Privacy Policy
Topupsell by TH Global Vietnam · Last updated 2026-07-28
Topupsell (“the app”) is a Shopify app operated by TH Global Vietnam. It shows post-purchase and cart offers in stores that install it. This policy explains exactly what the app stores, why, how long it keeps it, and who can reach it.
What the app does not collect
The app never stores a buyer’s name, email address, phone number, shipping or billing address, or any payment details. It has no need for them: offers are chosen from the products in an order, and charges are authorised by Shopify against the payment method already used at checkout. The app never sees a card number.
What the app stores
Merchant configuration. The offer funnels a merchant builds: product selections, prices, wording, images and routing rules. This belongs to the store, not to any buyer.
Offer events. One row per meaningful moment in a funnel: whether an order qualified for an offer, which step was shown, whether it was accepted, the amount and currency. Each row carries an order reference so it can be reconciled against the store’s own records.
Order protection windows. While a funnel is running, the app keeps the order identifier, its checkout token and the list of line item identifiers. This is what lets the app tell the store’s fulfilment process to wait a few minutes so an accepted offer is not shipped as a separate parcel.
Shopify access credentials. The access token Shopify issues when a merchant installs the app, so the app can read products and orders on the store’s behalf.
Why the app needs order data
Shopify classifies order data as protected customer data. The app requests it for two purposes only: deciding which offer an order qualifies for, and reporting funnel performance back to the merchant. The app does not request access to customer name, email, phone or address fields.
How long it is kept
Order protection windows are deleted 7 days after they are created. They serve a ten-minute purpose and have no value after that.
Offer events lose their order reference after 180 days. What remains — the type of event, the amount, the date — cannot be traced back to any person, and is kept so merchants do not lose their historical conversion figures. If a merchant or Shopify asks for a specific buyer’s data to be erased before then, the same removal is applied immediately.
Merchant configuration and access credentials are deleted when the app is uninstalled, and again when Shopify sends its shop erasure request 48 hours later.
Who else sees it
The app does not sell data and does not use it to send marketing. Data is processed by the providers below, acting on TH Global Vietnam’s instructions. No one else receives it.
| Provider | Purpose | Data received |
|---|---|---|
| Shopify | Source of the order data and host of the checkout | Already holds the data as the store platform |
| Vercel | Application hosting | Request traffic to the app, including IP addresses |
| Supabase | Database storage, encrypted at rest | Funnel configuration, offer events, order protection records |
| Meta Platforms only if enabled | Conversions API — reports upsell revenue to the merchant’s own Meta pixel | Upsell amount, currency, order reference, buyer IP address and browser user agent |
Meta Conversions API is off unless a merchant turns it on. A merchant who wants upsell revenue counted in their own Meta advertising reports can enter their Meta pixel identifier and access token in the app. From then on, when an offer is accepted the app sends Meta the amount, the currency, an order reference, and the buyer’s IP address and browser user agent — the two signals Meta requires to match the event. No name, email, phone or address is ever sent. Removing the token stops it. Buyers who want to know whether a particular store has this on should ask that store.
Data subject requests
Buyers should contact the store they bought from — under privacy law the merchant is the controller of that data. The app responds to Shopify’s mandatory customers/data_request, customers/redact and shop/redact webhooks, so a request made through the store reaches the app automatically. Merchants can also write to the address below.
Changes
Material changes to this policy will be reflected on this page with a new date above. The page is served by the app itself, so it always describes the version of the app currently running.
Related documents
Terms of Service · Data Processing Agreement
Contact
TH Global Vietnam — thvietnambtc@gmail.com