Last updated: DATE
FanDX Shop is a Shopify app operated by Loaded Holdings, Inc. It gives a merchant's Discord community members a Discord role based on what they have bought in that merchant's Shopify store, and can send each of them a single-use discount code.
This policy covers the FanDX Shop app only.
The merchant who installs FanDX Shop is the controller of their customers' data. Loaded Holdings is a processor acting on that merchant's instructions. A customer asking to see or delete their data should ask the store; the routes for both are described under Deleting your data below.
Nothing about a customer until that customer asks for it. Installing the app collects no customer data. A customer connects their own Discord account, from the store, by signing in and authorising it themselves. Before that moment the app holds nothing about them and no reward rule can reach them. There is no pre-ticked box and no processing that begins at install.
Once a customer connects, the app holds:
From Shopify
| Data | Why |
|---|---|
| Shopify customer ID | To link that customer to their Discord account |
| Lifetime spend and order count at the moment of linking | To evaluate reward rules against past purchases |
| For each subsequent order: order ID, customer ID, amount, currency, timestamp, and the discount codes applied with the amount each took off | To keep spend current, and to show the customer what their rewards have saved them |
The app never receives line items, names, email addresses, phone numbers, shipping or billing addresses, or payment information. The order webhooks name the fields they want, so Shopify sends only those and the rest never arrives.
From Discord
| Data | Why |
|---|---|
| Discord user ID, username, display name and avatar | To identify the member and show the merchant who is linked |
| The date they joined the server, and whether they boost it | Two reward triggers read these |
| The roles they hold in that server | To know what has already been granted, and what to take back |
The app keeps a cached copy of the merchant's Discord server membership so it can evaluate rules without querying Discord constantly. A member who leaves the server stays in that cache, marked as departed, rather than being deleted. It is removed when the customer's data is deleted, or when the app is removed from the store.
Three operations and no others:
fandx namespace: the Discord user ID, the date they connected, and the roles they hold.The app also creates discount codes. Each is single-use, restricted to the one customer who earned it, and created only when a rule the merchant wrote has already granted that customer a reward. The Discord username appears in the discount's title in the merchant's Shopify admin, in the form FanDX Shop: <reward> for <username>, so a merchant can tell the app's codes apart from their own.
The app creates no orders, no products and no price rules. It does not read, modify or delete the merchant's own discounts.
Role assignments, and nothing else. No product, order, spend or customer information is sent to Discord at any point.
The one message a member receives is the reward itself: the role they earned, the name of the server, the discount code, what it is worth, and the store's domain. It contains nothing about their orders or what they have spent.
shop/redact request deletes it outright.Three routes, all implemented:
customers/redact request deletes that customer's connection, spend records, granted roles, issued codes and any stored webhook payloads. shop/redact removes the store entirely.All traffic is over HTTPS. Shopify access tokens are encrypted at rest with AES-256-GCM using a key held in the environment, separately from the database. The database is managed PostgreSQL on Railway, which encrypts data at rest at the storage layer.
Shopify customer IDs and Discord user IDs are never written to logs in plain text. They are pseudonymised with a keyed hash first, so logs can be correlated for debugging but not reversed without the key.
Railway hosts the application and the database. No analytics, error tracking or advertising service is used, and no customer data is sold or shared with anyone else.
TO CONFIRM who at Loaded can reach the production database, and how that access is controlled.
The app decides one thing automatically: whether a customer holds a Discord role, based on thresholds the merchant sets. It has no legal or similarly significant effect, and a merchant can exclude any member from any reward.
Development runs against a Shopify development store and synthetic data the app generates itself. Real customer data is not copied into development.
Affected merchants are notified within TO CONFIRM: 72 hours of a confirmed breach, by email to the contact on the store, with what was accessed and what has been done about it.
TO CONFIRM: privacy contact address
Loaded Holdings, Inc.