Last updated: October 2026

Subi is a Shopify app built and operated by Nextwave Digital Ltd. Wherever this Privacy Policy says “Subi”, “we” or “us”, it means Nextwave Digital Ltd. This policy describes how we collect, use, store and protect information when you use the Subi app and this website (together, the “Service”). “You” means the merchant who installs the Service, and “Visitors” means the people who visit or buy from your Store.

1. Information Collected

Information You Provide to Us

  1. Information of your Store which is accessible from your Shopify account:
  2. Shop resource: the Store’s general settings and information, including name, domain, currency, language, location, and contact email address
  3. Products: the Store’s product catalog, including details on each product variant, titles, descriptions, prices, images, and collections;
  4. Orders: the store’s orders including details of the customer, their cart, and any transactions;
  5. Storefront: the store’s themes, including all files, pages, texts, assets, and script tags.
  6. Information about you or your Visitors:
  7. Device Information: We may collect certain information about the devices you use or your Visitor uses with the Service, including such data as unique device identifiers, device brand, and model, device name, push notification identifiers, Internet Protocol (IP) address, operating system, time zone, language, and browser types.
  8. Usage Information: We may collect information about how people use the Service or Store. This data may include Service usage times, visited pages, clicked links, ordered products, page view times, and linked IPs. We may keep track of how you interact with links across our Services by redirecting links or through other means.
  9. Location Information: We may also automatically collect your physical location if you choose to enable your computer or mobile device to send us location information.
  10. Cookies and Other Tracking Information: For commercial purposes and personalized services, the permission of setting cookies is taken from you and these cookies will be placed on your computer which, among other uses, allow you to sign in to your Account in a browser and maintain an identified browsing session with the Subi app.

2. Use of Information

  1. We use the collected information in order to provide the Service, improve its features, and develop new features such as the following purposes:
  2. To process requests or transactions you initiate by accessing or using the Service;
  3. To monitor and analyze usage and trends in order to improve the Service, or to improve your experience with the Service, for example by providing personalized content, features, or advertisements for you or your Visitors;
  4. To verify your identity or your Visitors’ identity, in order to protect your privacy and keep data protected;
  5. To contact or notify you or your Visitors of security alerts, important updates to our Terms of Service or this Privacy Policy, or support your use of Service and respond to your comments, questions, and requests;
  6. To link or combine with information we get from others to help understand your needs or provide you with better services;
  7. To detect, investigate, and/or prevent fraudulent, unauthorized, or illegal activity.
  8. We may also analyze the collected information, provide and publish some charts and statistics with commercial usages for public use, or publish their results in a targeted and usable way for various institutions or businesses, and present them to their owners. We may also use this information to develop other services. All of these usages are with fully protecting your and your Visitors’ privacy, without any Personal Information being made available or traceable to others. Therefore, except in cases of legal and judicial requirements, we never provide or sell information that can be identified as belonging to who (you or one of your users) to others.

3. Protecting, Securing, and Sharing Information

  1. With your consent: When you give us consent to do so, including if we notify you that the information you provide will be shared in a particular manner and you provide such information.
  2. With Third-Party Services: We share necessary Data with Third Party Services, consultants, or others who are working with us and need access to such information to carry out work on our behalf, and in this way, we can provide you the Service. Any Data used by such parties is used only to the extent required by them to perform the services that we request. Any use for other purposes is strictly prohibited. Furthermore, any Data that is processed by third parties will be processed within the terms of this privacy policy and in accordance with the UK Data Protection Act 2018 and the GDPR.
  3. In response to legal process or a request for information: If we believe disclosure is in accordance with any applicable law, rule, or regulation, we may share your Personal Information with appropriate individuals in such cases:
  4. Applying any applicable law, rule, regulation, or court judgment
  5. Applying Terms of Service that can be applied for inspections or detecting violations
  6. In order to investigate or remedy potential violations of our user agreements or policies
  7. to protect the rights, property, and safety of Subi, our users, or others, which is necessary or allowed due to regulations.
  8. Inside the Company: Employees of Subi whose job responsibilities require access to Personal Information are provided with such access and will use it solely to provide service and support to Clients, and these employees are subject to strict rules on the protection and confidentiality of information.

Sharing Non-Personal Information

We may share information that does not identify you or your Visitors, such as aggregated statistics about how the Service is used. Anything we publish or share in this way is aggregated or de-identified first, so that it cannot reasonably be traced back to you, your Store, or any individual.

4. Storing and Deleting of Information

We store the information described in this policy on the cloud servers the Service runs on, and with the service providers we use to run it, which today include our hosting, support, email, SMS, error monitoring and analytics providers. We keep it while the Service is installed on your Store.

When you uninstall the Service. Shopify sends us a request to erase your Store’s data 48 hours after you uninstall. We carry it out 28 days after we receive it, so that nothing is lost if you reinstall in that time, and a reinstall cancels it. We then replace the contact details on your Store’s account and its owner’s login with a one-way hash, clear your Store’s street address, delete your Store’s custom logo, and erase the personal information of every customer of your Store, as described below. We keep your Store’s settings, including any email addresses you entered in them, and the records of its subscriptions and orders, with your customers’ personal details removed.

When a Visitor asks to be erased. When one of your customers asks you to erase their data, Shopify sends us the request and we carry it out 28 days after we receive it. We erase that customer’s name, email address, phone number, saved payment method details and delivery address (we keep only its country and region), the notes on their subscriptions, and the copies of their details held in our order, email, SMS and webhook records.

What we keep after an erasure. A record that a phone number or an email address has opted out or unsubscribed, so that the opt-out keeps being honoured; the record of a customer’s consent to receive SMS, with its phone number; a birthday month and day saved for a loyalty reward; the reason a customer wrote when cancelling a subscription; the text of messages we sent, without the address they went to; and the files you uploaded to import or bulk-edit subscriptions, which can contain your customers’ details.

When a Visitor asks for a copy. When one of your customers asks you for the data held about them, Shopify sends us the request, and within a day we email your Store’s address a file with the records we hold about that customer’s details, subscriptions, saved payment methods, consents, messages and orders, or a note saying we hold none.

We began carrying out these requests automatically in October 2026. Requests Shopify sent us before then have not yet been carried out, and we will update this page when they have.

These steps cover our own databases. They do not edit our backups or system logs, and they do not reach copies held by the service providers in section 3 or by apps you connect to your Store, such as Klaviyo, which those parties delete on their own schedules. You can also ask us directly for a copy of the data we hold about your Store, or ask us to erase it, by writing to [email protected]. We answer within 30 days.

5. Changes in business ownership and control

If Subi is involved in a merger, an acquisition, a financing, or a sale of all or part of its assets, information covered by this policy may be transferred as part of that transaction. We will tell you before your information becomes subject to a different privacy policy, and until then whoever receives it is bound by this one.

6. Changes to this Privacy Policy

We may update this policy as the Service changes or as the law requires. When we do, we post the updated policy on this page and change the date at the top of it. If a change affects how we use information you have already given us, we will tell you by email or inside the app before it takes effect. If you keep using the Service after an update, you accept the updated policy.

7. DPA and GDPR Subject Rights

Where the GDPR applies, we process personal data on one of these legal bases:

Under the GDPR you have the following rights, and you can exercise any of them by writing to [email protected]:

Information covered by this policy may be processed outside the country you are in, by us and by the service providers we use to run the Service. If you are in the EEA or the UK, you also have the right to complain to your local data protection authority.

8. Your California Privacy Rights

If you live in California, the California Consumer Privacy Act, as amended by the CPRA, gives you the right to know what personal information we collect about you and how we use and disclose it, the right to ask us to erase it, the right to ask us to correct it, and the right not to be treated differently for exercising any of these rights.

We do not sell personal information, and we have not sold any in the last twelve months. The information we collect, why we collect it, and who we disclose it to are described in sections 1, 2 and 3 of this policy. This website uses Google Analytics, PostHog and Hotjar to understand how it is used.

Where we handle information about a Visitor, we do so as a service provider to the store that Visitor shopped at. If you are a Visitor, send your request to that store, which can pass it to us through Shopify.

To exercise any of these rights, write to [email protected]. We check a request against the email address on the account before we act on it. You may use an authorised agent, and we will ask that agent to show that you authorised them.

9. Children’s Privacy

The Service is built for businesses and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, write to [email protected] and we will erase it.

10. SMS / Text Messaging

Where the Service sends SMS messages to your Visitors on your behalf, you are responsible for having their consent to be messaged. We keep the phone number, the message and its delivery result, so that we can send the message, show you what happened to it, and bill you for it. Message and data rates may apply to the person receiving the message. A recipient can stop the messages by replying STOP, and a number that has opted out is suppressed across every store using the Service, not only the store it replied to.