Privacy Policy

BlackBox Software LLC ("BlackBox," "we," "us," or "our") builds Shopify apps for merchants. This Privacy Policy explains what each of our apps collects, how it is used, and your choices. It covers all BlackBox Software LLC apps listed on the Shopify App Store, including BlackBox Journey Attribution and BlackBox Trust Badges. Where an app differs, its own section says so.

Last updated: September 2026.

Who this applies to

This policy is for the Shopify merchants who install our apps. We do not sell consumer products and we do not build shopper profiles.

What every BlackBox app collects

When you install any of our apps, Shopify provides us with basic account information needed to run the app: your store domain and store name, the email address on your Shopify account, and an access token that lets the app talk to your store through Shopify's API. We use this only to operate the app, provide support, and send service messages about the app. We do not sell it.

BlackBox Trust Badges

Trust Badges displays payment icons and trust badges on your storefront. It is built to collect as little as possible.

No customer data. Trust Badges does not collect, store, or process any information about your shoppers. It sets no cookies, runs no pixel, and does no visitor tracking.

What we store: only the display settings you choose in the app (which badges to show, their wording, style, and placement). These are saved to your store as a Shopify app metafield and in our database so the app remembers your setup.

Payment method detection: with your permission, the app reads the list of payment methods your own store accepts, so it can show the right icons automatically. This is your store's own configuration, not shopper data.

On the storefront: the badges render through a Shopify theme extension. The storefront does not call our servers when a shopper loads a page, so the app adds nothing to your page speed and sees nothing about your visitors.

The only access the app requests is permission to serve content on an app-controlled path (used solely for the payment method detection above). It does not request access to customers, orders, or products.

BlackBox Journey Attribution

Attribution provides marketing attribution analytics for Shopify merchants. To do that, it processes more data than Trust Badges, but never customer PII.

Order data: order ID, revenue, currency, timestamp, status, and UTM parameters. We do not collect customer names, email addresses, shipping addresses, or payment details.

Visitor data: anonymous visitor identifiers, page views, referrer, UTM parameters, timestamps, and browser user agent, used to attribute a sale to the campaigns that led to it. This data is not tied to a named individual.

This data is used only to produce the attribution reports shown in your app dashboard.

Our marketing website (getblackbox.io)

This section is about our website, getblackbox.io, and is separate from the apps. When you browse our website, we and our tools collect standard analytics and advertising data to understand traffic and measure our own marketing. These tools include Google Tag Manager, Google Analytics, Google Ads, the Meta (Facebook) Pixel, Taboola, and the Reddit Pixel. You can manage your choices through the cookie banner on our site and our Cookie Policy. This website tracking does not run on your Shopify storefront and is not connected to either app. Our apps do not add any of these tools to your store.

Do Not Track

Some browsers offer a Do Not Track signal. There is no common industry standard for responding to it, so our website does not currently respond to Do Not Track signals. You can still manage tracking through our cookie banner.

How we store and protect data

Data is stored with our infrastructure providers (including Vercel and Supabase) and is protected in transit and at rest. Access is limited to what is needed to run the apps and provide support.

Data retention and deletion

We keep data only as long as you have the app installed, plus a short period for backups. When you uninstall an app, we honor Shopify's mandatory data deletion webhooks. You can also request deletion at any time by emailing us.

GDPR and CCPA

We support Shopify's mandatory data protection webhooks (customer data request, customer redact, shop redact). Because Trust Badges collects no customer data, a customer data request against it returns nothing. For applicable requests you can also contact us directly.

Your privacy rights

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal information, and to opt out of the sale or sharing of it. We do not sell your personal information. To exercise any right, email support@getblackbox.io. We will respond within the time required by applicable law and may need to verify your identity first. If you are in the EEA, UK, or a US state with a privacy law such as California under the CCPA and CPRA, those laws' rights apply to you.

Children's privacy

Our apps and website are intended for businesses, not children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us information, contact us and we will delete it.

Third parties

We do not sell your data. We use infrastructure providers to host and run the apps (see above). We do not share your data with advertisers, and our apps do not transfer one app's data into another.

Changes to this policy

We may update this policy as our apps change. The "last updated" date above reflects the current version.

Contact