Privacy Policy

1Our two roles

ChilliPopup lets businesses (“Customers”) build popups and inline forms and publish them on their own websites and stores. Depending on the data, we act in one of two capacities under the EU General Data Protection Regulation (GDPR):

• As a data controller: for the account data of our Customers and the people who sign up for and use the ChilliPopup dashboard. This policy governs that data.
• As a data processor: for the personal data that a Customer collects from visitors to the Customer's own website through ChilliPopup popups and forms (for example, an email address a visitor submits). For that data the Customer is the controller and decides why and how it is processed; we process it only on the Customer's instructions under our Terms of Use and applicable data-processing terms.

If you are a website visitor who submitted your details through a ChilliPopup popup or form on someone else's site, that business is responsible for your data. Please contact them directly, and see section 11.

2Information we collect

Account & billing data

When you create a ChilliPopup account we collect your name, email address, password (stored only as a secure hash), workspace and team details, chosen plan, and (for paid plans) billing details processed by our payment provider. We do not store full card numbers ourselves.

Content you create

The popups, forms, surveys, quizzes, wheels, coupons, display rules and settings you build and store in your workspace.

Visitor data (processed for our Customers)

Through the ChilliPopup pixel installed on a Customer's website, we collect, on that Customer's behalf: the information visitors submit in a popup or form (such as an email address or answers), and interaction events (views, clicks, closes, form submissions and spin-wheel activity), together with technical context such as the page URL, device type, and a session identifier.

Usage & technical data

When you use the dashboard or our sites we collect standard log data (IP address, browser and device information, pages viewed and timestamps) to operate, secure and improve the service.

3How we use it

• To provide, operate and maintain the ChilliPopup service and your account.
• To process visitor data strictly on our Customers' behalf and instructions.
• To take payment and manage subscriptions.
• To provide support and respond to your requests.
• To secure the service, prevent abuse and fraud, and debug problems.
• To understand usage and improve our features and performance.
• To send essential service communications and, where you have opted in, product updates.
• To comply with our legal obligations.

4Legal bases

Where GDPR applies, we rely on: performance of a contract (to provide the service you signed up for); legitimate interests (to secure, maintain and improve the service, and run our business), balanced against your rights; consent (where required, for example certain cookies or marketing emails; you can withdraw it at any time); and legal obligation (for example accounting and tax records).

5Cookies & tracking

The ChilliPopup dashboard uses a strictly necessary session cookie to keep you logged in. On a Customer's website, the ChilliPopup pixel uses local or session storage on the visitor's browser to remember which popups have already been shown (so a visitor is not shown the same popup repeatedly). It does not set advertising cookies. Our marketing site, chillipopup.com, uses a privacy-friendly, cookieless analytics tool that does not track you across sites.

6Who we share it with

We do not sell personal data. We share it only with service providers (sub-processors) that help us run ChilliPopup, under contracts that require them to protect it and use it only for us. These currently include, by category:

We may also disclose data where required by law, to enforce our Terms, or to protect the rights, safety and security of Kompassify, our users or the public. If we are ever involved in a merger or acquisition, data may be transferred as part of that transaction, subject to this policy.

7International transfers

We aim to host and process data within the European Union. Where a provider processes data outside the EU/EEA, we rely on appropriate safeguards recognised under GDPR, such as the European Commission's Standard Contractual Clauses.

8How long we keep it

We keep account data for as long as your account is active and for a reasonable period afterwards to meet legal, accounting and security obligations. Visitor data collected on a Customer's behalf is kept according to that Customer's configuration and instructions and is deleted or anonymised on request. When an account is closed, we delete or anonymise the associated data within a reasonable period, unless we are required to retain it by law.

9Security

We protect data with technical and organisational measures, including encryption in transit (HTTPS/TLS), hashed passwords, access controls, and restricted, need-to-know access for our team. No method of transmission or storage is perfectly secure, but we work to protect your data and to respond promptly to any incident.

10Your rights

Subject to applicable law, you have the right to access your personal data, and to rectify, erase, restrict or object to its processing, to data portability, and to withdraw consent at any time. To exercise these rights, contact us at contact@kompassify.com. You also have the right to lodge a complaint with a supervisory authority. In France, that authority is the CNIL.

If your data was collected through a popup or form on a Customer's website, please send your request to that Customer (the controller). As their processor, we will assist them in fulfilling it.

11Shopify & other platforms

When a Customer installs ChilliPopup through a platform such as Shopify, WordPress or Wix, ChilliPopup only adds the Customer's chosen popups and forms to their storefront. It does not request access to that store's customer, order or product records. For Shopify specifically, we honour Shopify's mandatory data-request and data-erasure (redaction) webhooks: when Shopify notifies us of a customer- or shop-data deletion request, we delete the corresponding data we hold.

When you install our app from the Shopify App Store, we automatically create a ChilliPopup workspace linked to your store, using your store's name and myshopify.com domain, so you can start building popups and forms immediately, without a separate sign-up. This account is created to perform our contract with you (to provide the app you installed); we do not enrol you in marketing emails as part of this. Billing for merchants who install through Shopify is handled entirely through Shopify's own App Pricing, not through an external payment processor. Uninstalling the app cancels the associated plan.

12Children

ChilliPopup is a business tool and is not directed to children. We do not knowingly collect personal data from children under 16. If you believe a child has provided us data, contact us and we will delete it.

13Changes

We may update this policy from time to time. When we do, we will change the “last updated” date above and, for material changes, provide a more prominent notice. Continued use of ChilliPopup after an update means you accept the revised policy.

14Contact us