Last updated: 20 September 2026

Your information.
Handled with purpose.

This notice explains how Balkaniq Apps uses information for RewardLift, our public website and our support service.

Who is responsible

RewardLift and Balkaniq Apps are operated by CARINUSH MEDIA SRL, CUI 49060650, registered in Romania under J2023020851401. Registered office: Str. Grigore C. Moisil 3, Bl. 7, Sc. 3, Et. 4, Ap. 159, Sector 2, Bucharest, 023791, Romania. Contact contact@balkaniq-apps.com for privacy questions.

For store-directed shopper processing, the merchant determines the purposes and we provide the app on its behalf. The store's privacy notice also applies. CARINUSH MEDIA SRL is responsible for its own business enquiries, support administration and service-abuse prevention.

Information involved

• Store information: store identifier, domain, app settings, installation and subscription status, and store partnership profiles supplied by merchants.
• Reward participation: email address, associated store and campaign, reward or discount information, verification status and timestamps, and recorded marketing preference where collected.
• Shopify contact syncing: a Shopify customer identifier and relevant app tags or segment information when the store enables contact syncing.
• Technical information: session identifiers, game activity and delivery or error information needed to operate, secure and troubleshoot the service.
• Support information: the contact details and content you choose to send us.

RewardLift does not need a shopper's payment card details to issue a reward or verify an email. Please do not send payment details or passwords to support.

Why we use this information

We use information to run configured reward games, evaluate gift eligibility, issue requested rewards, send requested verification messages, sync contacts when configured by the store, manage subscriptions, provide support and prevent misuse.

Email verification confirms access to an address. It is separate from marketing consent. Stores remain responsible for their marketing permissions and communications. We do not sell shopper email addresses.

For our own processing, we use business contact information to answer requests and administer the service, relying on the steps needed to enter or perform a contract where applicable, and our legitimate interests in support, security and preventing abuse. Legal obligations may require particular records to be retained. The store determines the legal basis for its shopper activities. Providing an email is necessary for an email-verified reward, not for simply viewing this website.

Who helps provide the service

Shopify provides the store platform and relevant customer, discount and billing interfaces. Amazon Web Services provides verification email delivery through Amazon SES. Cloudflare hosts and secures this public website and forwards support emails to our support inbox, hosted by Google Gmail.

Providers receive the information necessary for their role. For example, SES needs a recipient address and message to deliver a requested email. Information may also be disclosed where necessary to comply with a lawful request or protect the security of the service.

Website cookies and app storage

This presentation website does not include advertising trackers, visitor analytics scripts or an email sign-up form. The hosting provider may process technical request information for delivery and security.

RewardLift running inside a store uses browser session or local storage as needed for features such as remembering a dismissed game or preventing repeated reward prompts. The store's configuration and other store apps can affect its wider cookie and consent requirements.

Retention and deletion

• Verification links: normally expire after 24 hours; stores can choose between 1 and 72 hours. The app stores a hash of the token, not the original token. Expiry prevents its use, but does not automatically delete the shopper's participation record.
• Participation and store records: kept to provide reward recovery, store administration and configured contact syncing, until a relevant deletion request or Shopify redaction process removes them, subject to applicable obligations.
• Email safety: allowance counters and suppression entries use keyed hashes of addresses rather than plaintext recipient lists. Expired allowance counters are eligible for cleanup after two days; feedback-event identifiers after 90 days. Suppression entries remain while needed to prevent further unwanted sends. Deleting a participation record does not automatically remove this protection.
• Support and backups: kept according to the unresolved issue, security investigation, recovery need or applicable legal obligation. We do not promise immediate deletion from every backup. Contact us for the retention criteria relevant to your request.

RewardLift handles Shopify's customer data requests and customer or store redaction notifications. Uninstalling stops future app use; it does not itself erase every existing record immediately. Records already synced into Shopify remain subject to the store's own data handling.

Requests about your information

If you are a shopper, contact the store first for access, correction or deletion of its customer information or to change its marketing preferences. You can also write to contact@balkaniq-apps.com, naming the store and the request. We may verify identity and coordinate with the store before responding.

Depending on where you live, you may have rights to access, correct, delete or restrict the use of your information, withdraw consent where processing relies on it, or complain to your local privacy authority.

Where applicable, you may also object to processing based on legitimate interests and request data portability. In Romania, the supervisory authority is ANSPDCP (dataprotection.ro). To stop unwanted RewardLift verification messages, follow the support instructions; changing a store's marketing preferences is a separate request.

Security and international processing

We use measures such as authenticated app access, restricted service permissions and time-limited verification links to protect the service. No system can guarantee absolute security. Our providers operate internationally, so information may be processed outside your country; applicable safeguards depend on the service and relevant data-protection requirements.

Updates

We update this notice as our service and operating arrangements change. The date above identifies the latest version. Contact us if you have questions about how a change affects your information.