Last updated: October 24, 2026

Pcnaid Inc. operates Pcnaid Loyalty & Rewards. For loyalty-program data, the merchant is the controller and Pcnaid Inc. processes data on the merchant’s behalf. Pcnaid Inc. is the controller for service, security, and product-analytics data used to operate the app.

Merchant data includes the shop’s canonical Shopify domain, Shopify shop identifier, shop name and contact email, currency, timezone, app configuration, plan and billing state, and authenticated staff actions recorded for security and audit purposes.

Loyalty-member data can include the Shopify customer identifier, name, email, birthday, notification phone number and preferences, loyalty participation status, points and store-credit balances and transactions, VIP status, referrals, redemptions and discount codes, memberships, achievements, reviews, wishlists, visit and purchase milestones, fraud-review state, and related Shopify product, order, checkout, and transaction identifiers. The app also stores hashed email and IP signals, device hashes, and a shortened User-Agent value for duplicate-account and fraud detection; raw IP addresses are not stored in those customer fingerprints.

The Shopify web pixel records loyalty-attribution events such as page views, product and cart activity, and checkout activity. Its compact event record can include a Shopify customer, order, product, or variant identifier, quantity, total and currency, and the page scheme, host, and path. Query strings, fragments, and checkout tokens are removed before storage.

read_orders and write_orders support points and refund accounting and loyalty-related order metafields. read_products and write_products support product rewards, review context, and loyalty product metafields. read_customers and write_customers support member enrollment, balances, eligibility, loyalty tags, and customer metafield snapshots.

read_discounts and write_discounts support creating, reconciling, and retiring reward discount codes. read_metaobject_definitions, write_metaobject_definitions, read_metaobjects, and write_metaobjects support the app-owned loyalty catalog and definitions installed from the app configuration.

write_pixels, read_pixels, and read_customer_events support registering the loyalty web pixel and capturing storefront events for loyalty attribution. read_store_credit_accounts, read_store_credit_account_transactions, and write_store_credit_account_transactions support reading balances and issuing or deducting Shopify store credit as a loyalty reward.

read_themes lets the app list the store’s themes so the merchant can choose which theme receives the loyalty app blocks; it is read-only.

The authoritative application data is stored in PostgreSQL on Microsoft Azure. The app also creates app-owned Shopify metafield snapshots and metaobject projections so Shopify surfaces can use loyalty data. Redis supports non-authoritative rate-limit and fraud-signal data, for which failures fall back to in-process memory. Redis also backs the BullMQ maintenance-job queue and schedulers and stores a tenant-domain registry used to fan maintenance work out across shops. Each registry member is a canonical *.myshopify.com domain added through authenticated tenant traffic. Those set members have no expiry and are not currently removed on app uninstall or shop/redact.

Loyalty and merchant records are kept while needed to provide the installed service, preserve balances and transaction history, meet security and accounting needs, and respond to legal requests. An app-uninstall webhook deletes Shopify session records, including stored access and refresh tokens, along with the shop record and its database-linked loyalty data. A monotonic billing-trial history keyed by the canonical *.myshopify.com domain deliberately survives uninstall so reinstalling cannot create another introductory trial. A minimal domain-keyed privacy record also preserves the authenticated uninstall webhook id/time and any deferred shop-redaction id/time and reason. Shopify’s later shop/redact webhook deletes the trial history, any remaining Shopify session records, and any remaining PostgreSQL shop-linked data only after that positive uninstall signal is present. Ambiguous legacy requests are retained as deferrals until reconciliation. The Redis tenant-domain registry exception described above remains after both events. Continuous platform backups (Azure PostgreSQL PITR, retained for 7 days) and disaster-recovery drill artifacts (encrypted GitHub Actions artifacts, retained for 30 days) outlive live record deletion and expire automatically at the end of their respective retention windows. A restored verification copy in the dedicated drill database is kept until a later drill run resets it.

Shopify provides the commerce platform, identity, webhooks, billing, app-owned custom data, discounts, pixels, and store credit. Microsoft Azure provides Container Apps hosting and PostgreSQL storage. The configured Redis service supplies rate-limit and fraud-signal storage, persistent tenant-domain registry storage, and the BullMQ queue and schedulers required by the maintenance worker.

Sentry processes error diagnostics; PostHog and Mixpanel process product-analytics events; and Datadog processes server tracing and performance-monitoring data when configured. These operational events can contain shop or pseudonymous customer identifiers and technical request context.

Resend processes transactional email and delivery events. Twilio processes SMS messages when a merchant enables SMS and a member opts in. Klaviyo receives loyalty event data (the Shopify customer identifier and event properties) when a merchant connects the optional Klaviyo integration. Google processes the pass details (Shopify customer identifier, member name, points balance, tier and lifetime points) when a member saves an optional Google Wallet pass. Apple Wallet processes pass details (Shopify customer identifier, member name, points balance, tier, lifetime points, and referral code) when a member saves an optional Apple Wallet pass. Cloudflare Turnstile processes an anti-bot token and, when supplied, the request IP for protected public actions. A provider receives data only for the feature for which it is configured and used.

The app authenticates and handles Shopify’s three mandatory privacy webhooks. customers/data_request compiles the loyalty data held for the requested customer and emails the export to the merchant’s recorded contact address; when no shop contact address is stored, the handler logs that the export could not be delivered.

customers/redact deletes the matching live customer record and its cascading loyalty records in PostgreSQL. This deletion does not purge secondary operational records (such as outbound webhook delivery logs) and does not propagate to third-party service providers, application logs, or pre-existing backup snapshots (which roll off after 7 or 30 days) or the restored verification copy in the drill database (kept until a later drill run resets it). shop/redact consumes the positive signal recorded by the authenticated app-uninstall handler, then deletes the shop record, its dependent PostgreSQL records, all Shopify session rows for that shop domain, the retained domain-keyed trial history, and that signal. A current installation or a legacy request with no positive uninstall signal is acknowledged without deletion and recorded for reconciliation; session absence and token expiry are not treated as proof. As noted above, backups outlive live deletion until their retention windows expire, third-party provider logs are governed by provider retention, and the handler does not currently delete the unexpiring shop-domain member from the Redis tenant registry. A customer seeking access, correction, or deletion should contact the merchant whose loyalty program they joined so the merchant can initiate the appropriate Shopify process.