Legal
Last updated: 15 September 2026
This version replaces the version of 28 January 2026.
This Privacy Policy explains how App Attic Ltd (“Company”, “we”, “us”, “our”) collects, uses, stores, and shares personal data when you use Lantern and our related services (“Services”).
This policy applies to:
the Lantern Shopify application
our website and documentation
sales, marketing, and support communications
If you do not agree with this Privacy Policy, you should not use the Services.
App Attic Ltd is a company incorporated in England and Wales (company number 13045669) with its registered office at: Flat 22 Lawford Mews, 28 Waterloo Road, Bristol, BS2 0PN, United Kingdom.
Lantern is a Shopify application developed and operated by App Attic Ltd.
When you use Lantern to collect personal data from your customers or store visitors, you act as the data controller. You determine what data is collected, why it is collected, and how it is used.
You are responsible for:
informing your customers that their data will be processed using Lantern
making this Privacy Policy available to them where required
ensuring you have a valid legal basis to collect and share their data
obtaining any consent required for cookies and similar technologies on your storefront (see section 12)
We act as a data processor when processing customer data on your behalf to provide the Services. We act as a data controller for our own business data, such as merchant contact details, support communications, and marketing data.
We collect personal data you provide when you:
install or use the Services
contact us for support or sales
participate in marketing activities or events
This may include your name, email address, phone number, company name, store URL, and account configuration details.
When you contact us for support or communicate with us in relation to the Services, we process the information you choose to provide in order to respond to your enquiry and support the use of the Services. This may include communications from merchants, their authorised users, or, where applicable, individuals contacting us in relation to the operation of a merchant's use of Lantern.
Please do not include sensitive personal information (such as health information, payment card details, or other special category data) in communications with us, as this is not required for us to provide support or respond to enquiries.
When you use the Services or visit our website, we collect technical and usage data such as:
IP address
approximate location derived from IP address (country, region, and city)
browser and device information
operating system and language
usage logs, timestamps, and error data
This data is used for security, performance monitoring, and analytics, and to provide merchants with reporting on how visitors interact with their quizzes.
Depending on how you configure Lantern, your customers may provide personal data such as:
contact details (for example name, email, phone number)
quiz responses, preferences, and selections
product interests and interactions
files uploaded in response to a quiz question, where you enable that question type
We process this data only on your behalf and in accordance with your instructions.
Lantern does not require the collection of special category or sensitive personal data by default. However, you may choose to collect such data through quiz questions or configurations.
Where special category data is processed:
you are responsible for identifying and relying on a valid legal basis under applicable law
you must provide any required notices to data subjects
We process special category data solely on your behalf, under your instructions, and only to provide the Services. Where required by law, our processing relies on corresponding lawful grounds available to processors under applicable data protection laws.
We process personal data to:
provide, operate, and maintain the Services
store quiz configurations and results
enable integrations you choose to activate
provide analytics and reporting
respond to support requests
ensure platform security and prevent misuse
comply with legal obligations
We do not sell personal data.
We may use your contact details to communicate with you about:
the Services
updates, new features, or changes
other services we and our partners offer
Our primary data storage is in the European Union. Quiz data, merchant account data, and files uploaded through the Services are stored in Google Cloud data centres in the Netherlands and Belgium.
Some of the providers we use to operate, support, and monitor the Services store or process personal data outside the European Union and the United Kingdom, including in the United States. These providers are identified in our subprocessor list (see section 9).
Our own personnel are based in the United Kingdom and access personal data from there.
Where personal data is transferred outside the European Economic Area or the United Kingdom, we rely on an appropriate safeguard under Chapter V of the GDPR. Depending on the recipient, this may be an adequacy decision, the Standard Contractual Clauses, or the EU-US Data Privacy Framework where the recipient is certified under it. You can request details of the safeguard that applies to a particular transfer by contacting us.
Lantern integrates with third party services such as email, SMS, analytics, automation, subscriptions, reviews, and marketing platforms.
When you enable an integration:
you instruct us to share relevant data with that provider
the provider processes data under its own terms and privacy policy
Lantern is not responsible for the provider's data practices
Some integration providers may process data outside the European Union or the United Kingdom.
We may share personal data in the following circumstances:
We use trusted third party providers to operate and support the Services, including providers of:
cloud infrastructure and hosting
analytics and monitoring
customer support and communications
security, fraud prevention, and error tracking
AI and automation services
These providers process data only under our instructions and subject to contractual data protection and confidentiality obligations.
Our current list of subprocessors is published at the link below. The list identifies each provider, the purpose for which it is engaged, and where it processes data. www.trylantern.com/subprocessor-list
We will update that list before engaging a new subprocessor or replacing an existing one, and will give merchants at least 30 days' notice of the change. If you object to a new subprocessor on reasonable data protection grounds and we are unable to resolve your concern, you may terminate your use of the Services without penalty.
AI services are used only to generate quiz content from your product catalogue and the instructions you provide. Your customers' quiz responses and contact details are not sent to AI providers.
We receive data from and share data with Shopify as required to provide the Services and support authentication and app functionality.
When you enable an integration, personal data may be shared with that provider at your instruction.
We may disclose personal data where required to do so by law, regulation, or legal process, or to protect our rights, users, or others.
In addition to the storage locations described in section 7, personal data may be accessed from outside the European Union or the United Kingdom by our personnel and by our service providers, for support, maintenance, and operational purposes. Such access is subject to appropriate security, confidentiality, and transfer safeguards.
We retain quiz submissions and the personal data they contain for as long as the app remains installed and the merchant's account is open, and in any event for no longer than 36 months from the date the quiz was completed. After that period, the data is deleted or anonymised.
When you uninstall the app, deletion of your customers' personal data happens automatically. Approximately 48 hours after uninstallation, Shopify sends us a shop redaction request. On receiving it, and without any action or request from you:
we irreversibly overwrite the contact and network identifiers held in quiz submissions, including email address and IP address
we withdraw all quiz submission records from the Services, so they are no longer accessible or reportable
we permanently delete any files your customers uploaded through a quiz
This process runs on every uninstallation and cannot be disabled or opted out of.
We retain your quiz configuration, including questions, answers, logic, and appearance settings, after uninstallation so that your quizzes are still available if you reinstall the app. This configuration is your own content and does not contain your customers' personal data.
Where we act as controller, we retain:
account and configuration data for as long as your account is open, and for up to 12 months after it is closed
support communications for up to 24 months
billing and financial records for as long as required by law, which is at least six years under UK tax legislation
Deleted data may persist in encrypted backups for a limited period after deletion, after which it is overwritten in the normal backup cycle. Backups are not used to restore deleted personal data.
You may request deletion of personal data at any time, including before the periods above expire. On receiving a valid request we will delete or anonymise the relevant data without undue delay, unless we are required by law to retain it.
Lantern uses a small number of first party cookies and browser storage entries. We do not use third party advertising cookies and we do not use cookies to track visitors across other websites.
These are set by the quiz when a visitor interacts with it:
Name
Type
Lifetime
Purpose
lantern_<quiz>_session_id
Cookie
12 months
Set only when the merchant enables the “return to results” feature. Lets a returning visitor see the results of a quiz they already completed.
lantern_referrer
Cookie
12 months
Records the page the visitor arrived from, so the quiz can return them there when they close it.
lantern_<quiz>_ab_variant
Cookie
12 months
Set only while an A/B test is running. Keeps a visitor on the same version of a quiz across visits so results stay consistent.
ppf-popup-shown, ppf-popup-shown-count, ppf-popup-shown-timestamp
Local storage
Until cleared
Set only when the merchant enables the quiz popup. Records how many times the popup has been shown so it respects the merchant's frequency setting.
The session and referrer entries are necessary to deliver features the visitor has asked for. The A/B test and popup entries are not strictly necessary in that sense.
As the controller of your storefront, you are responsible for including these in your own cookie notice and for obtaining consent where your local law requires it, for example under the German TTDSG or the UK PECR.
When you use Lantern inside your Shopify admin, we set a session cookie to keep you signed in. This cookie is strictly necessary for the app to function.
Visitors can delete or block cookies through their browser settings and can clear local storage the same way. Blocking the entries above may mean a quiz does not remember a completed session or shows a popup more often than intended.
We implement appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, or disclosure. These include encryption of data in transit and at rest, access controls and authentication, activity logging, and regular review of our security measures.
No system can be guaranteed to be completely secure, and use of the Services is at your own risk.
Depending on applicable law, individuals may have rights to access, correct, delete, restrict, or object to the processing of their personal data, and to data portability.
If you are a customer of a merchant that uses Lantern, that merchant is the controller of your data. Please direct your request to them. If you contact us directly, we will tell you to approach the merchant and, where we can identify them, let you know who they are.
If you are a merchant, you are responsible for responding to requests from your customers. Where you need our help to locate, export, correct, or delete a customer's data held within Lantern, contact us at the address in section 17 and we will action your instruction without undue delay, and in any event within 30 days.
If we hold your data as controller, for example as a merchant contact, you can exercise your rights directly with us using the same contact details. You also have the right to lodge a complaint with a supervisory authority, which in the United Kingdom is the Information Commissioner's Office.
The Services are not intended for use by children. We do not knowingly collect personal data from individuals under 18. If you believe a child has provided personal data through a quiz, contact us and we will delete it.
We may update this Privacy Policy from time to time. The updated version will be effective when published. Where a change materially affects how we process personal data on behalf of merchants, we will notify affected merchants.
For privacy or data protection questions, contact:
Email: support@trylantern.com or contact@appattic.com
Address: App Attic Ltd, Flat 22 Lawford Mews, 28 Waterloo Road, Bristol, BS2 0PN, United Kingdom.
App Attic Ltd, registered in England and Wales, company number 13045669.
[
Link](#)
