Consent and DPA — visitor consent in your shop and your agreement with us
Two things govern data protection around PopUplift: your visitors' consent, collected by your cookie banner, and the data processing agreement (DPA) between you and PopUplift. This article explains both — it describes the product and is not legal advice.
The DPA
The first time you open the app, PopUplift asks you to read and accept the data processing agreement. The app can't be used further without it. The agreement is provided in German; the German version is authoritative.
The version of 2 October 2026 contains the purchase tracking addendum, which allows PopUplift to connect your popups with completed purchases; you accept it once the next time you open the app.
We announce future changes at least four weeks ahead by email to your store owner address and with a notice in the app, with a link to the new version. If you do not object before the stated day, the new version applies. To object, email privacy@popuplift.com; your current version then stays.
You can check the current state at any time under Settings → Data processing: version, status with date, who accepted, the state of Purchase tracking, and Open the agreement to read it again.
Your visitors' consent
PopUplift doesn't ask for cookies itself. It reads the decision your visitors make in your cookie banner through Shopify's Customer Privacy API — as Shopify requires of apps. If there is no answer, PopUplift treats it as “no”.
What that means for your popups:
| Without consent | With consent |
|---|---|
| Popups still appear — triggers such as time, scroll depth and exit intent need no storage | additionally, targeting based on earlier visits: pages visited, source (UTM, referrer), new or returning visitor |
| The “done” marker and frequency rules apply, because they stop a popup from reappearing again and again | the server additionally helps recognize completed popups if the browser loses the marker |
| A/B assignment only holds for the current visit | A/B assignment stays stable when the visitor returns |
| no Smart Trigger | Smart Trigger (needs marketing and analytics) |
Marketing and analytics consent are handled separately: someone who only agrees to analytics is not evaluated for targeting because of it — and vice versa. Targeting signals stay in the visitor's browser and are not sent to PopUplift.
Signing up in the popup
The email signup is a consent of its own: the visitor actively subscribes to your newsletter. So that the notice in the popup is correct, fill in Settings → Shop & legal:
- Company name (legal) — as in your legal notice,
- Privacy policy URL — your privacy policy,
- Terms of service URL — your terms.
The two URLs feed the links in your popups' privacy notices. The company name is not inserted into popups; if you want it in the notice, write it into the text yourself. You edit the notice text itself per popup in the Collection step of setup, field Privacy small print. Whether the signup runs with single or double opt-in is decided by your Klaviyo list — double opt-in is the usual choice in Germany, Austria and Switzerland. More in Klaviyo, SMS and WhatsApp.
Under Leads you see the consent and delivery status of every contact. WhatsApp contacts from your automation are explicitly marked there as not a newsletter subscription and not marketing consent.
Export CSV on the Leads page downloads every contact, email and WhatsApp, with its consent timestamps. The column marketingStatus reads Confirmed or Not confirmed. Older exports used the German values Bestätigt and Nicht bestätigt — if a spreadsheet or automation filters on this column, switch it to the English values.
Deletion and retention
- Deletion requests that Shopify passes on to apps (for example when a customer asks for their data to be erased) are carried out by PopUplift automatically.
- PopUplift deletes event data and anonymous visitors without a signup on its own after fixed periods.
- After uninstalling, PopUplift deletes your shop's data as soon as Shopify triggers it.
The full description is in our privacy policy.