Koru Upsells privacy policy

Last updated 12 November 2026.

Koru Upsells is a Shopify app made by Koru Group, the team behind Koru Nutrition in New Zealand. It shows a merchant's offer on the page between payment and the thank-you page, and adds the item to the order if the customer accepts. This policy covers the data the app handles for the merchants who install it and for their customers.

What we store about the merchant's store

• The store's myshopify domain and the access token Shopify issues when the app is installed.
• The funnels the merchant creates: names, rules, offers, discounts and page layouts.
• AI access keys the merchant creates. We keep only a one-way hash of each key, a short prefix so it can be recognised in the list, a label and when it was last used.

What we store about customers

No names, email addresses, postal addresses, phone numbers or payment details. For each offer shown we keep the checkout's reference id (a random id Shopify assigns), which offer and step it was, whether it was shown, accepted or declined, and for an accepted offer the amount and currency. This is what the merchant's results are counted from.

To decide which offer fits, the app reads the products and order total of the checkout the customer has just paid for, as Shopify passes them to the post-purchase page. It uses them for that decision and does not keep them. Payment for an accepted offer is handled by Shopify, on the payment method the customer already used; the app never sees card details.

How the data is used

Only to run the app: choosing and showing offers, adding accepted items to orders, and showing the merchant their results in the app and through the API. We don't sell or share it, use it for advertising, or combine it with data from other stores.

Where it is kept

The app runs on Vercel and its database is on Supabase, both in Sydney, Australia. Data is encrypted in transit (HTTPS) and at rest.

How long we keep it

When a merchant uninstalls the app, its access token is deleted and its AI keys stop working straight away. Shopify asks us to erase the store's data 48 hours later, and we then delete all of it: funnels, results, keys and tokens. Because we hold no personal customer data, a customer data request or deletion request from Shopify finds nothing to return or erase.

Your rights and contact

Merchants can ask what we hold about their store, or ask us to delete it, at any time. Customers should contact the store they bought from, which we will help with. Email info@korunutrition.co.nz.

We will update this page if what the app stores changes, and change the date at the top when we do.