Privacy policy
Vikalp Omni ("we") is a Shopify app made in India. Stores use it for marketing, their own shopping app, live chat, loyalty (Omni Pass), reviews, wishlists, referrals and the Omni Dock on their website. This policy explains what data Vikalp Omni handles, why, and the choices merchants and their customers have. Questions: support@vikalpomni.com.
Who this covers
Merchants who install Vikalp Omni and the team members they invite, and the customers and visitors of their stores who use the features those merchants switch on.
For customers’ data, the merchant decides what is collected and why (the merchant is the controller) and we process it on the merchant’s behalf, under our data processing terms. For merchants’ own account details, we are the controller.
What we collect
- Store details from Shopify: store name, domain, contact email, currency, country, markets, languages and locations, and the plan.
- Team members: the name and email of people a merchant invites, what they may see and change, and their sign-ins.
- Customers from Shopify: name, email, phone, address and orders, when a feature needs them (for example, to send a review request after delivery or to ship a reward).
- Omni Pass: membership, token and credit balances and their history, tier, birthday (if added), social accounts the customer says they follow, and rewards redeemed. Omni Credits are held as Shopify store credit.
- Reviews and questions: what the customer writes, their rating, photos and videos, the name they choose to show, and the order it relates to.
- Wishlist: the products saved and the lists they’re in, whether a list is shared or a gift list, which saved products the customer later bought (the order, product, quantity and amount, so the store can see what its wishlist sells), whether the customer asked for wishlist alert emails, and whether they turned wishlist alert notifications off. When a friend ticks “I’ll buy this” on a shared gift list, we keep only that the item is taken and a scrambled copy of a random code from the friend’s browser (so only they can undo it). We never ask the friend who they are.
- Referrals: referral links, the friends and orders that came from them, and rewards; how many times a customer shared their link with each share button, by day. Each time a friend opens a link, where it was shared (for example by email or a message), its campaign tags, the page it opened and a random id from the friend’s browser, so an order can be traced to the link. These are deleted after 13 months, or sooner when the customer whose link it is asks to be forgotten. To stop people referring themselves, a friend’s email, delivery address and phone are compared with the referrer’s (only compared, never kept), and the random browser id of a customer looking at their own link is kept for 13 months, so the same browser opening their link stands out.
- Live chat and Omni Inbox: chat messages, the email a visitor gives (if asked), the page they chatted from, orders they asked about, and the team’s notes and replies.
- Omni Marketing: the emails and notifications sent, whether they were delivered, opened or clicked, unsubscribes, and the orders that followed. Web push subscriptions and app device tokens, so notifications reach the right browser or phone.
- Store activity: with the merchant’s permission, Shopify’s customer events (products viewed, added to cart, checkout started) and the market a customer shops in (country, language, currency), so reminders and messages reach the right customer in their own market.
- The store’s app: sign-in through the store’s Shopify customer accounts, saved addresses the customer manages there, and app activity used for the store’s notifications.
- Support: messages merchants and their team send us from the dashboard.
We never collect payment card details. Shopify bills merchants for plans and takes every payment at checkout.
Cookies and storage
vikalpomni.com uses no cookies and no trackers. The dashboard sets one sign-in cookie when it’s opened in its own tab. On stores’ websites, Vikalp Omni keeps small items in the browser, such as a visitor’s saved items and their open chat, so the features work. A friend who opens a referral link gets one cookie (vk_ref) holding that link, for as long as the store counts it (30 days unless the store chooses otherwise), so the friend’s order still counts when they buy straight from a product page. Events sent to a merchant’s own Meta and Google accounts follow the store’s cookie banner.
How we use it
Only to run the features a merchant switches on, to support merchants, to keep the service secure, and to meet legal obligations. We do not sell data, use it for our own advertising, or share one store’s data with another store.
Merchants’ own ad and analytics accounts
A merchant can connect their own Meta (Facebook and Instagram) and Google (Analytics and Ads) accounts. Vikalp Omni then sends those accounts the events the merchant chose, such as joining a loyalty programme, saving to a wishlist or writing a review. On the website this happens only with the customer’s consent from the store’s cookie banner. Meta receives the customer’s email address, phone number and name only as one-way hashes. The merchant is responsible for their own use of these accounts.
Emails and your choices
Customers get wishlist alerts only if they ask for them, marketing emails only if they agreed to marketing in Shopify, and Omni Pass emails only as members. Every email has a one-click unsubscribe link, and we stop emailing addresses that bounce or report spam. Customers can turn off notifications in their browser or phone settings at any time.
Who helps us run the service
Render, Amazon Web Services (Amazon SES), Google Firebase (Cloud Messaging), Cloudflare, Sentry, GitHub, Google Workspace. What each one does and where is on our sub-processors page. They process data only on our instructions and under their own security commitments.
Our servers and database are in the United States (Oregon); review photos and images stores upload are kept in Cloudflare’s file storage and delivered through its worldwide network; emails are sent from India (Mumbai), so data may be processed outside your country. Where the law requires it, transfers rely on safeguards such as the European Commission’s Standard Contractual Clauses.
How long we keep it
As long as the store uses Vikalp Omni. Data about visitors who aren’t signed in is deleted after 90 days. When a customer asks the store to delete their data, Shopify tells us and we erase or anonymise it; Omni Pass history keeps only the amounts, for the store’s accounts. When a merchant uninstalls, Shopify asks us to delete the store’s data at least 48 hours later, and we do: the deletion is retried until it is done and recorded with the time it finished. Database backups expire within days, and a restored backup has recorded deletions applied again. Billing records are kept as the law requires.
Security
Data is encrypted in transit, secrets are encrypted at rest, each store’s data is kept separate, and access by merchants’ teams and by our own team is limited and logged. More on our security page.
Your rights
Depending on where you live, you may have the right to access, correct, delete or export your data, to withdraw consent, to object to how it is used, and to complain to a data protection authority. Under India’s Digital Personal Data Protection Act, 2023 you may also nominate someone to act for you. Customers should contact the store they bought from first, as the store controls their data; we help the store answer. Merchants and anyone else can write to support@vikalpomni.com. We reply within 30 days.
Children
Vikalp Omni is a tool for businesses. We don’t knowingly collect data from children; merchants are responsible for how their own stores handle it.
Grievance officer
For complaints about how your data is handled, contact our Grievance Officer: Akshay S Jain, at akshay@vikalpomni.com with “Grievance” in the subject. We acknowledge every complaint within 2 working days and resolve it within 30 days.
Changes
If we change this policy, we update the date above and, for important changes, tell merchants in their dashboard before the change applies.