Privacy Policy

Last updated: September 20, 2026

What data NASP Rewards collects, how we use it and your rights.

This policy explains what data we collect, why, how we handle it and your rights. We never sell your data.

This policy applies to NASP Rewards, built and maintained by Not A Side Project for Shopify.

“You” means merchants using NASP Rewards, website visitors and anyone contacting us.

We also process shopper information for merchants, including Shopify data needed to run loyalty programs.

Merchants control shopper information. We process it under their instructions to provide NASP Rewards.

Shoppers should contact their store with questions about their information.

What we collect and why

We collect only what we need.

Identity and access

Shopify provides store identity, including its domain and Shopify user IDs, when merchants install or use NASP Rewards. We use this to connect and run the app.

Shopify provides the owner’s email for important operational messages. With your consent, we may also send surveys, newsletters and updates.

We never sell personal information. We use your name or store in marketing only with permission.

Billing information

Shopify handles your NASP Rewards subscription and payment. We receive and store subscription, plan and billing-cycle information needed to verify access and report accepted email usage. We keep usage-reporting records associated with your store. We do not receive your credit card information.

Loyalty program information

We store information you enter or Shopify provides to operate NASP Rewards. We keep it while the app is installed.

When a merchant enables the relevant earning activity, loyalty program information can also include a customer’s birthday month and day, an optional birth year, and marketing email consent status.

VIP features also use order and transaction amounts, qualification records, membership tiers, validity periods and benefit history. Referrals record invited email addresses, the customers involved, qualifying purchases, confirmation and awarded points. Customers share referral invitations themselves; NASP Rewards does not send invitation emails.

When customer notifications are enabled, we process recipient addresses, customer language, the loyalty information included in the email, sender settings, rendered email content and sending records. We use an email delivery provider to send these messages and report accepted usage through Shopify.

IP addresses

We log access IP addresses to secure NASP Rewards.

Website interactions

We collect browsing data to understand website use and improve its design. This may include browser and operating system versions, IP address, visited pages, load times and referring websites.

Cookies

NASP Rewards uses a first-party cookie to make the app work inside Shopify. We do not use advertising cookies.

Cookies are text stored by your browser. You can block them in browser settings, but NASP Rewards may not work properly.

Voluntary correspondence

We keep support correspondence and your email address for future reference.

We store volunteered information, such as survey responses. We record interviews for future reference or use only with your express consent.

When we access or disclose your information

We access your information for limited purposes with your express permission, such as manual repairs. We seek lasting fixes to avoid repeat access. We may also access information to respond to legal process, as described below.

Support: we ask for consent before accessing your content to troubleshoot or fix a bug.

Restricted uses: access during abuse investigations is a last resort. We balance merchants’ privacy and safety with those of people reporting issues. Confirmed restricted use may require action, including notifying authorities where warranted.

When required under applicable law. Not A Side Project is based in Hong Kong, and NASP Rewards’ main data infrastructure is located in Europe.

Requests for user data. We will not give user data to government authorities unless the law requires us to, or in limited emergency circumstances. We will notify affected users before we disclose data unless the law prohibits us from doing so, except in some emergency cases.

Preservation requests. We will keep a copy of user data only when the law requires us to. Keeping a copy does not mean we will disclose it. We will disclose it only when the law requires us to. When the required preservation period ends, we will delete the copy unless we receive a valid legal requirement to keep it longer.

If we are audited by a tax authority, we may be required to disclose billing-related information. If that happens, we will disclose only the minimum required.

If Not A Side Project is acquired or merges, we will notify you well before your personal information transfers or becomes subject to another privacy policy.

Your rights with respect to your information

We strive to apply the same data rights regardless of location, including:

  • Right to Know. You have the right to know what personal information is collected, used, shared or sold. This policy describes the data we collect and its uses.
  • Right of Access. Access your personal information and details of its sharing, storage, security and processing.
  • Right to Correction. You have the right to request correction of your personal information.
  • Right to Erasure / “To Be Forgotten”. Request erasure from us and our service providers, subject to legal limits. Deletion may prevent NASP Rewards from working and require uninstalling it.
  • Right to Complain. You have the right to make a complaint regarding our handling of your personal information with the appropriate supervisory authority.
  • Right to Restrict Processing. Request limits on how and why your information is processed, including opting out of sale. We have never sold and will never sell personal data.
  • Right to Object. You have the right, in certain situations, to object to how or why your personal information is processed.
  • Right to Portability. You have the right to receive the personal information we have about you and the right to transmit it to another party.
  • Right to not Be Subject to Automated Decision-Making. You have the right to object to and prevent any decision that could have a legal or similarly significant effect on you from being made solely based on automated processes. This right is limited if the decision is necessary for performance of any contract between you and us, is allowed by applicable law, or is based on your explicit consent.
  • Right to Non-Discrimination. We do not and will not charge you a different amount to use our products, offer you different discounts, or give you a lower level of customer service because you have exercised your data privacy rights. Exercising some rights may prevent you from using NASP Rewards.

Contact us to exercise these rights. Some information may be legally exempt from requests, including information needed to provide NASP Rewards.

We may verify your identity before responding. Depending on the request and data sensitivity, this may include your name and email. Without verification, we may be unable to respond. For help, contact support@notasideproject.com or at Not A Side Project, Room 3602, Level 36, Tower 1, Enterprise Square Five, 38 Wang Chiu Road, Kowloon Bay, KL, HK. If an authorized agent is corresponding on your behalf, we will need your written consent and signature before proceeding.

Where applicable law allows an appeal, our denial will explain how to appeal. You may also complain to a supervisory authority. EU and UK residents can contact their data protection authority for complaints or local privacy guidance.

How we secure your data

Data sent from our servers to your browser is encrypted with SSL/TLS. We also work to secure stored data.

Most database data is not encrypted.

What happens when you uninstall NASP Rewards

Uninstalling makes your information immediately inaccessible. It should be fully purged within 30 days. See our Terms of Service.

Data retention

We retain information as needed for its purposes and your choices, then may delete it. We may also retain and use it to meet legal obligations, resolve disputes and enforce agreements. Specific retention periods appear above.

Location of site and data

Our main application and data infrastructure are primarily in Europe. Information from outside Europe may be transferred there and stored. Using our website or NASP Rewards, or providing personal information, means you consent to this transfer.

Changes and questions

We may update this policy as needed to comply with relevant regulations and reflect any new practices. If we make significant changes, we will refresh the date at the top of this page and notify merchants by email.

For questions about this policy, your data or your rights, email support@notasideproject.com.

Parts of this policy are adapted from 37signals' policies, licensed under CC BY 4.0, and modified for NASP Rewards.