Campaign Conductor Privacy Policy
This policy explains what the app processes, why it is needed, who receives it, and how merchants and buyers can exercise privacy rights.
Effective and last updated: October 16, 2026
Who we are and when this policy applies
Campaign Conductor is provided by Pcnaid Inc., 752 N Main St #2194, Mansfield, Texas 76063, United States. This policy applies when a merchant installs or uses Campaign Conductor, when the app schedules or runs a promotion, and when a buyer interacts with an enabled storefront feature or receives a merchant-authored campaign email.
For buyer information that a merchant makes available through Shopify, the merchant decides why the information is processed and Pcnaid acts as the merchant’s service provider or processor. Pcnaid separately controls account, support, security, and service-operation data used to provide and protect Campaign Conductor.
Information we process
| Category | Examples | Purpose |
|---|---|---|
| Merchant and store account data | Shopify shop domain, installed-app session and access token, approved scopes, user ID, name, email, locale, and account-owner or collaborator flags supplied by Shopify. | Authenticate the app, isolate each store, authorize billing, and call Shopify APIs. |
| Campaign and catalog configuration | Campaign names and times; selected product, variant, publication, theme, discount, and segment identifiers; price snapshots; tags; popup settings; and merchant-authored email subject and content. | Schedule, execute, and safely roll back the promotion configured by the merchant. |
| Buyer and marketing data | Shopify customer identifier, email or phone when approved and available, marketing consent state, campaign-email delivery state, and do-not-send suppression identity. A mixed-version compatibility rollout stores the normalized address with a shop-scoped one-way hash for every configured rotation key; customer redaction removes the linked plaintext. Storefront data includes event ID, type, time, page URL, campaign link, and bounded event payload. | Build merchant-selected audiences, send only to eligible consented recipients, honor unsubscribe or provider suppression, prevent duplicate sends, and report campaign events to that merchant. |
| Subscription and operations data | Shopify subscription identifiers and status, one-time trial claim, quota counters, job and webhook receipts, app release, route, browser/device diagnostics, errors, and bounded security logs. | Provide billing and plan limits, recover jobs, prevent replay, troubleshoot, and secure the service. |
| Merchant-configured integrations | Operational-alert email address, one-way developer API token hash and prefix, encrypted Slack incoming-webhook URL, encrypted outbound HTTPS endpoint and signing secret, selected event types, and delivery status. | Send campaign lifecycle notices to destinations the merchant selects and diagnose failed deliveries. |
| Support communications | Store domain, contact details, message, screenshots, and troubleshooting context you choose to send. | Respond to the request and maintain an appropriate support record. |
How information is collected
- From Shopify APIs, OAuth sessions, billing state, and signed compliance/app webhooks.
- From campaign and settings fields a merchant submits inside Shopify Admin.
- From the consent-aware Campaign Conductor web pixel and signed app proxy when the merchant enables storefront functionality. The app does not use this data for cross-store advertising.
- From application, queue, delivery, security, and observability systems.
- From email or other support messages you send to Pcnaid.
Purposes and limits
We process this information to perform the merchant’s campaign instructions, authenticate users, enforce plans, deliver merchant-authored email, show tenant-local analytics, maintain and secure the service, communicate about support or material service matters, and comply with law. Buyer data is not used to advertise Pcnaid products to buyers, create cross-merchant profiles, or make decisions that produce legal or similarly significant effects.
We do not sell personal information or share it for cross-context behavioral advertising. We honor Shopify marketing-consent state before campaign email and maintain unsubscribe, bounce, complaint, and provider-suppression records so future sends fail closed.
Service providers and disclosures
Information is disclosed only as needed to operate Campaign Conductor:
- Shopify provides authentication, store APIs, billing, app surfaces, and compliance webhooks.
- Microsoft Azure hosts the web app, worker, and PostgreSQL production data.
- A managed Redis service holds delayed and retryable campaign-job state.
- Resend delivers merchant-authored campaign email and operational campaign alerts, and reports delivery, bounce, and complaint events.
- Slack receives bounded campaign lifecycle notices only when a merchant connects a Slack incoming webhook. Merchant-selected outbound HTTPS endpoints receive the event types that merchant enables.
- Sentry, Datadog, and PostHog receive bounded service diagnostics and usage events.
- GitHub Actions retains encrypted, restore-verified logical database backups.
We may also disclose information when required by law, to protect rights or service security, or during a corporate transaction subject to appropriate confidentiality and notice obligations. Providers may process information in the United States and other locations where they operate.
Retention and deletion
- Active-install data is kept while needed to provide the app. Uninstall stops active work, revokes external integration and calendar grants, and blanks stored session credentials; Shopify’s later signed
shop/redactrequest deletes the remaining shop-scoped campaign, customer, event, integration configuration, delivery, and subscription records; the minimized domain record retained as a queued-job erasure receipt is deleted once that erasure completes. - Signed
customers/redactrequests delete matching customer marketing profiles and storefront events, plus recipient-level campaign email delivery history. Before deletion, the app collects current and previous addresses from those matched rows, removes every matching plaintext suppression address, and retains the shop-scoped one-way hashes. Signedcustomers/data_requestrequests identify those matching records and any retained do-not-send suppression entry for the merchant’s response process. - Processed webhook replay receipts are pruned after 30 days.
- Encrypted, restore-verified logical backups are retained for 30 days.
- A minimal shop trial-history tombstone is retained after redaction to prevent repeated trial abuse. It contains the shop identifier and trial claim/provider metadata, not buyer contact or campaign content.
- Suppression information is retained while the shop uses the service so an opt-out, bounce, or complaint is not accidentally reversed, including after a customer redaction request. During a mixed-version compatibility rollout, new entries use both a normalized address and one shop-scoped one-way hash per configured rotation key so every active worker version honors the block. Customer redaction removes every linked normalized address and retains only the hashes. These records are deleted with the shop’s data after
shop/redact. Security incident, legal-hold, and support records may be retained longer where reasonably required for the stated purpose or by law.
Security
Campaign Conductor uses HTTPS, encrypted managed storage, encrypted logical backups, signed webhooks and app-proxy requests, tenant-scoped database transactions, PostgreSQL row-level security forced on every tenant table, least-privilege runtime credentials, request-size and replay limits, secret-redacting logs, and restricted staff/service-provider access. No security measure eliminates every risk.
Cookies and similar storage
The embedded app uses Shopify authentication and strictly necessary session mechanisms. Its diagnostics providers may use browser storage to maintain service-session context and prevent duplicate telemetry. Campaign Conductor does not use buyer storefront events for Pcnaid advertising and does not place an advertising cookie through its web pixel.
Merchant and buyer choices
Depending on location, a person may have rights to access, correct, delete, restrict, object to, or receive a copy of personal information, and to withdraw consent where processing relies on consent. Buyers should first contact the Shopify merchant that controls their store relationship; the merchant can submit Shopify’s privacy request workflow and we will act on its authenticated compliance webhook. Merchants and other requesters can also email us. We may verify identity and authority before disclosing or deleting information.
Children
Campaign Conductor is a business application for Shopify merchants and is not directed to children. If you believe the app holds a child’s information contrary to a merchant’s lawful instructions, contact the merchant or Pcnaid so the request can be evaluated and handled.
Changes and contact
We will update the date on this page when this policy changes and will provide appropriate notice of material changes. Privacy and data-subject requests may be sent to support@pcnaid.com. Security reports may be sent privately to security@pcnaid.com. Please do not include passwords, access tokens, or customer lists in ordinary email.