Rich Quantity Breaks

Effective date: 1 August 2026 Last updated: 1 August 2026

1. Who we are

Rich Quantity Breaks (“the App”) is a Shopify app built and operated by North JS Tech (“we”, “us”).

The App has two parts:

• An embedded admin interface inside the Shopify admin, where a merchant builds quantity-break, bundle, upsell, and gift offers.
• A storefront widget, delivered as a Shopify Theme App Extension, that displays those offers to shoppers on the merchant’s storefront.

Roles. For data about the merchant and their staff, we act as a data controller. For data about the merchant’s storefront visitors and customers, the merchant is the controller and we act as a processor on their behalf. Shoppers with questions about how a particular store uses their data should contact that store directly.

2. Data we collect from merchants

When a merchant installs the App, we store the following in our own PostgreSQL database:

Authentication and session data Shopify shop domain, API access token, refresh token and its expiry, granted scopes, session expiry, and a Shopify Storefront API access token. Where Shopify issues an online session, we also store the staff member’s Shopify user ID, first name, last name, email address, email-verified flag, account-owner flag, collaborator flag, and locale. These fields come from Shopify’s session payload and are used to authenticate requests and to display who is signed in.

Store record, shop domain, store name, install status, store-level settings, IANA timezone, and the IDs of the discount functions the App creates in the store.

Offer configuration, everything the merchant builds in the admin: offer and bar structure, discount values, merchant-written headings and labels, colours and styling, translations, countdown timer settings, and image URLs.

Offer configuration references products, variants, collections, and markets only by their Shopify global ID. We do not copy the merchant’s product catalogue into our database, product titles, prices, images, and inventory are fetched live from Shopify’s API each time they are needed and are not retained.

Permissions we request

The App requests the following Shopify access scopes:

ScopeWhy we need itread_products, write_productsRead product and variant data to build and render offers; write is used for offer-related product and metafield updates.read_discounts, write_discountsCreate and maintain the discount functions that apply quantity-break and offer pricing at checkout.read_ordersReceive the orders/paid webhook so merchants can see which orders came from an offer.read_files, write_filesUpload shopper-submitted personalisation files into the merchant’s own Shopify Files library and read them back.read_publications, write_publicationsDetermine and manage which sales channels offer products are published to.read_themesDetect the merchant’s theme so the widget can integrate with it correctly.read_localesSupport multi-language storefronts and offer translations.read_marketsApply the right currency and market-specific pricing.unauthenticated_read_product_listings, unauthenticated_read_product_inventoryLet the storefront widget read published product and inventory data as a shopper would.

3. Data we collect from storefront visitors

The storefront widget collects a small, pseudonymous set of interaction data so merchants can measure whether their offers work.

Visitor ID. The first time the widget runs in a browser, it generates a random identifier (a UUID) and stores it in that browser. This identifier is not derived from any personal information and is not linked to a name, email address, or Shopify customer account by us.

Events. We record four event types, each tagged with the visitor ID, the offer ID, and where applicable the selected bar ID:

EventWhen it fireswidget_viewThe offer widget is displayed (recorded at most once per offer per browser session).bar_selectThe shopper selects a quantity-break or offer tier.cart_addAn offer item is added to the cart.purchaseAn order containing an offer item is paid for (recorded server-side, see section 5).

For purchase events we additionally store the order revenue and discount amount, in cents, and the Shopify order ID.

What we do not collect. We do not collect or store shopper names, email addresses, phone numbers, postal addresses, payment details, IP addresses, user-agent strings, referrer URLs, or the pages a shopper browses. We do not build cross-site profiles, and the visitor ID is scoped to a single storefront domain, it cannot be used to track a shopper across different merchants’ stores.

4. Cookies and browser storage

The widget writes the following to the shopper’s browser. All are first-party to the merchant’s storefront domain.

NameTypeLifetimePurpose_rqb_vidCookie2 years (SameSite=Lax)Stores the pseudonymous visitor ID so offer views and conversions can be attributed._rqb_visitor_idlocalStorageUntil clearedMirror of the visitor ID, used when cookies are unavailable._rqb_analytics_viewed_<offerId>sessionStorageCurrent browser tab sessionPrevents the same offer view from being counted repeatedly.rqb-timer-session-<offerId>localStorageUntil clearedStores when a per-visitor countdown timer started, so it resumes correctly.

The widget also reads Shopify’s own cart_currency and localization cookies to detect the shopper’s market and currency. It does not create or modify them.

A shopper can clear these at any time through their browser settings. Clearing them resets the visitor ID; the widget will still work, but repeat visits will be counted as new visitors.

5. Order data

When an order is paid, Shopify sends us an orders/paid webhook. From that payload we read the order ID, total price, currency, and line items, including each line’s price, quantity, discount, and the hidden properties the widget attached (_rqb_offer_id, _rqb_bar_id, _rqb_visitor_id, _rqb_role, _rqb_bundle_id).

We use these to record a purchase event and calculate offer revenue.

The order payload also contains customer name, email address, and shipping and billing addresses. We do not store any of it. Those fields are ignored during processing; the only order information written to our database is the order ID, the revenue and discount amounts, and the offer identifiers listed above.

6. Cart line-item properties and personalisation

To attribute conversions, the widget attaches hidden properties (_rqb_offer_id, _rqb_visitor_id, _rqb_bar_id, _rqb_bundle_id, _rqb_role) to cart lines. These travel with the order inside Shopify and are visible to the merchant.

If a merchant enables product personalisation fields, anything a shopper types into them (text, dates, selections, and similar) is attached to the cart line as a standard, customer-visible line-item property. This content is stored in the merchant’s Shopify order, not in our database.

If a personalisation field accepts file uploads, the file is sent to our server, which immediately forwards it to the merchant’s own Shopify Files library (maximum 20 MB) and returns the resulting Shopify CDN URL. We do not retain a copy of the file.

7. How we use data

We use the data described above only to:

• render offers correctly on the storefront and apply the right discounts;
• attribute cart additions and purchases to the offers that produced them;
• show merchants analytics about their own store’s offer performance;
• operate, secure, debug, and support the App.

We do not sell data, share it with advertising networks or data brokers, use it for advertising or profiling, or use it to train machine-learning models. We do not combine data across merchants for any purpose other than aggregate, non-identifying operational metrics.

8. Who we share data with

We use a small number of sub-processors:

ProviderRoleShopifySource of all store data; hosts the merchant’s admin, storefront, uploaded files, CDN assets, and the discount functions the App creates.Linode (Akamai)Hosts the App server and its PostgreSQL database.GitHub (Container Registry, Actions)Stores and builds our deployment images. Contains application code only, not customer data.

We do not use any third-party analytics, advertising, error-tracking, or email service. There is no Google Analytics, Segment, Mixpanel, PostHog, Sentry, or comparable tool in the App or the storefront widget.

Server logs. Our reverse proxy keeps HTTP access logs for 30 days. Client IP addresses in those logs are masked (truncated) before they are written, and authentication parameters are redacted. These logs are used for security and debugging only.

We may also disclose data where required by law, or to protect our rights, safety, or the integrity of the service.

9. Data retention and deletion

Sessions. When a merchant uninstalls the App, Shopify sends an app/uninstalled webhook and we delete that store’s session records, including the access tokens and any staff name and email held in them.

Configuration and analytics. Offer configuration and analytics events are retained after uninstall so that a merchant who reinstalls does not lose their work. We do not currently run an automatic purge or apply a fixed retention window to this data.

Requesting deletion. A merchant can ask us to permanently delete all data associated with their store, configuration, analytics events, and aggregates, by emailing support@northjstech.com from an address associated with the store. We handle these requests manually and will confirm once the deletion is complete. We aim to respond within 30 days.

We describe our retention practice as it currently stands rather than promising automation we do not yet run.

10. Your rights

Depending on where you are located, you may have the right to access, correct, export, restrict, or delete your personal data, to object to processing, and to lodge a complaint with your local data protection authority.

• Merchants can exercise these rights by emailing support@northjstech.com.
• Shoppers should contact the store they interacted with, since that merchant controls the data. If a merchant passes a request to us, we will act on their instructions. Shoppers may also contact us directly at support@northjstech.com; note that because we hold only a random visitor ID and no identifying details, we may need the visitor ID from the shopper’s browser (cookie _rqb_vid) to locate any records.

11. Security

• Access tokens and all application data are stored in a PostgreSQL database that is not exposed to the public internet; it is reachable only over a private container network on our host.
• All traffic to the App is served over HTTPS with TLS certificates managed automatically by our reverse proxy.
• Sessions are stored server-side in the database rather than in signed browser cookies.
• Requests from the Shopify admin are verified via Shopify’s session token authentication, webhooks are verified by HMAC signature, and storefront proxy requests are verified against Shopify’s app-proxy signature.
• Access to production infrastructure is limited to authorised personnel.

No system is perfectly secure, and we cannot guarantee absolute security. If we become aware of a breach affecting merchant or shopper data, we will notify affected merchants and the relevant authorities as required by law.

12. International transfers

Our infrastructure is operated on servers that may be located outside your country, including outside the European Economic Area and the United Kingdom. Where personal data is transferred internationally, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses. Shopify’s own transfer safeguards apply to data held within Shopify.

13. Children

The App is a business tool sold to merchants and is not directed at children. We do not knowingly collect personal data from anyone under 16.

14. Changes to this policy

We may update this policy as the App changes. When we do, we will revise the “Last updated” date above. Material changes affecting how merchant or shopper data is handled will be communicated to installed merchants.

15. Contact

North JS Tech Email: support@northjstech.com

For privacy questions, data deletion requests, or any concern about how the App handles data, email support@northjstech.com.