Skip to content
Install free

Just Curious Privacy Policy

Last updated: October 12, 2026

Just Curious: Purchase Survey ("Just Curious" or "the app") is provided by Duskford Digital, a trade name of SAB Ventures LLC ("we", "us"), 30 N Gould St, STE R, Sheridan, WY 82801, USA. You can contact us at justcurious@duskforddigital.com.

This policy explains what personal information the app processes when a Shopify merchant installs it, and when that merchant's customers answer its survey after checkout.

Our role

  • Merchant information: we decide how it is used.
  • Information about the merchant's customers: we process it on the merchant's behalf, only to provide the app. The merchant controls it. Customers with questions about their data should contact the store first. We help the store respond.

What we collect

From merchants, when the app is installed

  • Store details from Shopify: the store's domain, time zone and currency.
  • Access credentials: the access credentials Shopify issues so the app can work with the store.
  • App settings:
    • the survey question, answers, follow-up questions and thank-you line;
    • display options, such as shuffling answers or asking first-time buyers only;
    • the store's plan and monthly response count.
  • Klaviyo connection (Pro, only if the merchant connects it):
    • the private API key the merchant pastes, stored encrypted, of which only the last 4 characters are ever shown again;
    • whether the connection is working.

About the merchant's customers, when they answer the survey

The survey appears on the store's Thank you and Order status pages. Answering is optional. When a customer answers, we keep:

  • which order: the order's Shopify ID, its number (such as #1001), its date, and whether it was a test order;
  • the order's value: its total, currency, and the date it was cancelled, if it was, kept up to date when the order is refunded, edited or cancelled;
  • the answer:
    • the option the customer chose;
    • any text they typed in "Other" or in a follow-up question;
    • which page they answered on;
  • whether it was their first order, as the Thank you page reports it;
  • how tracking says they arrived: the visit source and type, and the UTM source, medium and campaign for the first and last visit, as Shopify recorded them for the order. We never store the referring URL, the landing page or a referral code;
  • a 0–10 score, if the store asks how likely the customer is to recommend it.

Typed text can contain anything the customer chooses to write. Stores should not ask for sensitive information in their questions.

Read to run the app, but not stored:

  • the customer's Shopify ID, or for a guest the order's confirmation number, compared once to check the answer belongs to that order;
  • the customer's number of orders, to show the survey to first-time buyers only;
  • Pro stores with Klaviyo connected: the email address on the order, read when the answer is sent to the store's Klaviyo account (see "Who we share it with") and not kept by us.

Never read: customers' names, phone numbers, addresses, payment details, or the items they bought. We do not collect or store payment card details.

Data requests

When Shopify passes on a customer's request for their data, we keep the customer's Shopify ID and the orders the request names, so the merchant can see what to send. Shopify's request also includes the customer's email and phone; we don't keep those. We delete the request 30 days after it arrives.

Server logs

Like any website, our hosting provider records technical details of each request to the app, such as the IP address, browser type and time. We use these logs only to keep the app running and secure. Our own logs never contain customers' email addresses, typed answers or API keys.

How we use it

  • To show the survey, and to check each answer belongs to the order it is for.
  • To show the merchant reports: the share of each answer, and for Pro stores the orders, revenue and average order value behind each one. Pro stores also see what tracking recorded next to what customers said.
  • Klaviyo (Pro, only if the merchant connects it): to add the customer's answer to their profile in the store's own Klaviyo account, as profile properties: what they answered, any typed details, the date, and the 0–10 score if the store asks for one.
    • If the buyer isn't in that Klaviyo account yet, Klaviyo creates a profile for them.
    • We never subscribe anyone, and never change anyone's marketing consent.
    • Test orders are never sent.
    • The key the merchant provides could also read their Klaviyo profiles, but the app only uses it to send these properties and to check the key works.
  • Shopify Flow (Pro): if the merchant builds a flow with our "Survey answered" trigger, we pass the order ID, the answer, any typed text and the score to that flow within Shopify.
  • CSV export (Pro): to let the merchant download their responses. Exports contain no email addresses or other contact details.
  • To apply the merchant's plan limits. Plans are billed by Shopify.
  • To provide support, keep the app secure, and meet legal obligations.

We do not sell personal information. We do not use it for advertising. We do not make automated decisions about anyone that have legal or similarly significant effects.

Who we share it with

We share information only with the service providers needed to run the app, and only for that purpose:

  • Shopify: the platform the app runs on, billing, and Shopify Flow.
  • Vercel: application hosting.
  • Neon: database hosting.
  • Klaviyo, only when a Pro merchant connects their own Klaviyo account. We send the email address and the survey answer described above to that account. Once the answer is in the merchant's Klaviyo, the merchant controls it under their agreement with Klaviyo, including deleting it when a customer asks.

We may also disclose information when the law requires it, or as part of a merger or sale of the business. In that case the commitments in this policy continue to apply.

Where it is stored

Information is stored with our providers in the United States. Where data from the EU, the UK or elsewhere is transferred to the US, we rely on appropriate safeguards, such as our providers' standard contractual clauses.

How long we keep it

  • Survey responses are kept for 25 months, long enough to compare a month with the same month a year earlier, and then deleted automatically. They are deleted sooner:
    • when Shopify tells us a customer's data must be deleted (a customer redaction request), for the orders named in it;
    • when the store's data is deleted after the app is uninstalled, about 48 hours after uninstall.
  • The Klaviyo key is deleted when the merchant disconnects Klaviyo, and as soon as the app is uninstalled.
  • Email addresses are never stored.
  • Data requests are kept for 30 days after they arrive.
  • Merchant information is kept while the app is installed, and deleted with the store's data after uninstall.
  • Server logs are kept by our hosting provider for a short time and then deleted automatically.

Security

We protect the information we hold:

  • encryption in transit (HTTPS) and at rest, including backups;
  • Klaviyo keys are also encrypted by the app itself (AES-256), tied to the store they belong to;
  • access to production systems is limited to the owner, with strong, unique passwords and two-factor authentication;
  • any direct access to production data is logged, and the log is reviewed monthly;
  • a written security incident response process.

Your rights

  • Merchants can ask to access, correct, export or delete their information by emailing justcurious@duskforddigital.com.
  • Customers should contact the store. The store can send us their request through Shopify. When it does, the merchant sees that customer's survey answers on the app's Customer data requests page, and we help the store respond within the time the law requires.
  • Depending on where you live (for example under the GDPR, the UK GDPR or California law), you may have rights to:
    • access, correct and delete your information;
    • object to or restrict processing;
    • data portability;
    • not be discriminated against for using these rights.

We do not sell or share personal information for cross-context behavioral advertising.

Children

The app is not directed to children under 16, and we do not knowingly collect their information.

Changes

If this policy changes, we will update the date above. If the change is significant, we will tell merchants by email or in the app.

Contact

Duskford Digital (SAB Ventures LLC), 30 N Gould St, STE R, Sheridan, WY 82801, USA. justcurious@duskforddigital.com