RuleKit / SpecialCase

Privacy Policy

Last updated: 3 October 2026

RuleKit: Cart & Checkout Rules ("RuleKit") is provided by SpecialCase Software Solutions. This policy explains how we handle information when a merchant installs or uses RuleKit with a Shopify store. For privacy questions, email support@specialcase.net.

Information we handle

We receive the store domain and Shopify authorization information needed to run the app. Shopify staff sessions can include a staff member's name and email address. We store the offers and rules a merchant creates, including selected product and variant identifiers and titles, reward settings, and configured customer or location conditions.

Shopify Functions evaluate the cart and checkout information needed for a merchant's configured rules. This can include cart contents, buyer sign-in status, customer tags or spending information, and delivery location. RuleKit does not store individual customer records in its own database. We do not receive payment card details.

How we use information

We use this information to authenticate the store, display and manage its configuration, synchronize offers and rules with Shopify, apply the configured cart and checkout behavior, keep the service secure, and provide support. The public RuleKit site and app do not use advertising or remarketing trackers. Authentication and essential session technologies may be used to operate the app.

Sharing and hosting

RuleKit uses Shopify's APIs and platform to operate the app and its checkout functions. The application is hosted on a Hetzner server. Our hosting provider may process information needed to deliver and secure the service. We do not sell merchant or customer information or share it for third-party marketing. We may disclose information when required by law or to protect the service and our rights.

Retention and deletion

We keep store installation details and merchant-created configuration while the app is installed. When Shopify notifies us that the app was uninstalled, we delete its active sessions. On Shopify's authenticated shop-redaction request, we delete the store's offers, rules, engine state, and remaining sessions from the live database. RuleKit does not maintain individual customer records to return or erase in response to customer privacy requests.

Server access and error logs may contain an IP address, store domain, and technical error details. We keep them for operation, security, and troubleshooting, and remove them when they are no longer needed for those purposes. Manual database backups may retain copies after live records are deleted. We keep those backups only while needed for recovery and remove them when they are no longer needed. Contact us if you need help with a deletion request.

Security

RuleKit uses HTTPS for its public endpoints, Shopify authorization for store access, and authenticated Shopify privacy webhooks. Access to the server and stored information is limited to people who need it to operate and support the service. No internet service can guarantee absolute security.

Your choices and rights

Depending on your location, you may be able to request access to, correction of, or deletion of personal information we hold. Email support@specialcase.net with a privacy question or request. A merchant can also uninstall RuleKit through Shopify.

Changes

We may update this policy as RuleKit changes. The date at the top of this page will show when it was last updated.