Bonafan Privacy Policy

1. Information we collect

The Service collects only the minimum information necessary to operate.

• Entrants: email address, Shopify customer ID (when the store has a customer record), and entry history (raffles entered, results, and payment status)
• Entrants: aggregated order figures used to compute the fan score (purchase count, amount spent, and whether a discount was applied). We do not collect or store line items, addresses, or payment details such as card numbers
• Entrants: sender IP address used to prevent abusive bulk requests (deleted automatically after 24 hours)
• Merchants: store domain and Shopify API access token

2. Purpose of use

Collected information is used solely for the following purposes.

• Running raffles (accepting entries, email verification, drawing, winner notification, and payment reconciliation)
• Computing fan scores (to give loyal fans better odds)
• Preventing fraudulent entries (rate limiting and merchant-managed blocklists)
• Maintaining and improving the Service and resolving issues

3. Third parties and processors

Entry information (email address, entry history, and fan score) is provided to the merchant of the store running the raffle.

The Service relies on the following providers; collected information may be processed and stored on their infrastructure.

Except as described above or required by law, we do not share collected information with third parties. We never use or sell it for advertising.

• Cloudflare (application hosting)
• Supabase (database)
• Resend (entry confirmation emails)
• Shopify (winner notification and checkout; the commerce platform between the store and entrants)

4. Retention and deletion

Entry history is retained as a record of raffle fairness. However, upon a customer data erasure request via Shopify (GDPR webhooks), we delete the customer’s fan score and blocklist records and anonymize the email address in their entry history.

After the app is uninstalled, we delete all data for the store upon Shopify’s shop data erasure request.

• Request logs including sender IP addresses: deleted automatically after 24 hours
• Email send ledger: deleted automatically after 48 hours
• Processed-order records (used to prevent duplicates): deleted automatically after 30 days

5. Cookies and data sent to third parties

We use a cookie that stores your language preference (bonafan_lang, valid for one year). It is used only by our own servers and is never sent to third parties.

On our public pages only (home, user guide, terms and this policy) we also use Google Analytics 4, provided by Google LLC, to understand how the site is used. The page URL, referrer, browser and device type and an approximate location are sent to Google through cookies. IP addresses are anonymised, and we never send information that directly identifies you, such as your name or email address. The data is used only to improve the service and never for advertising.

Google Analytics is not loaded on the dashboard, the entry page or the result page. URLs on those pages can contain signed tokens or a store identifier, so by design nothing from them is sent to a third party.

See Google's privacy policy (https://policies.google.com/privacy) for how Google handles the data. To stop the transmission, use Google's opt-out add-on (https://tools.google.com/dlpage/gaoptout) or your browser's cookie settings.

6. Security

All communication is encrypted with TLS. Database access is restricted with row-level security, and signed tokens are used for entry verification and result lookup to prevent leaks and tampering.

7. Disclosure, correction, and deletion requests

Entrants may request disclosure, correction, or deletion of their information through the merchant of the store they entered, or directly via the contact below. We respond within a reasonable period.

8. Changes to this Policy

This Policy may be revised as necessary. Material changes will be announced on this page.

9. Contact

For inquiries about this Policy, contact bonafan098@gmail.com.