Twisty Pre & Post Surveys privacy policy

Last updated: 17 October 2026

Twisty Pre & Post Surveys ("the App") is provided by Twisty Design, Sector 15 Part 1, 69P, Gurugram, Haryana 122001, India ("we", "us"). This policy explains what information the App collects when a merchant installs it on their Shopify store, how we use it, and the choices merchants and their customers have.

1. Who this policy applies to

• Merchants who install the App on their Shopify store.
• Customers of those merchants who see or answer a post-purchase survey on the store's Thank you or Order status page.
• Visitors to the merchant's online store who see or answer an on-site survey, if the merchant turns on on-site surveys.

For customer data, the merchant is the data controller and we act as a data processor on the merchant's behalf.

2. Information we collect

From the merchant's store (through Shopify's APIs), when the App is installed:

• Store information: the store's myshopify domain, currency and primary language.
• An access token issued by Shopify, so the App can work on the merchant's behalf.
• The survey questions, settings and lists the merchant creates in the App.

About orders and customers, for orders where the survey is shown or answered, and for paid orders (to report revenue per answer):

• Order ID and order number, order total and subtotal (in the store's currency), currency, products purchased, and order date.
• Refunds and cancellations (the order's current total), discount codes used, whether the order is a test order, and where the order was created (for example the online store or a draft order created by the merchant).
• The name of the payment method used (for example "PayPal"), the customer's tags set by the merchant in Shopify (for example "VIP"), and the types and vendors of the products ordered, used only to decide which questions to show.
• Marketing attribution that Shopify records for the order: the marketing source and medium, UTM campaign parameters, the referring website's domain, the type of ad click identifier (not the identifier itself), and the number of days from first visit to purchase.
• Customer ID (a Shopify identifier, not a name), whether the customer is new or returning, and the customer's number of orders.
• The country of the shipping or billing address. We do not store names, email addresses, phone numbers or street addresses.

From customers who answer a survey:

• Their answers (selected responses, free-text answers, dates) and the time of the answer.
• Which survey questions were shown for the order (so the merchant can see a response rate).

From store visitors who see or answer an on-site survey (only if the merchant turns on on-site surveys):

• A random visitor ID created in the visitor's browser (it does not identify the person). It is kept in the browser's local storage, only when the visitor has allowed it under the store's cookie / privacy choices, so the survey isn't shown again to someone who already answered or closed it. With the same permission the browser also remembers how many visits the visitor has made and where the current visit came from (search, social media, email, ads, another website or direct), so the merchant can show a survey only to new or returning visitors or by traffic source. These two facts stay in the visitor's browser and are not sent to us.
• To decide which survey to show, the survey script also reads in the visitor's browser whether they are logged in, their country / market as set by the store, and (only for surveys with cart rules) the cart total and products. None of this is sent to us or stored by the App.
• The page where the survey was shown: page type (home, collection, product or other), the page path without its query string, and the product ID on product pages.
• Device type (desktop, tablet or mobile) and the store language.
• Whether the survey was shown or closed, and the time.
• Their answers and the time of the answer.
• If the visitor is logged in to their customer account, the Shopify customer ID (sent to us by Shopify, not a name or email).
• If the visitor later places an order in the same browser and has allowed analytics cookies, the order ID together with their random visitor ID (sent by the App's Shopify web pixel on the order confirmation page), so the merchant can see purchases and revenue by answer. This is only stored for visitors who answered a survey.

We do not use cookies in the surveys, we do not use the visitor ID for advertising or to follow visitors across other websites, and we do not collect payment information.

3. How we use the information

• To show the right survey questions to the right customers (targeting by new or returning customer, country, products and the conditions the merchant sets, such as order value, customer tags or payment method).
• To avoid asking a customer the same question twice, and to show on-site surveys only where, to whom and as often as the merchant chose.
• To show the merchant analytics (including how often on-site surveys are shown, closed and answered): answer counts, revenue and average order value per answer, repeat purchase rates and customer lifetime value, and comparisons with Shopify's marketing attribution.
• To send answers to integrations the merchant turns on (see section 4).
• To let the merchant export their survey data.
• To keep the App secure, prevent abuse and fix problems.

We do not sell personal information, and we do not use it for advertising or share it with third parties for their own purposes.

4. Sharing and sub-processors

We share information only with service providers that help us run the App, under agreements that protect it:

Integrations the merchant turns on. When a merchant connects an integration (for example an outgoing webhook to their own system or another tool), the App sends each new survey answer to that destination on the merchant's instruction. These events contain the answer, order details (order number, totals, country, discount codes, marketing source) and Shopify customer and order IDs, but no names, emails, phone numbers or addresses. If the merchant turns it on, on-site survey answers are sent too, with the page (type, path, product), device, language, the random visitor ID and, for logged-in visitors, the Shopify customer ID. The merchant chooses the destination and is responsible for how it handles the data. Delivery records are kept for up to 90 days and are deleted when a customer or the shop asks for data deletion.

Answers saved in the merchant's store. If the merchant connects "Shopify tags & metafields" (and grants the App permission to edit orders and customers), the App also writes survey answers into the merchant's own Shopify store, as tags and metafields on the order and on the customer. This data then lives in the merchant's store, is controlled by the merchant, and stays there if the App is uninstalled.

We may disclose information if required by law.

5. Data retention and deletion

• Survey data is kept while the App is installed, so the merchant can see their analytics, unless the merchant asks us to delete it sooner.

• When a merchant uninstalls the App, all of the store's data is deleted when Shopify sends the shop/redact request (48 hours after uninstall).
• When a customer asks a merchant to delete their data, Shopify sends us a customers/redact request and we delete that customer's survey answers (including on-site survey answers given while logged in) and order information. On-site answers from visitors who were not logged in are linked only to a random visitor ID, not to a person.
• When a customer asks a merchant for a copy of their data, Shopify sends us a customers/data_request request and we provide the data we hold to the merchant within 30 days.

6. Security

Data is encrypted in transit (HTTPS) and at rest (encrypted database storage and backups). Access to production systems is limited to authorised staff using strong passwords and multi-factor authentication. If a security incident affects personal information, we will notify affected merchants without undue delay and within 72 hours of becoming aware of it.

7. Your rights

Customers should contact the merchant they bought from to access, correct or delete their information; the merchant can make these requests through Shopify, and we act on them as described above. Depending on where you live (for example under the GDPR or CCPA), you may have additional rights, including the right to complain to a data protection authority.

8. Changes to this policy

We will post any changes on this page and update the "Last updated" date. For significant changes we will notify merchants through the App or by email.

9. Contact

Questions about this policy or about data the App holds:

• Twisty Design
• Email: team@twisty.design
• Address: Sector 15 Part 1, 69P, Gurugram, Haryana 122001, India