prevention and abuse monitoring | Legitimate interests — Article 6(1)(f) |
| Responding to a support request | Legitimate interests — Article 6(1)(f), or consent where you volunteered the information |
7. Sharing and sub-processors
We do not sell data, rent it, share it with advertisers, or use it to train machine learning models. We share it only with the service providers needed to run the app:
| Provider | Role | Location |
|---|---|---|
| Shopify Inc. | Platform; authentication; serves the storefront widget and your settings | Canada / global |
| Fly.io | Application hosting | Frankfurt, Germany |
| Neon | Database hosting | Frankfurt, Germany |
| Google (Gmail) | Support correspondence | United States and other Google regions |
We may also disclose information where we are legally required to, or to establish or defend a legal claim.
8. International transfers
Our providers may process data outside your country, including outside the UK and EEA. Where that happens, transfers are covered by the UK International Data Transfer Agreement, the EU Standard Contractual Clauses, or an adequacy decision, as applicable.
9. How long we keep it
| Data | Retention |
|---|---|
| Access token and sessions | Deleted immediately on uninstall |
| Store domain and settings | Kept while the app is installed; deleted within 48 hours of uninstall, when Shopify sends the shop/redact webhook |
| Analytics counters | Deleted together with the store record |
| Support correspondence | Up to 24 months, then deleted |
Reinstalling before the purge restores your settings. After it, you start fresh.
10. Security
- All traffic is encrypted in transit over TLS.
- Access tokens are held server-side only and are never sent to a browser.
- Every request from a merchant's admin is verified against a Shopify session token; every webhook is verified by HMAC signature; every app proxy request is verified against Shopify's signature.
- Settings submitted by a browser are re-validated and sanitised on our servers before being stored, so a malformed or malicious payload cannot reach your storefront.
- Access to production systems is limited to personnel who need it.
No system is perfectly secure. If a breach affects your data, we will notify you and the relevant supervisory authority as required by law, and without undue delay.
11. Your rights
Depending on where you live, you may have the right to access the data we hold about you, to correct it, to have it deleted, to restrict or object to its processing, to receive it in a portable format, and to withdraw consent where we rely on it. Residents of California may additionally request disclosure of the categories of information collected and may opt out of its sale — Scroll Up Pro does not sell personal information, and never has.
To exercise any of these, email infinitescrolltotop@gmail.com. We respond within 30 days. You may also delete everything yourself, at any time, by uninstalling the app.
If you are unhappy with our response you may complain to your local data protection authority. In the UK that is the Information Commissioner's Office (ico.org.uk).
Shopify's mandatory privacy webhooks
Scroll Up Pro implements all three webhooks Shopify requires:
| Webhook | What we do |
|---|---|
customers/data_request | We hold no data about any individual customer, so there is nothing to return. The request is acknowledged and logged. |
customers/redact | We hold no data about any individual customer, so there is nothing to erase. The request is acknowledged and logged. |
shop/redact | Everything we hold for the store — settings, sessions and analytics counters — is permanently deleted. |
12. Cookies and tracking
Scroll Up Pro sets no cookies on your storefront and uses no tracking technology of any kind. Nothing about Scroll Up Pro requires you to change your store's cookie banner or consent configuration.
The embedded admin, which only you see, relies on Shopify's own session mechanism to keep you signed in.
13. Children
Scroll Up Pro is a business tool sold to merchants and is not directed at children. We do not knowingly collect information from anyone under 16.
14. Changes to this policy
If we change this policy we will update the date at the top of the page. For changes that materially affect how we handle data, we will also notify merchants inside the app or by email before the change takes effect.
15. Contact
Questions about this policy or about your data: infinitescrolltotop@gmail.com.