Clear about
your information.

1. Who we are

SweepSpot is operated by Steven Vining in Jenks, Oklahoma, United States. SweepSpot provides Shopify merchants with sweepstakes administration tools. The merchant determines its promotion rules, eligibility and prizes and generally directs our processing of participant data.

Privacy lead: Steven Vining, responsible for protection of personal information. Contact him through laziz@cogotulsa.com. This is our temporary support/privacy contact during prelaunch. Our dedicated address, support@sweepspotapp.com, is being configured.

2. Information we process and why

Depending on the features a merchant uses, SweepSpot processes:

• Merchant and account information: Shopify store and authorized staff identifiers, settings and subscription status, to authenticate access, operate the app and verify plan limits.
• Participant information: Shopify customer identifiers, names, email addresses and phone numbers, to match entry records, display entry history and support merchant-directed winner contact.
• Order and entry information: order identifiers, dates, eligible products, amounts, discounts, refunds, calculated entries and adjustments, to apply the merchant’s rules and reconcile changes.
• Alternative entries and referrals: submitted contact information, eligibility attestations, referral attribution and awards, to review entry requests and apply configured rewards.
• Winner evidence: entry snapshots, draw history and merchant review records, to support a verifiable selection record.
• Service and support records: correspondence, request metadata, restricted keyed hashes and minimized error/security diagnostics, to resolve requests, protect the service and prevent duplicate processing.

Shopify handles subscription approval and billing. SweepSpot does not need payment-card credentials. Please do not place unnecessary sensitive information in notes or support messages.

We do not sell participant information, use it for unrelated marketing or targeted advertising, or use it to train general-purpose AI models. Merchant marketing is governed by the merchant’s notices and choices.

3. Providers, sharing and locations

Authorized merchant staff can view and export their store’s information. Exported copies downloaded by merchants are under their control. We also use Shopify, Vercel, Supabase, Upstash and Sentry for the purposes described in our service-provider list.

The public app’s primary database and application-function region are in the United States. Hosting networks, provider operations and support may involve other countries. Applicable contractual safeguards and transfer requirements must be addressed for the markets in which the service is offered.

We may disclose limited information when required by law or reasonably necessary to investigate misuse, protect people or secure the service. If ownership of the service changes, information may transfer with the service subject to appropriate notice and applicable obligations.

4. Privacy requests and consent choices

For access, correction, deletion or questions about a promotion, contact the merchant running it. You can also contact SweepSpot concerning the app’s processing. Identify the merchant and the request; we may verify your identity and coordinate with the merchant before acting. We do not request identity documents as a default first step.

Merchants can manage Shopify privacy requests through the app. Verified requests take precedence over ordinary retention, except where a specific legal obligation requires limited retention. We review linked records, generated files and retained copies rather than treating deletion of a single entry as complete erasure.

Referral attribution in supported storefront integrations requires Shopify analytics and marketing consent. Merchants must configure Shopify’s privacy controls appropriately. Withdrawing consent stops further attribution and clears the app’s cart attribution. This public website has no advertising pixels, analytics scripts, contact form or optional cookies; hosting providers still process connection metadata to deliver and secure pages.

5. Retention and deletion

We keep information for the service purposes above and apply shorter retention when a verified request requires it. Standard generated campaign exports currently expire after 24 hours; privacy review archives expire after seven days. Expiry also starts physical file cleanup; downloaded merchant copies are separate. The operator has adopted the following retention targets for launch:

Prelaunch implementation status: daily campaign expiry is active with reviewed retention holds and verified export/journal safeguards. Access-audit records expire after 30 days; completed privacy-review notes are minimized after 24 months. Standalone referral and billing-usage expiry is active with attribution, activity, campaign/award and billing-period safeguards. Provider internal-copy limits and safe erasure-journal expiry remain under review. Public installation remains closed while launch controls are completed.

Successful and skipped webhook payloads are cleared after processing. Privacy review archives have a seven-day expiry. Restricted erasure suppression records must remain available while an older backup or replay could recreate erased data, then be removed once that risk ends. A backup must be recovered in isolation and later erasures reapplied before serving data.

Uninstalling stops app access. It does not prove that all copies are immediately erased. Where a specific legal obligation requires retaining a limited record, we document the reason, restrict its use and review its expiry.

6. US launch scope and Canadian privacy requests

Our current planned merchant launch is United States only. Canadian merchant availability, including Quebec, is deferred. The Canadian request information below applies where relevant; this notice does not announce public installation or certify compliance.

Processing outside your province or country

SweepSpot operates from Oklahoma. Its primary application database and function region are in the United States, so Canadian information can be processed outside Canada and Quebec. Provider networks and authorized support may involve other countries. Information may be accessible to courts, law enforcement or other authorities under those countries’ laws. We use contractual and security safeguards; we do not promise Canadian data residency. See the providers and purposes. Merchants remain responsible for their participant notices and any required assessment and written agreement before a transfer.

Access, correction, portability and complaints

You may ask what personal information is held about you, how it is used and disclosed, request access or correction, withdraw consent where applicable, and request deletion subject to applicable limits. Where Quebec law applies, you may also request qualifying computerized information collected from you in a structured, commonly used technological format, including transfer to an authorized recipient where required. Information created or inferred by the service is not necessarily covered by that portability right.

Contact the merchant for campaign records or our privacy lead through laziz@cogotulsa.com. State the store and request; we use proportionate verification and secure delivery. We aim to respond within 30 days, subject to applicable legal deadlines and permitted extensions. If access is restricted, we explain the applicable reason and review options as required. We do not automatically require government identification or a complete customer export.

You can raise a privacy complaint with Steven Vining through that contact. We review it and explain our response. You may also contact the Office of the Privacy Commissioner of Canada or the appropriate provincial regulator, including the Commission d’accès à l’information du Québec. Your rights depend on the applicable law and our role in the processing.

Entry calculations and review

SweepSpot automatically calculates entries using order events and merchant-configured rules, and provides tools for randomized selection. The merchant controls eligibility, official rules and final prize administration. Ask the merchant to explain the information and main rules used, correct inaccurate inputs, and arrange human review of a disputed result. This notice does not represent every configured promotion as free of exclusively automated decisions; merchants must provide any required decision notice and review route.

Incidents and limited retained records

We investigate suspected confidentiality incidents and coordinate with affected merchants. Where applicable, regulatory and individual notification duties are assessed promptly. Limited statutory incident records can outlast routine compliance notes: PIPEDA breach records are kept for at least two years where required, and Quebec incident-register records for at least five years after awareness where required. These restricted records do not justify retaining all participant data or raw exports.

Sentry documents indefinite retention of organization audit logs, separately from its 30-day Developer event window. Other provider security/account logs and internal copies have their own terms and are still under review; our routine app-log targets do not promise their deletion.

7. Security, incidents and updates

Controls include authenticated app access, restrictions between stores, HTTPS, protected credentials and minimized diagnostics. Access and erasure requests are reviewed for authorization. No system can promise absolute security, and this notice does not claim an independent certification.

We investigate suspected incidents and notify affected merchants as applicable, providing known scope and response steps. Material changes to this notice will be dated here and communicated through an appropriate service or merchant channel.