Version 2026-10-11.
These terms govern customer data processed by Basharat Ali / PakisTech, operator of Offerwren, for merchants using Offerwren. The merchant determines the purposes of its customer processing. Offerwren processes data on the merchant's instructions, including configured offers, to select complementary post-purchase products and implement the buyer's explicit acceptance or refusal.
Processing includes signed checkout references, purchased product identifiers, currency and purchase subtotal, selected offer and variant, discount, session timestamps, subscription allowance and client-reported processing result. Offerwren does not request customer name, email, phone or address fields for offer selection and never collects payment-card details. Shopify processes payment. App authentication and merchant subscription data are processed to provide the service. No sale of customer data, advertising reuse or decisions with legal or similarly significant effects are permitted.
The operator will restrict access to authorized persons who need it to provide or support the service and are subject to confidentiality obligations; maintain HTTPS, encrypted storage and credentials, verified requests and tenant isolation; notify affected merchants without undue delay after becoming aware of a personal-data breach; and provide available information and reasonable assistance with investigation and remediation.
The merchant authorizes Cloudflare for hosting and database processing. Shopify provides authentication, store APIs, billing and checkout under its applicable terms. The operator remains responsible for delegated subprocessor obligations. Before adding or replacing a subprocessor, the operator will provide affected merchants at least 30 days' notice and an opportunity to raise reasonable data-protection objections or stop using the service. Processing may occur outside the merchant's country. Legally required transfer safeguards must be established before restricted transfers; these terms do not themselves constitute Standard Contractual Clauses.
The operator will reasonably assist with applicable access, correction, deletion and security requests, maintain necessary records, provide information reasonably needed to demonstrate these obligations and cooperate with proportionate confidential assessments. It will inform the merchant if an instruction appears to infringe applicable data-protection law. Checkout session records are retained for billing allowance enforcement for no longer than 40 days plus one hourly cleanup interval. Expired signed changeset payloads are removed during hourly cleanup. Merchant settings and encrypted sessions remain while installed. Uninstall or Shopify shop-erasure notifications remove app records; orders already created remain in Shopify under merchant control. Any legally required retention must be limited and protected.
The merchant is responsible for lawful instructions, customer notices and applicable consent. Buyers can decline an offer and are charged only through their explicit acceptance. An authorized merchant representative must accept the published terms in the authenticated app before enabling offers. Store, version and acceptance timestamp are retained while installed; material changes require renewed acceptance. These terms supplement the privacy policy and do not reduce mandatory rights. Contact: basharatoffice8@gmail.com.