Uppercase builds two Shopify apps — Post Perks, which turns orders into physical rewards, and FlashDrop, which runs reward-based sales campaigns. Each app collects different data for different reasons, so each has its own complete policy below.
We collect the minimum each app needs to do its job: Post Perks needs order and shipping details to send physical rewards; FlashDrop needs order and campaign-participation details to run tiered discounts and group buys. We never sell personal data, we share it only with the specific partners each app needs to function, and we delete it when it's no longer needed. Merchants stay in control of their customers' data at all times, and the two apps don't merge customer records unless a merchant explicitly connects a feature between them.
Post Perks lets merchants send physical rewards — handwritten notes, small gifts, discount cards — to customers after a purchase. This part of the policy covers what that app collects and how it's used.
Post Perks is a Shopify app built and operated by Uppercase ("Uppercase," "we," "us").
This policy covers three groups of people: merchants who install Post Perks on their Shopify store, customers of those stores whose order information we process to deliver rewards, and visitors to our website, including people who join our waitlist.
For customer data that flows to us through a merchant's store, the merchant is the data controller and we act as a processor on their behalf. For merchant accounts and website visitors, we are the controller.
We use the information above to:
We do not use customer order data to build advertising profiles, and we do not send marketing to a merchant's customers on our own behalf.
Post Perks receives data through the Shopify API only with the permissions a merchant grants at install, and we request the minimum scopes needed to run the service. Our handling of this data follows Shopify's API Terms and its requirements for protected customer data.
When a merchant uninstalls Post Perks, we stop receiving their store's data and delete stored customer data within the timeframes Shopify requires. Merchants can also ask us to delete specific customer records at any time — including to fulfil data-deletion requests they receive from their own customers.
We never sell personal data. We share it only with:
Uppercase also builds FlashDrop, a separate Shopify app for running reward-based sales campaigns (see Part Two, below). Post Perks and FlashDrop are independent apps with their own installs and their own permissions — installing one does not automatically give the other access to a merchant's store or its customers' data.
If a merchant installs both apps, we keep each app's data in separate systems and do not merge or cross-reference customer records between them. The only situation where data moves between the two is if a merchant explicitly connects a feature — for example, sending a Post Perks reward when a FlashDrop group-purchase campaign is unlocked — and in that case only the specific fields needed for that feature are shared, under the same protections described in this policy.
We keep personal data only as long as we need it for the purposes above. As a rule of thumb:
We protect data with encryption in transit and at rest, access controls that limit data to the people who need it, and logging of access to customer records. No system is perfectly secure, but if a breach affects your personal data we will notify affected merchants and, where required, regulators without undue delay.
Depending on where you live — including the EEA and UK under the GDPR, and California under the CCPA/CPRA — you may have the right to:
If you're a customer of a store that uses Post Perks, the fastest route is usually to contact the merchant directly — they control your data and we'll act on their instructions. You can also contact us at hello@uppercaseapps.com and we'll respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.
Post Perks is a business tool for merchants and is not directed at children under 16. We don't knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we'll delete it.
Our service providers may store or process data outside your country. Where data moves out of the EEA or UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, and we require equivalent protections from our providers.
We'll update this policy as the product and the law evolve. When we make material changes we'll update the date at the top of this page and, for significant changes affecting merchants, notify you by email or in the app. Continued use of Post Perks after changes take effect means you accept the updated policy.
Questions, requests, or concerns about Post Perks or your data:
Uppercase
hello@uppercaseapps.com
FlashDrop lets merchants run reward-based sales campaigns — time-limited deals with built-in urgency, real-time inventory counters, and group-purchase campaigns where customers share with friends to unlock bigger discounts. This part of the policy covers what that app collects and how it's used.
FlashDrop is a Shopify app built and operated by Uppercase ("Uppercase," "we," "us"). It helps merchants create strategic promotions — tiered discounts that grow as more customers participate, live inventory counters, and group purchases that unlock exclusive rewards when enough customers share and buy.
This policy covers three groups of people: merchants who install FlashDrop on their Shopify store, customers of those stores who participate in or are affected by a campaign, and visitors to our website.
For customer data that flows to us through a merchant's store, the merchant is the data controller and we act as a processor on their behalf. For merchant accounts and website visitors, we are the controller.
We use the information above to:
We do not use campaign or referral data to build advertising profiles, and we do not sell pricing or demand data to third parties.
FlashDrop receives data through the Shopify API only with the permissions a merchant grants at install, and we request the minimum scopes needed to run the service. Our handling of this data follows Shopify's API Terms and its requirements for protected customer data.
When a merchant uninstalls FlashDrop, we stop receiving their store's data and delete stored customer data within the timeframes Shopify requires. Merchants can also ask us to delete specific customer records at any time — including to fulfil data-deletion requests they receive from their own customers.
We never sell personal data. We share it only with:
Within a single campaign, a merchant running that campaign can see referral and participation activity for their own customers. We don't share one customer's referral activity with other customers.
Uppercase also builds Post Perks, a separate Shopify app for sending physical rewards after purchase (see Part One, above). FlashDrop and Post Perks are independent apps with their own installs and their own permissions — installing one does not automatically give the other access to a merchant's store or its customers' data.
If a merchant installs both apps, we keep each app's data in separate systems and do not merge or cross-reference customer records between them. The only situation where data moves between the two is if a merchant explicitly connects a feature — for example, triggering a Post Perks physical reward when a customer unlocks a FlashDrop group-purchase tier — and in that case only the specific fields needed for that feature are shared, under the same protections described in this policy.
We keep personal data only as long as we need it for the purposes above. As a rule of thumb:
We protect data with encryption in transit and at rest, access controls that limit data to the people who need it, and logging of access to customer records. No system is perfectly secure, but if a breach affects your personal data we will notify affected merchants and, where required, regulators without undue delay.
Depending on where you live — including the EEA and UK under the GDPR, and California under the CCPA/CPRA — you may have the right to:
If you're a customer of a store that uses FlashDrop, the fastest route is usually to contact the merchant directly — they control your data and we'll act on their instructions. You can also contact us at hello@uppercaseapps.com and we'll respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.
FlashDrop is a business tool for merchants and is not directed at children under 16. We don't knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we'll delete it.
Our service providers may store or process data outside your country. Where data moves out of the EEA or UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, and we require equivalent protections from our providers.
We'll update this policy as the product and the law evolve. When we make material changes we'll update the date at the top of this page and, for significant changes affecting merchants, notify you by email or in the app. Continued use of FlashDrop after changes take effect means you accept the updated policy.
Questions, requests, or concerns about FlashDrop or your data:
Uppercase
hello@uppercaseapps.com