Privacy policy

1. Introduction

Wiply M.E E-Commerce Ltd., together with its affiliates and subsidiaries (collectively, "Wiply," "we," "us," or "our"), is committed to protecting the privacy of individuals who interact with our B2B SaaS platform for gamified marketing experiences (the "Platform"). This Privacy Policy describes how we collect, use, share, and protect Personal Information when you visit our websites at wiply.com and platform.wiply.co (collectively, the "Website") or use the Platform.

As a B2B SaaS provider serving enterprise customers primarily in the European Union, the United States, and Israel, we operate in a multi-jurisdictional regulatory environment. We have designed our privacy practices to comply with applicable data protection laws, including:

• the EU General Data Protection Regulation (GDPR) 2016/679;
• the Israeli Privacy Protection Law, 5741-1981 and its regulations, including Amendment 13 (effective August 2025); and
• applicable U.S. state privacy laws, including the CCPA/CPRA, and similar statutes.

We are committed to providing transparent, user-centric privacy controls that reflect recognized standards of data protection and accountability that are appropriate for entities of our size and type.

Any capitalized terms not defined in this Privacy Policy have the meanings set forth in our Terms of Use. This Privacy Policy is incorporated into and forms part of those Terms. Nothing in this Privacy Policy creates a contractual obligation or private right of action beyond those required under applicable law.

We aim to respond promptly and within all legally required timeframes. For EU/EEA/UK residents, our EU representative details will be provided where required under GDPR Article 27. A list of our subprocessors is available upon request.

2. Scope and our role

We handle personal information in three primary contexts:

• Website visitors: We collect only limited technical and usage data.
• Platform account users (brands, agencies, B2B/B2C customers): We collect account creation, billing, contact, and support-related data strictly necessary to provide and administer the Services. Wiply acts as the data controller for this information.
• End users (people who play games or interact with campaigns built on the Platform): In the vast majority of cases, the Customer, not Wiply, determines the purpose, categories, and means of collecting any End User data (e.g., through custom forms, pixels, or tracking parameters embedded in games).

Wiply generally acts as a data processor (or service provider under U.S. law) for End User data processed on behalf of the Customer, following their instructions.

In such cases, Wiply acts as a Data Processor (GDPR) or Service Provider (U.S. laws), and the customer is the Data Controller or Business. Customers are responsible for providing required notices, establishing lawful bases, and ensuring their campaigns comply with applicable laws. If you are an end-user of a customer campaign, please refer to that customer's privacy policy.

Separately, Wiply acts as controller for limited technical, diagnostic, fraud-prevention, and security-related data required to host, monitor, and protect the Platform (such as IP-derived fraud signals and server performance logs).

3. Information we collect

3.1. Personal information you provide directly

When you interact with our Website or Platform, you may voluntarily provide:

• Identity & contact data: Full name, business name, email address, phone number, job title, country of residence
• Account data: Login credentials, subscription details, account preferences, admin settings
• Billing & payment data: Payment details handled via processors (e.g., Stripe); we store limited tokens only
• Communication data: Support tickets, feedback, inquiries, and correspondence
• Marketing & preference data: Newsletter subscriptions, opt-in/opt-out records
• AI interaction data: Prompts, queries, and feedback submitted to AI-powered features
• Recruitment data: Resume/CV, application materials, and related correspondence (job applicants)

3.2. Automatically collected information

When you visit our Website or use the Platform, we automatically collect:

• Technical data: IP address, device identifiers, browser type/version, operating system, language settings, time zone
• Usage data: Pages visited, features used, navigation paths, timestamps, referral/UTM sources, engagement metrics
• Performance & diagnostic data: Load times, errors, security event logs
• Gamification data: Campaign participation, game performance metrics, rewards earned, challenge completion.

3.3. End user / game interaction data (processed on behalf of customers)

For end users interacting with customer campaigns, we process on behalf of the Customer:

• Session duration, engagement events, and completion status;
• Campaign and referral metadata (QR code, link source);
• Technical identifiers for fraud prevention and abuse detection; and
• Optional Customer-enabled fields such as age range, gender, or location (which may constitute sensitive data in certain jurisdictions).

By default, we process only non-identifying, aggregated gameplay metrics. Customers may optionally activate additional data fields subject to their own legal compliance obligations.

3.4. Sensitive personal information

We do not intentionally collect sensitive categories of Personal Information (such as health data, biometric identifiers, genetic data, or precise geolocation) unless voluntarily provided by you or necessary for specific, disclosed purposes with your explicit consent.

How we treat combined data: If Non-Personal Information could reasonably be linked to your Personal Information, we treat that combined data as Personal Information and apply the same protections.

4. How we collect information

4.1. Automated collection

We automatically collect information through cookies, pixels, log files, SDKs, and similar technologies when you visit our Website or use the Platform. This includes browsing behavior, technical information, performance and diagnostic data, and gaming/campaign analytics. See Section 6 (Cookies and tracking technologies) for full details.

4.2. Voluntary submissions

We collect Personal Information you voluntarily provide when you:

• create an account or request a demo;
• subscribe to newsletters or marketing communications;
• register for webinars, reports, or other resources;
• contact us through email, chat, or support tickets;
• participate in events or training sessions;
• apply for employment or contractor opportunities; or
• interact with AI-powered Platform features.

4.3. Third-party sources

We may receive limited information about you from third-party sources such as Single Sign-On (SSO) providers (e.g., Google, LinkedIn) when you use these services to access the Platform. Your use of SSO is governed by the third-party provider's privacy policy.

5. How we use your information

We process Personal Information for the following specific purposes and on the corresponding legal bases:

6. Cookies and tracking technologies

Wiply uses cookies and similar tracking technologies (web beacons, pixels, local storage) to collect information about how you interact with our Platform and Website.

6.1. Categories of cookies

• Strictly necessary cookies: Essential for core Platform functionality including authentication, session management, security, and load balancing. Deployed on the basis of legitimate interests and contractual necessity. No consent required.
• Functional cookies: Enable enhanced features and personalization (language preferences, interface settings). May be set by Wiply or integrated third parties.
• Performance & analytics cookies: Collect aggregated, anonymized data on how users navigate the Platform to monitor performance, diagnose issues, and improve user experience. Require consent where mandated by law.
• Marketing & targeting cookies: Used to deliver relevant content and measure campaign effectiveness. May build interest-based profiles across platforms. Require explicit, informed consent where legally required (including under GDPR and applicable U.S. state laws).
• Third-party cookies: Set by third-party service providers (analytics platforms, hosting providers, integrated marketing tools). Wiply requires such providers to process data only as instructed and in compliance with applicable law.

6.2. Legal basis for cookie use

Strictly necessary cookies are processed on the basis of legitimate interests (GDPR Art. 6(1)(f)) and contractual necessity (Art. 6(1)(b)). All other cookie categories are processed only with your explicit consent (Art. 6(1)(a)), which you may provide or withdraw at any time. Withdrawal does not affect the lawfulness of prior processing.

For Wiply Games for Shopify, first-party browser storage used for display frequency and an active reward countdown is functional storage required to provide the storefront behavior selected by the merchant. The Shopify App also records limited aggregate service events without placing an analytics cookie or device identifier, as described in Section 21.5. A shopper's optional email marketing choice is separate from these functions. Any future non-essential analytics or targeting technology that processes Personal Information will be subject to the shopper's applicable Shopify Customer Privacy choices and consent where required.

6.3. Managing your cookie preferences

You may manage or disable cookies through your browser settings or our consent manager (where available). Note that disabling certain cookies may impair Platform functionality. Wiply honors Global Privacy Control (GPC) signals where required by applicable law.

Browser-specific cookie management:

• Google Chrome: support.google.com/chrome/answer/95647
• Firefox: support.mozilla.org/en-US/kb/clear-cookies-and-site-data-firefox
• Safari (Desktop/Mobile): support.apple.com/guide/safari
• Microsoft Edge: support.microsoft.com/en-us/microsoft-edge
• Opera: help.opera.com/en/latest/web-preferences/#cookies

Opt-out tools:

• Interest-based advertising (US): optout.aboutads.info
• EU residents: youronlinechoices.eu

6.4. Do not track

There is currently no uniform industry standard for responding to DNT signals. Wiply does not respond to all DNT signals but does honor GPC signals as described above.

7. Sharing and disclosure of information

We never sell Personal Information for monetary consideration. Any disclosure is limited to what is strictly necessary and subject to appropriate contractual, confidentiality, and security safeguards. Under certain U.S. state laws, limited disclosures associated with analytics or operational technologies may be characterized as a "sale" or "sharing"; where such laws apply, we comply with all applicable notice and opt-out requirements.

We may disclose Personal Information only in the following circumstances:

Non-Personal Information (aggregated or anonymized data) may be shared for analytics, research, or business purposes.

8. International data transfers

Wiply is headquartered in Israel. The Wiply platform, including Wiply Games for Shopify, runs on Cloudflare Workers and Cloudflare R2 and uses a managed PostgreSQL database provided by PlanetScale. The Shopify application's Worker placement is currently configured near Frankfurt, Germany. Shopify separately hosts and processes information kept in a merchant's Shopify store, including customer records, consent records, discounts, files, metafields, billing, and subscription information. These providers may process limited operational and support data in other countries under their applicable terms and data-transfer safeguards.

When Personal Information originating from the EU/EEA, UK, or Israel is transferred to countries not recognized as providing an adequate level of data protection, we implement appropriate safeguards, including:

• European Commission Standard Contractual Clauses (SCCs);
• Additional technical and organizational measures (encryption, access controls); and
• Transferring data only to jurisdictions recognized as providing adequate protection where possible.

We require all affiliates and service providers, regardless of location, to protect Personal Information to a standard at least equivalent to this Privacy Policy and applicable law.

9. Data retention, storage, and deletion

9.1. Retention principles

We retain Personal Information only for as long as reasonably necessary to fulfill the purposes outlined in this Policy, meet legal and regulatory obligations, resolve disputes, and support legitimate business operations (security monitoring, fraud prevention). Once Personal Information is no longer required, we securely delete or anonymize it in accordance with our data retention policies.

We apply a data minimization approach to retention, maintaining Personal Information only for the time needed to: deliver the Platform features and services you have requested or subscribed to; sustain our ongoing business relationship with you; satisfy legal, regulatory, tax, accounting, and audit requirements; resolve disputes, enforce our contractual agreements, and protect our legal rights; and support legitimate business operations, including security monitoring, incident response, and fraud prevention.

Our retention periods depend on the nature of the information collected and the specific purpose for which it was processed. Marketing and communications data, for example, is retained while you remain subscribed to our communications and for a reasonable period thereafter to honor opt-out requests and maintain suppression lists.

Website and Platform usage data, including analytical and technical logs, is typically retained for 12 to 24 months unless extended retention is necessary for security investigations or system integrity purposes.

Account, customer, and transaction data is retained throughout the duration of our business relationship and for applicable statutory limitation periods thereafter as required by law. Legal, compliance, and regulatory records are retained for the periods mandated by applicable laws, regulations, and supervisory authority guidance.

9.2. Storage

Personal Information is stored and processed in the EU (primarily AWS EU-Ireland), Israel, the United States (where permitted by law), and other locations where Wiply or authorized third-party service providers operate, including secure cloud environments.

9.3. Deletion and anonymization

When Personal Information is no longer required and there is no legal obligation to retain it, we take commercially reasonable steps to permanently delete it using secure deletion methods or anonymize it so it can no longer be linked to you. If you request deletion or withdraw consent, we will honor your request except where retention is necessary to:

• comply with legal, regulatory, or tax obligations;
• resolve disputes or enforce our Terms; or
• defend against legal claims or investigations.

In such cases, we retain only the minimum data necessary and restrict its use to those specific purposes.

10. Data security

We implement appropriate technical, organizational, and physical safeguards to protect Personal Information from unauthorized access, loss, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit and at rest;
• Secure user authentication and robust access controls;
• Regular security audits and vulnerability assessments;
• Strict internal policies and employee training on data handling; and
• Documented and tested incident response procedures.

In the event of a data breach or security incident, we have established response protocols to assess, contain, and remedy the situation and to notify affected individuals and regulatory authorities in accordance with applicable law (including GDPR, the Israeli Privacy Protection Law, and other relevant statutes). Despite these measures, no transmission or storage method is 100% secure. If you notice suspicious activity or security concerns, please contact us immediately at support@wiply.com.

11. Third-party service providers

Wiply engages third-party service providers to support our Platform, including providers for infrastructure hosting, data analytics, marketing communications, payment processing, security monitoring, and customer engagement tools. When selecting these partners we consider their security measures, privacy practices, and compliance with applicable law.

For Wiply Games for Shopify, the principal service providers are Shopify (commerce records, app distribution, and app billing), Cloudflare (application hosting, delivery, security, and object storage), and PlanetScale (managed PostgreSQL database hosting). The Shopify-specific practices and division of responsibility are described in Section 21.

All third-party providers are contractually obligated to:

• process Personal Information only in accordance with our documented instructions;
• process data only for lawful business purposes specified by Wiply;
• maintain data protection standards no less protective than applicable law requires; and
• maintain confidentiality and implement appropriate technical and organizational safeguards.

Wiply reserves audit and oversight rights over its providers to ensure ongoing compliance. A list of current subprocessors is available upon request.

12. AI and automated processing

We use artificial intelligence, machine learning, and automated tools to support and enhance the Platform. These technologies may be applied to:

• detect and respond to security incidents and fraudulent or abusive activity;
• identify patterns in technical logs and usage data;
• support product development, feature enhancement, and testing;
• personalize content, campaign recommendations, or communications;
• measure and analyze Platform and marketing campaign performance;
• optimize gamification mechanics and user engagement; and
• provide in-product guidance and customer support.

Where these tools process Personal Information, we limit processing to what is necessary and apply appropriate safeguards, including access controls, encryption, audit logging, and periodic review of system configurations.

No high-risk automated decision-making: We do not rely on solely automated decision-making, including profiling, that produces legal or similarly significant effects concerning you, unless permitted by applicable law, required consent has been obtained, and we have provided meaningful information and an opportunity to exercise your rights (including requesting human review). If any Platform feature involves an AI system, we will clearly disclose this at the point of interaction.

We commit to complying with emerging obligations under the EU AI Act (phased implementation from 2025–2026 onward) and similar frameworks as they become applicable.

13. Children's privacy

Wiply is a B2B platform designed for use by businesses and their authorized personnel. Our Platform and Services are not directed to, and are not intended for use by, children or minors. To access Wiply, you must be at least 18 years of age or the age of legal majority in your jurisdiction, whichever is greater.

Age restrictions under applicable laws:

• COPPA (U.S.): We do not knowingly collect Personal Information from children under 13.
• GDPR (EU/EEA): We do not knowingly collect Personal Information from individuals under 16 (or a lower age established by individual EU Member State law, provided such age is not below 13).
• Israeli law: We do not knowingly collect Personal Information from minors under 18 without verifiable parental or legal guardian consent where required.

Customers who create and publish campaigns bear sole responsibility for ensuring compliance with child-specific privacy laws (including COPPA, GDPR Article 8, and Israeli requirements), implementing appropriate age verification or parental consent mechanisms, and avoiding collection of child data without proper safeguards. If we become aware that a Customer is using the Platform to unlawfully process data from children, we reserve the right to immediately suspend or terminate the relevant campaign(s) and/or account.

If Wiply becomes aware that Personal Information has been collected from a minor in violation of applicable law or this Policy, we will promptly delete such information. If you are a parent or guardian and believe your child has provided Personal Information to Wiply, please contact us immediately at support@wiply.com.

14. Job candidates

When you submit a job application via our Website or authorized third-party platforms (such as LinkedIn), we collect your contact details, resume/CV, and any other materials you choose to provide ("Candidate Information"). Wiply uses Candidate Information solely for internal recruitment purposes, including identifying and evaluating qualified candidates, making hiring decisions, conducting permitted background checks, and communicating about job opportunities.

Retention: We may retain Candidate Information after a position is filled to consider you for future roles. If hired, we retain information for employment-related purposes. Candidate Information is treated as Personal Information subject to applicable data protection laws.

Your rights: Where applicable laws (including GDPR and Israeli Privacy Protection Law) grant you data subject rights, you may request access to, correction, or deletion of your Candidate Information by contacting us at support@wiply.com. Note that in certain circumstances, we may retain some information as required by law or to defend against legal claims.

15. Your privacy rights

Depending on your location and applicable law, you may have the following rights in relation to your Personal Information:

• Right to be informed: To receive clear information about how and why your Personal Information is collected and used.
• Right of access: To request confirmation of whether we process your Personal Information and to obtain a copy of it.
• Right to rectification: To request correction of inaccurate or incomplete Personal Information.
• Right to erasure ("right to be forgotten"): To request deletion in certain circumstances (e.g., data no longer necessary for its original purpose, or consent withdrawn).
• Right to restriction of processing: To request limitation of processing in certain circumstances.
• Right to data portability: To receive certain Personal Information in a structured, machine-readable format and transmit it to another controller.
• Right to object: To object to processing based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent: Where processing relies on consent, to withdraw it at any time without affecting the lawfulness of prior processing.
• Right to lodge a complaint: To submit a complaint to your competent data protection authority.

How to exercise your rights

Email us at support@wiply.com. We may verify your identity before processing your request. We respond within the timeframes required by applicable law (generally 30–45 days, with possible extensions). We will respond in accordance with legal requirements.

Authorized agents: Where permitted by law, you may designate an authorized agent to submit a request on your behalf. We may require verification of identity and confirmation of the agent's authority.

Appeals and complaints: If you believe a request has been improperly denied, you may submit an appeal by contacting us at support@wiply.com or lodge a complaint with your competent data protection authority.

16. Rights under U.S. state privacy laws

Residents of California, Virginia, Colorado, Connecticut, Utah, and other U.S. states with comprehensive privacy laws may have rights similar to those described above, subject to applicable statutory conditions, exceptions, and limitations. Depending on your state of residence, these rights may include:

• the right to confirm whether we process your Personal Information;
• the right to access your Personal Information;
• the right to request correction of inaccurate Personal Information;
• the right to request deletion of Personal Information, subject to applicable legal exceptions;
• the right to obtain a copy of certain Personal Information in a portable format, where required by law; and
• the right to opt out of certain processing activities, such as targeted advertising, the sale or statutory "sharing" of Personal Information, or profiling in furtherance of decisions that produce legal or similarly significant effects, as defined under applicable law.

The availability and scope of these rights may vary based on your jurisdiction and the nature of our processing activities.

California-specific terms (CCPA/CPRA)

Wiply does not sell Personal Information for monetary consideration and does not engage in cross-context behavioral advertising as defined under the California Consumer Privacy Act ("CCPA") and the California Privacy Rights Act ("CPRA").

For purposes of this section, the terms "personal information," "business purpose," "commercial purpose," "sale," "sharing," "service provider," and "sensitive personal information" have the meanings assigned to them under the CCPA and CPRA. In the event of any inconsistency between this section and other provisions of this Privacy Policy, this section governs with respect to California residents.

Subject to applicable conditions, exceptions, and verification requirements under California law, California residents may have the following rights:

• Right to know/access: Disclosure of categories and specific pieces of Personal Information collected, sources, business/commercial purposes, and categories of third parties to whom Personal Information is disclosed.
• Right to delete: The right to request deletion of Personal Information, subject to statutory exceptions that permit retention, including for legal compliance, security, and business operations.
• Right to correct: Correction of inaccurate Personal Information.
• Right to opt out of sale or sharing: Wiply does not sell or share Personal Information for such purposes. We honor valid opt-out signals including GPC.
• Right to limit use of sensitive personal information: Wiply does not use or disclose sensitive Personal Information except as permitted under the CPRA.
• Right to non-discrimination: You will not receive discriminatory treatment for exercising any rights under California privacy law.

We comply with enhanced auto-renewal subscription disclosure and easy cancellation requirements.

The availability and scope of these rights may vary based on your jurisdiction and the nature of our processing activities.

17. Israeli law compliance

In addition to our obligations under the GDPR, CCPA, and other applicable global privacy laws, we comply with the Israeli Privacy Protection Law, 5741-1981 (the "Israeli PPL") and applicable regulations, including the Privacy Protection Regulations (Data Security), 2017, and Amendment 13 (effective August 2025). These laws govern our approach to database security, access controls, and incident response.

Under the Israeli PPL and Amendment 13, Israeli residents have the following rights:

• Right to access: Request access to your Personal Information held in our databases and information about how we use it.
• Right to correction: Request correction of inaccurate or incomplete Personal Information.
• Right to deletion: Request deletion of your Personal Information in certain circumstances, subject to legal retention obligations.
• Right to object: Object to certain types of processing, including direct marketing.
• Right to withdraw consent: Withdraw consent at any time by contacting us at support@wiply.com (noting that withdrawal may limit certain services).

Databases

Where required under Amendment 13, we will maintain databases in connection with our business activities. To the extent mandated by Israeli law, these databases are managed in compliance with the Israeli PPL and applicable regulations, and are protected by appropriate technical and organizational safeguards, which may include:

• Role-based access controls restricting access to authorized personnel only
• Encryption of sensitive Personal Information in transit and at rest
• Regular security audits and vulnerability assessments
• Ongoing employee training on data security and privacy obligations
• Documented and tested incident response procedures

These databases may be used for purposes such as customer relationship management, customer support, marketing (where explicit consent is obtained), and recruitment.

You acknowledge that your Personal Information may be included in one or more databases registered in accordance with Israeli law and that you have been informed of the purposes for which the information is collected, used, and stored.

International transfers from Israel

When we transfer Personal Information from Israel to other jurisdictions, we implement measures to ensure compliance with the Israeli PPL. These measures may include transferring data only to jurisdictions recognized as providing an adequate level of protection, entering into appropriate contractual arrangements that include safeguards for the protection of Personal Information and obtaining your explicit, informed consent where required for transfers to jurisdictions without an adequacy determination. These steps help ensure that your Personal Information remains protected regardless of where it is processed.

If you are an Israeli resident and have concerns regarding your rights under Israeli privacy law, you may contact us at: support@wiply.com.

You may also contact the Israeli Privacy Protection Authority:

• https://www.gov.il/en/departments/privacy_protection
• https://www.gov.il/he/departments/privacy_protection

We may update this section from time to time to reflect changes in Israeli privacy law or our data protection practices. Material updates will be communicated in accordance with applicable legal requirements, and we encourage you to review this Privacy Policy periodically.

Where required under applicable law, including Amendment 13 to the Israeli PPL, we will have appointed a Data Protection Officer responsible for overseeing our data protection strategy, ensuring compliance with Israeli privacy requirements, and serving as the primary contact for data subjects and the Israeli Privacy Protection Authority.

How to exercise your rights

To exercise any rights available to you under applicable privacy laws, you may contact us at support@wiply.com. We may require additional information, as permitted by law, to verify your identity and process your request.

Limitations and exceptions

• Requests to access, delete, or otherwise restrict processing of Personal Information are subject to applicable legal conditions and exceptions.
• We may retain or continue to process Personal Information where permitted or required by law, including to comply with legal obligations, resolve disputes, enforce our agreements, or establish, exercise, or defend legal claims.
• Where a request cannot be fully honored, we will respond in accordance with applicable legal requirements.

Authorized agents

Where permitted by law, you may designate an authorized agent to submit a request on your behalf. We may require verification of your identity and confirmation of the agent's authority before processing such requests.

Appeals and complaints

If you believe a request has been improperly denied or restricted, you may submit an appeal or follow-up request by contacting us at support@wiply.com, subject to applicable law. You may also have the right to lodge a complaint with your competent data protection authority.

Response timing and fees

Requests are reviewed and responded to within the timeframes required by applicable law. Where permitted, response periods may be extended, and fees may be charged, or requests declined, if a request is manifestly unfounded, excessive, or repetitive.

18. Changes to this privacy policy

We may revise this Privacy Policy from time to time to reflect changes in our practices, technology, legal obligations, or service offerings. The updated version will be posted here with a revised "Last updated" date. Unless otherwise required by law, changes become effective as of that date.

For material changes that affect how we process your Personal Information, we will make reasonable efforts to notify account holders via email, in-app message, or prominent notice on the Website/Platform. We encourage you to review this Policy periodically. Continued use of the Website or Services after changes constitutes your acceptance of the updated Policy.

19. Governing law

Your statutory rights under applicable data protection and privacy laws are governed by the mandatory laws of your jurisdiction of residence and are not affected by this section.

To the extent permitted by applicable law, and solely with respect to the contractual interpretation and enforcement of this Privacy Policy (excluding statutory privacy rights), this Privacy Policy and any non-statutory claims arising out of or relating to it shall be governed by the laws of the State of Israel, without regard to its conflict of law principles. Subject to mandatory local law, any disputes arising out of or relating to this Privacy Policy shall be submitted to the exclusive jurisdiction of the competent courts of Tel Aviv, Israel.

20. Contact us

We strive to respond to all privacy-related inquiries within a reasonable timeframe and in accordance with applicable legal requirements.

For any questions about this Privacy Policy or our privacy practices, please contact us:

For Israeli privacy matters

Israeli Privacy Protection Authority: gov.il/en/departments/privacy_protection

For EU/EEA/UK residents

Wiply is not currently required to appoint an EU or UK representative under GDPR Article 27, based on the nature, scope, and risk profile of its processing activities. If and to the extent that applicable law requires Wiply to appoint an EU or UK representative in the future, Wiply will do so and update this Privacy Policy accordingly. In the meantime, EU, EEA, and UK residents may contact Wiply directly using the contact details above.

Thank you for trusting Wiply with your privacy. We value your feedback; if anything in this Policy is unclear or if you have suggestions, please reach out at support@wiply.com.

21. Wiply Games for Shopify

This section applies when a merchant installs or uses the Wiply Games app for Shopify (the "Shopify App"), and when a shopper interacts with a Wiply game on that merchant's Shopify storefront. If this section conflicts with a more general statement elsewhere in this Privacy Policy, this section controls for the Shopify App.

21.1. Our role and the merchant's role

For information about a merchant's Shopify store, app installation, account, and relationship with Wiply, Wiply acts as a controller. For shopper personal information processed to provide a merchant's games and rewards, the merchant is the controller or business and Wiply acts as its processor or service provider. The merchant decides which games to publish, whether to request shopper details, which optional form fields to display, and how it will use customer and marketing information stored in Shopify.

Shoppers should review the merchant's privacy policy as well as this Privacy Policy. Merchants are responsible for giving shoppers any additional notice and obtaining any consent required for their campaigns.

21.2. Merchant and store information

When a merchant installs or uses the Shopify App, Wiply processes:

• the store's myshopify.com domain, installation status, granted app scopes, Wiply workspace reference, subscription tier, and installation and update timestamps;
• an expiring Shopify Admin API access and refresh token, encrypted in Wiply's database, so the Shopify App can perform the actions the merchant requests;
• game and campaign drafts and published settings, including game content, reward rules, placement settings, text, tags, and Shopify-hosted file URLs; and
• aggregate campaign events and monthly play totals used to operate plan limits and show campaign reporting.

The Shopify App requests access to customers, discounts, files, and app-owned metaobjects only so it can create customer and reward records, manage discount codes, let merchants choose Shopify-hosted media, and publish games into the merchant's theme. It does not request access to or read Shopify orders, shipping addresses, payment card details, or order history.

21.3. Shopper information and rewards

When a merchant enables a reward form, a shopper provides an email address and may also provide a name and phone number. The form also contains a separate, optional email-marketing checkbox. Wiply transmits these fields through its application service to Shopify to create or update the merchant's Shopify customer record. Wiply does not persist the shopper's name, email address, or phone number in its own application database.

Shopify retains the customer record, any customer tags, the shopper's email marketing choice, customer reward marker, and Shopify discount record in the merchant's store. Wiply retains a limited reward-claim record containing:

• the store and campaign references;
• a keyed, one-way HMAC identifier derived from the Shopify customer reference or a short-lived play-session subject;
• the issued discount code, claim status, and relevant timestamps; and
• non-identifying event rows such as game started, form submitted, and coupon claimed.

The HMAC identifier is pseudonymous. Wiply uses it to enforce reward limits and prevent duplicate claims, and can associate it with a Shopify customer when Shopify supplies that customer's identifier for a privacy request. Wiply does not use shopper information for cross-store advertising, interest-based profiling, data brokerage, or training AI models.

For logged-in shoppers, Shopify can include the Shopify customer identifier in the signed app-proxy request. Wiply uses that identifier temporarily to bind a short-lived play session and allocate a customer-specific reward. Wiply does not retain the raw customer identifier in its application database.

21.4. What remains in Shopify and what Wiply stores

The merchant's Shopify store remains the system of record for customer contact details, email-marketing consent, customer tags, customer reward markers, discounts, files selected through Shopify's file picker, and app billing. Published picker records and storefront configuration are also synchronized to Shopify metafields or app-owned metaobjects so Shopify can render the theme extension.

Wiply stores the merchant's game configuration and the limited installation, usage, and reward-claim records described above. Shopper form fields pass through Wiply's service only long enough to complete the requested Shopify API operation and are not written to Wiply's application database.

Shopify manages app subscriptions and payment processing. Wiply receives the active subscription name, status, and resulting plan tier so it can provide the correct features and usage limits. Wiply does not receive or store a merchant's payment card number.

21.5. Storefront storage, analytics, and consent

The Shopify App's storefront extension does not set advertising or analytics cookies and does not install a Shopify Web Pixel. It uses first-party browser storage for the functions selected by the merchant:

• a game identifier and a timestamp, or a session marker, to apply "once per session" or "once per day" display frequency; and
• an issued discount code, campaign identifier, expiry time, display color, and text direction to show an active reward countdown and remove the applied cart discount after expiry.

The session marker lasts for the browser session. Daily-frequency and reward countdown entries remain until the Shopify App overwrites or removes them when it next runs, or until the shopper clears the browser's storage. These entries are used only to provide the storefront feature and are not used to recognize the shopper across stores or build an advertising profile.

Wiply records aggregate first-party service events—game started, form submitted, and coupon claimed—by store and campaign. These records do not contain the shopper's name, email address, phone number, cookie identifier, device identifier, or raw Shopify customer identifier. Wiply uses them to enforce plan limits, prevent abuse, operate the service, and provide aggregate campaign reporting to the merchant. Network and security providers may also process ordinary request information such as an IP address and browser user agent as described in Sections 3.2, 5, 7, 9, and 10.

The optional marketing checkbox controls only whether the shopper asks the merchant to subscribe the Shopify customer record to email marketing. Leaving it unchecked does not unsubscribe an existing Shopify customer. It is separate from functional browser storage and from the operational, aggregate service events described above. If Wiply later introduces non-essential analytics, targeting technologies, or a Web Pixel that processes Personal Information, Wiply will respect the shopper's applicable Shopify Customer Privacy choices and obtain consent where required before that processing begins.

21.6. Retention, uninstall, and deletion

While the Shopify App remains installed, Wiply keeps store, campaign, usage, and reward-claim records for as long as needed to provide the service and maintain campaign and reward integrity. Aggregate campaign event rows and monthly totals are retained for the life of the installation unless the merchant asks Wiply to delete them earlier and no legal obligation requires retention.

When a merchant uninstalls the Shopify App, Wiply immediately deletes the store's Shopify API sessions and access credentials and marks the installation as uninstalled. Shopify ordinarily sends the mandatory "shop/redact" request 48 hours after uninstall. On receipt, Wiply deletes the remaining Shopify-linked session, reward-claim, usage, conversion, installation-mapping, and Shopify game-configuration records. Wiply de-identifies and archives the associated workspace and removes its games from active service. Limited records may be retained only when required by law, to resolve a dispute, or to protect the service, and are then restricted to that purpose. Provider backups age out under the applicable backup-retention schedules.

When Shopify sends a verified "customers/redact" request, Wiply uses the Shopify customer identifier supplied in that request to locate and delete the customer's pseudonymous Wiply reward-claim records. The customer's Shopify record, consent, metafields, and discounts are controlled by the merchant and Shopify.

21.7. Access, correction, and deletion requests

Shoppers should first contact the merchant whose game they used. The merchant can access, correct, export, or delete the customer's information held in Shopify and can submit Shopify's privacy requests to installed apps. Wiply responds to Shopify's mandatory "customers/data_request", "customers/redact", and "shop/redact" webhooks and will assist the merchant with the limited pseudonymous claim information Wiply retains.

Merchants may request access to, correction of, or deletion of their Shopify App information by emailing support@wiply.com. Please include the myshopify.com store domain and enough information for Wiply to verify the request. Wiply will respond within the timeframe required by applicable law.

21.8. Service providers and international processing

The principal providers used for the Shopify App are:

• Shopify, which operates the commerce platform, stores Shopify customer, discount, file, metafield, and consent records, distributes the app, and manages app subscriptions and billing;
• Cloudflare, which provides application hosting through Workers, delivery, security services, and object storage through R2; and
• PlanetScale, which provides the managed PostgreSQL database used for Wiply's encrypted installation records and the limited campaign, usage, and reward records described in this section.

Wiply's Shopify Worker placement is currently configured near Frankfurt, Germany. Because Wiply is established in Israel and these providers operate globally, information may be processed from Israel and other countries where Wiply or its providers operate. Wiply uses the transfer safeguards described in Section 8 where required by applicable law.

21.9. Security

Wiply protects the Shopify App with HTTPS/TLS, encryption at rest, AES-256-GCM encryption for Shopify Admin API sessions and tokens using a dedicated key, access controls, signed and purpose-limited storefront play sessions, verification of Shopify app-proxy signatures, and HMAC verification of Shopify webhooks. Production access is restricted to authorized personnel.

Questions or privacy requests about Wiply Games for Shopify may be sent to support@wiply.com or to the postal address in Section 20.