Customer Data Policy

Applies to: Participating organizations, their authorized users, and Shopify-connected stores

1Purpose and Scope

This Customer Data Policy explains how Phaeros Inc. (“Phaeros,” “Orbit,” “we,” “us,” or “our”) handles customer and store information made available through a participating organization’s use of Orbit, including through a Shopify connection.

This Policy supplements the Orbit Privacy Policy and the agreement between Phaeros and the participating organization. Where applicable, the agreement between Phaeros and the participating organization governs commercial terms and organization-specific obligations.

Orbit is a fan rewards service. Shopify does not operate, provide, or support Orbit. Orbit does not process payments, sell merchandise, fulfill orders, or issue customer refunds.

2What Orbit Needs — and What It Does Not

Orbit processes only the minimum Shopify customer, order, product, and store information reasonably necessary to provide its enabled functions.

This includes information required for:

• connecting and administering an authorized Shopify store;
• identifying eligible purchase activity;
• matching eligible purchase activity to an Orbit account where appropriate;
• calculating and maintaining program points;
• reflecting Shopify-reported refunds, cancellations, or other changes;
• administering rewards;
• processing applicable Shopify privacy requests;
• maintaining security and preventing fraud or abuse;
• providing support and troubleshooting; and
• providing related Orbit services.

For a Shopify-connected program, Orbit requests only the Shopify access needed for its applicable functions. This currently includes access to orders and products.

Only Shopify stores with USD as their store currency are currently supported for connection to Orbit.

Orbit does not create, modify, or delete Shopify customer, order, product, or merchant data.

Orbit may process:

• store and connection identifiers;
• Shopify customer and order identifiers;
• order, line-item, product, transaction-status, refund, cancellation, and adjustment information relevant to eligibility;
• information required to process applicable Shopify privacy requests; and
• reward-attribution and points-ledger records.

Orbit retains minimized commerce records needed to operate the rewards service. These may include store and order identifiers, order number, currency, eligible merchandise value, reward points, refund information, and purchase-attribution outcome.

Shopify customer email

Where a Shopify customer email is required as a fallback attribution check, Orbit may temporarily use the raw Shopify customer email to perform the matching process.

Orbit normalizes the email and derives a protected keyed representation for an exact match against a verified Orbit fan account.

Orbit does not persist the raw Shopify customer email in its Orbit commerce records for this purpose.

Orbit does not use fuzzy matching or matching based on a customer’s name, phone number, physical address, or other unrelated information.

Orbit does not require or retain customer phone numbers, physical addresses, payment information, or shipping information for purchase attribution or rewards administration.

Orbit does not need payment-card data to provide its functions and does not process the underlying payment or refund.

Shopify access credentials and tokens are protected using appropriate security controls.

3Rewards Calculation and Data Use

For purchase-based programs, the standard rule is 100 points per eligible U.S. dollar of eligible merchandise.

Orbit currently supports USD transactions only. Non-USD transactions are not eligible for Orbit points, and Orbit does not convert non-USD transactions for rewards purposes.

Orbit uses Shopify’s final eligible line-item amount as the source of truth and does not independently recalculate Shopify discounts.

Points are awarded after Shopify confirms that an order is paid.

Shipping, taxes, duties, tips, gift-card purchases, and other non-merchandise charges do not earn points. Purchasing a gift card does not earn points; eligible merchandise purchased using a gift card may earn points.

Refund and chargeback reversals are based on the final eligible refunded line-item value reported by Shopify and cannot exceed the points originally awarded for the eligible purchase.

If an order is cancelled before points are awarded, no points are awarded. If points have already been awarded, the applicable points are reversed.

A reversal may cause a fan’s actual points balance to become negative. The fan may see that negative balance while the tier or progress display floors at zero. No redemption is available while the actual balance is negative.

Orbit does not provide manual point adjustments.

4Information Shared With Participating Artists and Labels

Orbit is designed to limit the Shopify customer information available to participating organizations.

Participating artists and labels may access limited fan participation and reward information needed to administer their authorized program. This may include:

• an artist-scoped or pseudonymous fan reference;
• participation status;
• points balance;
• tier information;
• qualifying activity;
• reward activity; and
• redemption information.

Participating artists and labels do not receive Shopify customer information through the Orbit dashboard, including:

• Shopify customer email addresses;
• phone numbers;
• physical addresses;
• payment information;
• shipping information; or
• billing information.

Participating organizations do not receive Shopify customer information simply because a purchase has been attributed to an Orbit fan account.

Label users may access only the artists and program information their accounts are authorized to access.

Orbit may provide participating labels with aggregated audience-overlap information for associated artists, such as the number or percentage of fans shared between programs. Such information does not identify an individual fan’s cross-artist identity or relationship.

Participating organizations must use information accessed through Orbit only for the authorized program purpose and in accordance with applicable law, their privacy notices, and their agreement with Phaeros.

They must not attempt to re-identify aggregate information or use information outside their authorized artist or label scope.

5Artist-Label Contact Information

When an artist accepts an invitation from a label or other participating organization, Orbit stores the artist’s verified Orbit account email as a contact email snapshot on that artist-label relationship.

Authorized members of the active label workspace may access this relationship-level contact information for purposes of administering the artist-label relationship.

The contact email snapshot is associated with the accepted artist-label relationship rather than maintained as an independent label-owned contact record.

When the artist-label relationship ends, the relationship-level contact email snapshot is removed.

If the relevant artist account is later erased, the associated relationship-level contact email snapshot is also removed.

If an artist invitation expires or is cancelled before acceptance, the invitation email is removed and no artist contact record is created for the label.

6Staff Access and Audit Logging

Phaeros limits access to customer and Shopify data to personnel and systems with a legitimate support, security, or operational need.

Access is managed using appropriate authentication and access controls and according to the principle of least privilege.

Access to protected Shopify customer data may be recorded in audit logs for security, accountability, and operational review.

Protected customer-data access audit records are retained for up to 12 months.

Phaeros conducts a monthly review of applicable protected customer-data access records and permanently failed Shopify webhook processing.

Only authorized staff may access protected customer data for a documented operational or support purpose. Employee administrative access requires MFA. Staff must not copy customer data into general support tickets, chat, source code, or test environments.

7Security Safeguards

Phaeros maintains administrative, technical, and organizational safeguards designed to protect customer data, limit unauthorized access, and detect and respond to security events.

Shopify access credentials and tokens are protected using appropriate security controls.

Specific security measures may vary based on the systems and services used to operate Orbit and may be updated over time.

Additional infrastructure and security controls may be described separately in Orbit’s Security documentation.

8Subprocessors and International Transfers

Phaeros may use service providers for hosting, databases, authentication, communications, monitoring, analytics, support, and other services necessary to operate Orbit.

Service providers receive only the information reasonably necessary to provide their services and are subject to appropriate contractual or other safeguards.

Phaeros may process information in Canada and other jurisdictions where Phaeros or its service providers operate.

Where required, Phaeros uses appropriate safeguards for applicable cross-border transfers.

Phaeros will maintain appropriate information about its service providers and processing locations as required by applicable law or the applicable agreement.

9Shopify Privacy Requests and Customer Data Deletion

Shopify customer privacy requests are handled separately from general Orbit account deletion.

Where applicable, Phaeros processes Shopify’s mandatory privacy requests through Shopify’s designated mechanisms, including:

• customers/data_request;
• customers/redact; and
• shop/redact.

When Shopify-derived customer data must be deleted or deidentified, Orbit removes or deidentifies the applicable Shopify-derived information in accordance with the applicable request and requirements.

This may include applicable customer, order, refund, attribution, webhook, or related Shopify-derived information.

Where necessary to maintain the integrity of the rewards ledger, any remaining reward effect may be addressed through a compensating ledger entry. Related historical ledger information may be deidentified where appropriate.

An independent Orbit account may remain active where it can continue to operate without the removed Shopify-derived information.

Shopify privacy export files are retained for up to 30 days.

Shopify privacy request records are retained for up to 12 months.

Shopify privacy deletion markers may be retained for up to 24 months where necessary to prevent reprocessing or document the applicable deletion.

Phaeros may retain a minimal non-identifying record that a privacy request was completed where permitted and necessary for compliance.

10Orbit Account Deletion

Orbit account deletion is currently a verified, support-assisted process. Orbit does not currently provide fully automated self-service account deletion.

A user may request deletion through the Orbit privacy contact. Phaeros may verify the requester’s identity and review relevant workspace ownership, access, reward, transaction, and retention considerations before processing the request.

Deleting an Orbit account ends access to the applicable Orbit account, points, rewards, and program participation, subject to information Phaeros is required or permitted to retain.

Deleting an Orbit account does not necessarily result in the immediate deletion of every associated record.

Certain reward, redemption, transaction, audit, security, legal, or other records may need to remain for a permitted or required retention purpose. Where retained information is no longer required in identifiable form, Phaeros will delete or deidentify it in accordance with the applicable retention requirements.

A later Orbit account is treated as a new account and does not automatically restore a previously deleted points balance or rewards history.

11Uninstall, Disconnection, and Program Closure

Shopify disconnection

When an organization disconnects Shopify, Orbit stops new Shopify-derived purchase attribution for that connection.

Disconnecting Shopify does not automatically delete the independent Orbit account, points balance, or every associated record.

Existing information may continue to be retained where necessary for reward history, refund handling, dispute resolution, privacy requests, security, legal obligations, or other legitimate purposes.

The organization must stop using Shopify-derived information previously accessed through Orbit except as permitted by law and its obligations.

Shopify shop redaction

Following a Shopify deletion or shop-redaction request, Orbit removes or deidentifies the applicable Shopify-derived information, which may include:

• Shopify installation information;
• encrypted Shopify credentials;
• store and catalogue information;
• orders;
• refunds;
• webhook receipts; and
• privacy export files.

Non-identifying records necessary to document completion of the action or prevent reprocessing may remain for the applicable retention period.

Completed, unsupported, or permanently failed Shopify webhook receipts are retained for up to 90 days.

Shopify privacy deletion markers may remain for up to 24 months where necessary to prevent reprocessing or document the applicable deletion.

Program closure

When an organization terminates a rewards program, a 30-day wind-down period applies unless a different period is required by applicable law or an applicable written agreement.

During the wind-down period:

• no new Shopify-derived points are awarded;
• existing points remain associated with the applicable program; and
• existing eligible rewards remain available for redemption, subject to applicable reward conditions.

After the wind-down period, the program closes and redemption is disabled.

Program closure does not itself determine the retention period for records. Applicable information is retained, deleted, or deidentified according to the Orbit Data Retention Policy and any applicable legal or contractual requirements.

12Organization Responsibilities

Each participating organization represents and agrees that it:

• has authority to connect the store and authorize Orbit to process the data needed to provide the service;
• will provide customers with legally required notices and obtain any required permissions;
• will maintain accurate program terms and comply with its consumer, marketing, merchandising, and other legal obligations;
• will keep its Orbit user accounts secure and limit access to authorized users;
• will promptly notify Phaeros of suspected unauthorized access or a relevant data incident; and
• will not use Orbit data for unlawful, unrelated, or unauthorized advertising, profiling, or disclosure.

Participating organizations must not attempt to obtain, reconstruct, or infer Shopify customer information that Orbit does not make available through the service.

13Retention

Phaeros maintains specific retention periods for Orbit application data and Shopify-derived information.

The applicable periods include:

• login email cooldown records: up to 24 hours;
• unaccepted artist invitations: up to 7 days;
• email-delivery recipient records: removed after delivery, cancellation, or permanent failure;
• Shopify privacy export files: up to 30 days;
• Shopify privacy request records: up to 12 months;
• protected customer-data access audit records: up to 12 months;
• Shopify privacy deletion markers: up to 24 months;
• completed, unsupported, or permanently failed Shopify webhook receipts: up to 90 days; and
• identifiable Shopify commerce records: up to 24 months after the relevant commerce activity, unless longer retention is legally required or otherwise permitted for a specific purpose.

The artist-label contact email snapshot is retained for as long as the relevant artist-label relationship remains active and is removed when the relationship ends or the relevant account is erased.

For the complete retention schedule and end-of-retention handling, see the Orbit Data Retention Policy.

Phaeros may retain information for longer where necessary or permitted to comply with law, establish or defend legal claims, resolve disputes, prevent fraud or security incidents, maintain accounting or audit records, enforce agreements, or protect the rights and security of Phaeros, Orbit, participating organizations, and users.

Where information is retained under an exception, Phaeros will delete or deidentify it when the applicable retention purpose ends.

14Contact

For a customer data request or question, contact:

Phaeros Inc.

Email: hello@phaeros.co

Please use the subject line “Customer Data Request.”

For a suspected vulnerability or security incident, use the Security / Incident Contact process.