Last updated: 22 September 2026
Your information.
Handled with purpose.
This notice explains how Balkaniq Apps uses information for RewardLift, our public website and our support service.
Who is responsible
RewardLift and Balkaniq Apps are operated by CARINUSH MEDIA SRL, CUI 49060650, registered in Romania under J2023020851401. Registered office: Str. Grigore C. Moisil 3, Bl. 7, Sc. 3, Et. 4, Ap. 159, Sector 2, Bucharest, 023791, Romania. Contact contact@balkaniq-apps.com for privacy questions.
For store-directed shopper processing, the merchant determines the purposes and we provide the app on its behalf. The store's privacy notice also applies. CARINUSH MEDIA SRL is responsible for its own business enquiries, support administration and service-abuse prevention.
Information involved
- Store information: store identifier, domain, app settings, installation and subscription status, and store partnership profiles supplied by merchants.
- Reward participation: email address, associated store and campaign, reward or discount information, verification status and timestamps, and recorded marketing preference where collected.
- Shopify contact syncing: a Shopify customer identifier and relevant app tags or segment information when the store enables contact syncing.
- Technical information: session identifiers, game activity and delivery or error information needed to operate, secure and troubleshoot the service.
- Support information: the contact details and content you choose to send us.
RewardLift does not need a shopper's payment card details to issue a reward or verify an email. Please do not send payment details or passwords to support.
Why we use this information
We use information to run configured reward games, evaluate gift eligibility, issue requested rewards, send requested verification messages, sync contacts when configured by the store, manage subscriptions, provide support and prevent misuse.
Email verification confirms access to an address. It is separate from marketing consent. Stores remain responsible for their marketing permissions and communications. We do not sell shopper email addresses.
For our own processing, we use business contact information to answer requests and administer the service, relying on the steps needed to enter or perform a contract where applicable, and our legitimate interests in support, security and preventing abuse. Legal obligations may require particular records to be retained. The store determines the legal basis for its shopper activities. Providing an email is necessary for an email-verified reward, not for simply viewing this website.
Who helps provide the service
Shopify provides the store platform and relevant customer, discount and billing interfaces. Oracle Cloud Infrastructure Email Delivery provides verification email delivery, configured in the Frankfurt region. Cloudflare hosts and secures this public website and forwards support emails to our support inbox, hosted by Google Gmail.
Providers receive the information necessary for their role. For example, Oracle needs a recipient address and message to deliver a requested email and maintains delivery-suppression information. Amazon SES was used during earlier setup tests; it is not the active delivery provider. Information may also be disclosed where necessary to comply with a lawful request or protect the security of the service.
Website cookies and app storage
This presentation website does not include advertising trackers, visitor analytics scripts or an email sign-up form. The hosting provider may process technical request information for delivery and security.
RewardLift running inside a store uses browser session or local storage as needed for features such as remembering a dismissed game or preventing repeated reward prompts. The store's configuration and other store apps can affect its wider cookie and consent requirements.
Retention and deletion
- Verification links: normally expire after 24 hours; stores can choose between 1 and 72 hours. Only a token hash is stored, and expired hashes are cleared by scheduled cleanup.
- Participation records: unconfirmed sign-ups are removed after 30 days; verified local reward participation records after 365 days from creation. Cleanup runs hourly, allowing active operations to complete safely. This does not delete contacts already synchronized into Shopify.
- Store records: removed 30 days after uninstall, or earlier following authenticated Shopify redaction. Minimal keyed usage identities are retained while a store remains installed to prevent duplicate subscriber charges.
- Access and rights records: completed privacy-request contact identifiers are cleared after 30 days; security access logs and expired support sessions are retained for up to 365 days.
- Email safety: allowance counters and suppression entries use keyed hashes, not plaintext recipient lists. Expired allowance counters are eligible for cleanup after two days; feedback-event identifiers after 90 days. Suppression entries remain while necessary to prevent unwanted messages.
- Support and backups: closed support correspondence is normally deleted after 90 days. Encrypted database backups expire after 30 days; any restore is isolated until later deletions and retention rules have been reapplied. A documented legal or security obligation may require specific records to be kept longer, with restricted access and periodic review.
RewardLift handles Shopify's customer data requests and customer or store redaction notifications. Read the Data Processing Agreement for merchant instructions, safeguards and the provider inventory. Contact us for an authorized export or deletion request.
Requests about your information
If you are a shopper, contact the store first for access, correction or deletion of its customer information or to change its marketing preferences. You can also write to contact@balkaniq-apps.com, naming the store and the request. We may verify identity and coordinate with the store before responding.
Depending on where you live, you may have rights to access, correct, delete or restrict the use of your information, withdraw consent where processing relies on it, or complain to your local privacy authority.
Where applicable, you may also object to processing based on legitimate interests and request data portability. In Romania, the supervisory authority is ANSPDCP (dataprotection.ro). To stop unwanted RewardLift verification messages, follow the support instructions; changing a store's marketing preferences is a separate request.
Security and international processing
We use authenticated, tenant-scoped access, restricted service permissions, access logs, encrypted database storage and backups, encrypted connections and time-limited verification links. No system can guarantee absolute security. Contabo hosts the RewardLift deployment; Fly.io hosts existing GiftCart services during migration. Providers operate internationally, including legacy hosting in the United States. Applicable safeguards and provider details are described in our Data Processing Agreement; we do not promise EU-only processing.
Updates
We update this notice as our service and operating arrangements change. The date above identifies the latest version. Contact us if you have questions about how a change affects your information.