Privacy policy

Last updated: 15 September 2026

This version replaces the version of 28 January 2026.

This Privacy Policy explains how App Attic Ltd (“Company”, “we”, “us”, “our”) collects, uses, stores, and shares personal data when you use Lantern and our related services (“Services”).

This policy applies to:

• the Lantern Shopify application
• our website and documentation
• sales, marketing, and support communications

If you do not agree with this Privacy Policy, you should not use the Services.

1. Who we are

App Attic Ltd is a company incorporated in England and Wales (company number 13045669) with its registered office at: Flat 22 Lawford Mews, 28 Waterloo Road, Bristol, BS2 0PN, United Kingdom.

Lantern is a Shopify application developed and operated by App Attic Ltd.

2. Roles and responsibilities

Merchants

When you use Lantern to collect personal data from your customers or store visitors, you act as the data controller. You determine what data is collected, why it is collected, and how it is used.

You are responsible for:

• informing your customers that their data will be processed using Lantern
• making this Privacy Policy available to them where required
• ensuring you have a valid legal basis to collect and share their data
• obtaining any consent required for cookies and similar technologies on your storefront (see section 12)

App Attic Ltd

We act as a data processor when processing customer data on your behalf to provide the Services. We act as a data controller for our own business data, such as merchant contact details, support communications, and marketing data.

3. Personal data we collect

Data you provide to us

We collect personal data you provide when you:

• install or use the Services
• contact us for support or sales
• participate in marketing activities or events

This may include your name, email address, phone number, company name, store URL, and account configuration details.

Support and communications

When you contact us for support or communicate with us in relation to the Services, we process the information you choose to provide in order to respond to your enquiry and support the use of the Services. This may include communications from merchants, their authorised users, or, where applicable, individuals contacting us in relation to the operation of a merchant's use of Lantern.

Please do not include sensitive personal information (such as health information, payment card details, or other special category data) in communications with us, as this is not required for us to provide support or respond to enquiries.

Data collected automatically

When you use the Services or visit our website, we collect technical and usage data such as:

• IP address
• approximate location derived from IP address (country, region, and city)
• browser and device information
• operating system and language
• usage logs, timestamps, and error data

This data is used for security, performance monitoring, and analytics, and to provide merchants with reporting on how visitors interact with their quizzes.

Customer data collected through Lantern

Depending on how you configure Lantern, your customers may provide personal data such as:

• contact details (for example name, email, phone number)
• quiz responses, preferences, and selections
• product interests and interactions
• files uploaded in response to a quiz question, where you enable that question type

We process this data only on your behalf and in accordance with your instructions.

4. Special category data

Lantern does not require the collection of special category or sensitive personal data by default. However, you may choose to collect such data through quiz questions or configurations.

Where special category data is processed:

• you are responsible for identifying and relying on a valid legal basis under applicable law
• you must provide any required notices to data subjects

We process special category data solely on your behalf, under your instructions, and only to provide the Services. Where required by law, our processing relies on corresponding lawful grounds available to processors under applicable data protection laws.

5. How we use personal data

We process personal data to:

• provide, operate, and maintain the Services
• store quiz configurations and results
• enable integrations you choose to activate
• provide analytics and reporting
• respond to support requests
• ensure platform security and prevent misuse
• comply with legal obligations

We do not sell personal data.

6. Marketing and partner communications

We may use your contact details to communicate with you about:

• the Services
• updates, new features, or changes
• other services we and our partners offer

7. Data storage and location

Our primary data storage is in the European Union. Quiz data, merchant account data, and files uploaded through the Services are stored in Google Cloud data centres in the Netherlands and Belgium.

Some of the providers we use to operate, support, and monitor the Services store or process personal data outside the European Union and the United Kingdom, including in the United States. These providers are identified in our subprocessor list (see section 9).

Our own personnel are based in the United Kingdom and access personal data from there.

Where personal data is transferred outside the European Economic Area or the United Kingdom, we rely on an appropriate safeguard under Chapter V of the GDPR. Depending on the recipient, this may be an adequacy decision, the Standard Contractual Clauses, or the EU-US Data Privacy Framework where the recipient is certified under it. You can request details of the safeguard that applies to a particular transfer by contacting us.

8. Integrations and third party services

Lantern integrates with third party services such as email, SMS, analytics, automation, subscriptions, reviews, and marketing platforms.

When you enable an integration:

• you instruct us to share relevant data with that provider
• the provider processes data under its own terms and privacy policy
• Lantern is not responsible for the provider's data practices

Some integration providers may process data outside the European Union or the United Kingdom.

9. When and with whom we share personal data

We may share personal data in the following circumstances:

Service providers and subprocessors

We use trusted third party providers to operate and support the Services, including providers of:

• cloud infrastructure and hosting
• analytics and monitoring
• customer support and communications
• security, fraud prevention, and error tracking
• AI and automation services

These providers process data only under our instructions and subject to contractual data protection and confidentiality obligations.

Our current list of subprocessors is published at the link below. The list identifies each provider, the purpose for which it is engaged, and where it processes data.

We will update that list before engaging a new subprocessor or replacing an existing one, and will give merchants at least 30 days' notice of the change. If you object to a new subprocessor on reasonable data protection grounds and we are unable to resolve your concern, you may terminate your use of the Services without penalty.

AI services are used only to generate quiz content from your product catalogue and the instructions you provide. Your customers' quiz responses and contact details are not sent to AI providers.

Shopify

We receive data from and share data with Shopify as required to provide the Services and support authentication and app functionality.

Integrations chosen by you

When you enable an integration, personal data may be shared with that provider at your instruction.

Legal requirements

We may disclose personal data where required to do so by law, regulation, or legal process, or to protect our rights, users, or others.

10. International access

In addition to the storage locations described in section 7, personal data may be accessed from outside the European Union or the United Kingdom by our personnel and by our service providers, for support, maintenance, and operational purposes. Such access is subject to appropriate security, confidentiality, and transfer safeguards.

11. Data retention, uninstallation, and deletion

Customer data processed on behalf of merchants

We retain quiz submissions and the personal data they contain for as long as the app remains installed and the merchant's account is open, and in any event for no longer than 36 months from the date the quiz was completed. After that period, the data is deleted or anonymised.

When you uninstall the app, deletion of your customers' personal data happens automatically. Approximately 48 hours after uninstallation, Shopify sends us a shop redaction request. On receiving it, and without any action or request from you:

• we irreversibly overwrite the contact and network identifiers held in quiz submissions, including email address and IP address
• we withdraw all quiz submission records from the Services, so they are no longer accessible or reportable
• we permanently delete any files your customers uploaded through a quiz

This process runs on every uninstallation and cannot be disabled or opted out of.

Quiz configuration

We retain your quiz configuration, including questions, answers, logic, and appearance settings, after uninstallation so that your quizzes are still available if you reinstall the app. This configuration is your own content and does not contain your customers' personal data.

Merchant account and business data

Where we act as controller, we retain:

• account and configuration data for as long as your account is open, and for up to 12 months after it is closed
• support communications for up to 24 months
• billing and financial records for as long as required by law, which is at least six years under UK tax legislation

Backups

Deleted data may persist in encrypted backups for a limited period after deletion, after which it is overwritten in the normal backup cycle. Backups are not used to restore deleted personal data.

Deletion on request

You may request deletion of personal data at any time, including before the periods above expire. On receiving a valid request we will delete or anonymise the relevant data without undue delay, unless we are required by law to retain it.

12. Cookies and local storage

Lantern uses a small number of first party cookies and browser storage entries. We do not use third party advertising cookies and we do not use cookies to track visitors across other websites.

On a merchant's storefront

These are set by the quiz when a visitor interacts with it:

The session and referrer entries are necessary to deliver features the visitor has asked for. The A/B test and popup entries are not strictly necessary in that sense.

As the controller of your storefront, you are responsible for including these in your own cookie notice and for obtaining consent where your local law requires it, for example under the German TTDSG or the UK PECR.

In the Shopify admin

When you use Lantern inside your Shopify admin, we set a session cookie to keep you signed in. This cookie is strictly necessary for the app to function.

Managing cookies

Visitors can delete or block cookies through their browser settings and can clear local storage the same way. Blocking the entries above may mean a quiz does not remember a completed session or shows a popup more often than intended.

13. Security

We implement appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, or disclosure. These include encryption of data in transit and at rest, access controls and authentication, activity logging, and regular review of our security measures.

No system can be guaranteed to be completely secure, and use of the Services is at your own risk.

14. Data subject rights

Depending on applicable law, individuals may have rights to access, correct, delete, restrict, or object to the processing of their personal data, and to data portability.

If you are a customer of a merchant that uses Lantern, that merchant is the controller of your data. Please direct your request to them. If you contact us directly, we will tell you to approach the merchant and, where we can identify them, let you know who they are.

If you are a merchant, you are responsible for responding to requests from your customers. Where you need our help to locate, export, correct, or delete a customer's data held within Lantern, contact us at the address in section 17 and we will action your instruction without undue delay, and in any event within 30 days.

If we hold your data as controller, for example as a merchant contact, you can exercise your rights directly with us using the same contact details. You also have the right to lodge a complaint with a supervisory authority, which in the United Kingdom is the Information Commissioner's Office.

15. Children's data

The Services are not intended for use by children. We do not knowingly collect personal data from individuals under 18. If you believe a child has provided personal data through a quiz, contact us and we will delete it.

16. Changes to this policy

We may update this Privacy Policy from time to time. The updated version will be effective when published. Where a change materially affects how we process personal data on behalf of merchants, we will notify affected merchants.

17. Contact us

For privacy or data protection questions, contact:

Email: support@trylantern.com or contact@appattic.com

Address: App Attic Ltd, Flat 22 Lawford Mews, 28 Waterloo Road, Bristol, BS2 0PN, United Kingdom.

App Attic Ltd, registered in England and Wales, company number 13045669.