what we
collect.

If you write to us

The contact form asks for your name, your email address, your store, and optionally a sentence about who the shop is for. It is stored so that a person can read it and reply to you.

It is not a mailing list. There is nothing to unsubscribe from, because nothing is ever sent to that address except a reply from a person. It is not passed to anybody, sold, or used to build a profile. Ask us to delete it — hello@getpopuup.com — and we will, and you do not have to say why.

If you open a shop we made

A popuup shop records that a page was viewed, that a product was clicked, and that somebody went through to a checkout. That is the entire list of events — there is no fourth kind and no free-form event, and nothing recorded carries a score, a weight, or a group you have been sorted into.

Each is tagged with a random identifier generated in your browser and kept in sessionStorage. It is not derived from anything about you, it is scoped to that one tab on that one site, and it is gone when you close the tab. A popuup shop sets no cookie. That is why there is no banner asking you to accept any.

One coarse label is kept alongside: roughly where the click came from, worked out from the referrer your browser already sent — “instagram”, not a URL — plus a campaign tag if the merchant put one in the link. Nothing else about the request is stored. No IP address, no device fingerprint, no location.

The merchant whose shop it is can see the totals. They cannot see who you are, because neither can we.

If you buy something

You do not buy anything from popuup. Checkout is a Shopify cart link, pre-filled and handed to the merchant’s own store, and everything after that click is between you and them under their privacy policy. popuup never sees an order, a payment, a customer record or an address.

What we store about a merchant’s store

A store’s public product feed — the same information anybody can read from its storefront — along with the shops built from it and the sentences that produced them. That is business data rather than personal data, and it is what makes a shop able to stay current with price and availability.

Who else is involved

• Anthropic — the merchandiser sends a store’s public catalogue and the merchant’s sentence to Claude to decide what goes in a shop. No shopper data is sent, because none is collected at the point the shop is built.
• Supabase — where shops, catalogues, events and contact-form messages are stored.
• Vercel — where the site runs. It keeps its own request logs, as any host does.
• Shopify — a merchant’s own store, which handles every checkout.

That is the whole list. There is no analytics script, no advertising pixel, no tag manager, no session recorder and no chat widget on this site or on a shop.

Fonts and images

Typefaces are served from this site rather than from a font CDN, so opening a shop does not make a request to a third party carrying your address. Product photography is loaded from the merchant’s own store, which is the one unavoidable outside request a shop makes.

Your rights

Ask what we hold about you, ask for a copy, or ask us to delete it. One address, and a person reads it: hello@getpopuup.com.

This page describes the software accurately and is not legal advice. It has not yet been reviewed by a lawyer, and saying so here is better than implying otherwise. If popuup starts doing something this page does not describe, this page changes first.