Perkbase

Privacy Policy

Last updated: 4 November 2026

This Privacy Policy explains how Cultmetrics Oy (“Cultmetrics”, “we”, “us”) handles personal data in connection with Perkbase (the “App”), a gamified activation tool for Shopify and WooCommerce merchants that runs prize wheels and similar promotions and can issue discount codes to participants.

1. Our role: controller and processor

Data protection roles depend on whose data is involved:

• Merchant account data. For data about the merchants who install and use the App (store owners and their staff), Cultmetrics acts as the data controller.
• Shoppers’ data collected through activations. When a shopper interacts with an activation on a merchant’s storefront, the merchant is the data controller and Cultmetrics acts as a data processor handling that data on the merchant’s behalf and under their instructions.

2. Data we collect

From merchants

• Store identifier (myshopify.com domain) and Shopify store details returned during installation.
• Account and user details: name and email address used to access the admin.
• OAuth access tokens issued by Shopify, stored encrypted, used only to call the Shopify APIs the merchant authorized.
• For WooCommerce stores: the store URL, store name, admin email and currency sent by the Perkbase plugin when connecting, and the WooCommerce REST API keys the merchant approves, stored encrypted and used only to create winner coupons and register the order webhook.
• Order details needed for revenue attribution: order number, total, currency and the discount codes used (no customer names or addresses).
• For paid plans billed through Stripe (WooCommerce): billing name, email, address, VAT number and subscription status. Card details are entered on Stripe’s pages and never reach us.
• Configuration you enter: activation designs, prizes, copy, branding, and plan/billing status.

From shoppers (end customers) participating in an activation

Data	Why it is processed
Email address (only if the shopper provides it)	To deliver a prize/discount, and — where the shopper opts in — to record marketing consent for the merchant.
Name and email of a shopper signed in to the store	When a shopper is signed in to the merchant’s store, the store passes their first name and email to the activation so they don’t have to type them again.
Marketing opt-in status	To record and, with the merchant’s Shopify scopes, sync the shopper’s marketing consent to the store.
Participation records	Plays, prize won, and any generated discount code, so the merchant can run and analyze the promotion.
Attributed order data	Where a shopper uses a discount code from an activation, the resulting order’s reference and value, so the merchant can measure the activation’s revenue and ROI.
IP address and browser user-agent	Abuse prevention, rate limiting, and basic fraud protection for the activation.

From visitors to our website

• Email address you give in the “send the setup link” form: to send you the link and to ask later how the trial is going. It is stored in our customer register (HubSpot); you can ask us to delete it at any time.
• Page views and visit sources, counted with our own Matomo (matomo.cultmetrics.com) in cookieless mode: no cookies or local storage, and IP addresses are shortened.
• Only with your consent in the cookie banner: Google Analytics 4 and HubSpot (Statistics), and the Meta Pixel and Meta Conversions API (Marketing).

The App does not knowingly collect payment card details, government identifiers, or special-category personal data.

3. How we use data

• To provide, operate, and secure the App and its activations.
• To generate and manage discount codes for winning participants.
• To record marketing consent and, when authorized, sync it to the merchant’s Shopify store.
• To produce activation analytics (for example participation and prize breakdowns) for the merchant.
• To prevent abuse and to comply with legal obligations.

We do not sell personal data, and we do not use shopper data to build cross-merchant profiles.

4. Legal bases (GDPR)

• Performance of a contract — to provide the App to merchants.
• Consent — for shopper marketing opt-in and any non-essential cookies.
• Legitimate interests — to secure the service and prevent abuse, balanced against individuals’ rights.
• Legal obligation — to meet retention, tax, and data-subject-request requirements.

5. Sharing and sub-processors

We share data only as needed to run the service:

• Shopify — the platform the App runs on for Shopify merchants; we call Shopify APIs with the scopes the merchant grants.
• WooCommerce (the merchant’s own WordPress site) — we call the store’s REST API with the keys the merchant approves.
• Stripe — subscription billing, payments and VAT calculation for WooCommerce merchants.
• The merchant — shoppers’ activation data is made available to the merchant who owns the activation.
• Email marketing tools the merchant connects (Klaviyo, Mailchimp) — on the merchant’s instruction, we send the email addresses of shoppers who gave marketing consent to the merchant’s own list.
• Resend — delivers our emails to merchants (for example the email sent after signing up).
• Hostinger (hosting; EU/EEA) — stores and serves App data.
• Cloudflare — DNS and traffic routing.

Web fonts are self-hosted from our own servers; no font requests are made to third-party font providers.

We keep a current list of sub-processors and will notify merchants of changes so they may object. For merchants, we make available a Data Processing Agreement (DPA) covering our processing of shopper data on their behalf. We do not otherwise disclose personal data except where required by law.

6. International transfers

Cultmetrics Oy is established in Finland (EU) and our hosting is located in the EU/EEA. Where a sub-processor processes data outside the EEA (for example Cloudflare or Stripe), we rely on an appropriate transfer mechanism such as the EU–U.S. Data Privacy Framework and/or the European Commission’s Standard Contractual Clauses.

7. Retention and deletion

We keep personal data only as long as needed for the purposes above or as required by law:

• Activation participation records (plays, prizes, generated discount codes) — up to 12 months after the activation, then deleted or anonymized.
• Abuse-prevention data (IP address, user-agent) — up to 90 days.
• Marketing-consent records — until the shopper withdraws consent or the merchant deletes them.
• Merchant account data and Shopify access tokens — deleted within 30 days of uninstall or a shop/redact request.
• WooCommerce API keys — deleted immediately when the merchant disconnects or deletes the plugin; the account and activations are kept for a reconnect and deleted within 30 days of a deletion request.
• Billing records — kept as long as accounting law requires (in Finland, up to 6 years).

We honor Shopify’s mandatory privacy webhooks: on a customer data-erasure request (customers/redact) we delete the shopper’s participation data, and when a store uninstalls and requests erasure (shop/redact) we delete the store’s associated data. Customer data-access requests (customers/data_request) are fulfilled to the merchant so they can respond to the shopper.

8. Your rights

Subject to applicable law, individuals have the right to access, correct, delete, restrict, or object to processing of their personal data, and to data portability. Where we rely on legitimate interests, you may object to that processing. Where processing is based on consent, you may withdraw consent at any time without affecting processing carried out beforehand; withdrawing is as easy as giving it.

Because shopper data is controlled by the merchant, please direct shopper requests to the merchant’s store. If a shopper contacts us directly, we forward the request to the responsible merchant without undue delay and assist them in fulfilling it. Merchants and other individuals may contact us using the details below. You also have the right to lodge a complaint with your local supervisory authority (in Finland, the Office of the Data Protection Ombudsman).

9. Cookies

The App admin uses strictly necessary cookies to keep you signed in and to secure requests. Activation widgets use first-party functional storage only (for example to remember whether a shopper has already participated). The App and activation widgets do not use advertising cookies. The merchant is responsible for obtaining any cookie or storage consent required on its storefront. On our own website, statistics and marketing cookies are set only with consent given in the cookie banner.

10. Security

We use encryption in transit (HTTPS), encrypt stored access tokens, and apply access controls and rate limiting. No method of transmission or storage is completely secure, but we work to protect personal data appropriately. In the event of a personal-data breach we will notify affected merchants without undue delay so they can meet their own notification obligations.

11. Children

The App is not directed to children under 13 and we do not knowingly collect their personal data.

12. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the “Last updated” date above and, where appropriate, by notifying merchants.

13. Contact

Cultmetrics Oy (Business ID / Y-tunnus: 3595346-9)
Perkiönkatu 33, 33900 Tampere, Finland
Data protection contact: privacy@perkbase.app