Terms of Service and Data Processing Addendum

Effective date: November 13, 2026

These terms are an agreement between CounterQuest, 15 Hershey Rd, Shippensburg, PA 17257, United States ("CounterQuest", "we", "us") and the business that installs the CounterQuest app on its Shopify store ("you", the "merchant"). They have two parts: the Terms of Service and the Data Processing Addendum ("DPA"), which covers how we handle your customers' personal data. Our Privacy Policy describes the same data in more detail and forms part of the DPA.

Part 1: Terms of Service

1. Acceptance

By installing or using CounterQuest you accept these terms, including the DPA, on behalf of your business. If you do not accept them, do not install the app, or uninstall it. The person installing the app confirms they are authorized to accept these terms for the business.

2. The service

CounterQuest is a rewards and loyalty app for Shopify stores. It lets your customers earn points from purchases and from other activities you choose to reward (such as events, check-ins and trade-ins), and redeem them as discount codes or gift cards online or at the Shopify POS register. It also provides VIP tiers, badges, quests, want lists, notifications, reports, backups, imports from other loyalty apps and related features. Features may change as we improve the app.

3. Your account

Your account is your Shopify store. Access to CounterQuest follows access to your store: anyone you allow to use the app in Shopify admin or Shopify POS can use it on your behalf, and you are responsible for their actions. Keep your Shopify accounts secure and tell us promptly if you believe the app has been misused.

4. Fees and trial

• CounterQuest is a paid subscription at the price shown on our Shopify App Store listing when you subscribe: currently $29 per month or $290 per year, with a 14-day free trial. Founding shops keep the lower price we offered them ($19 per month).
• All charges are billed through Shopify's app billing and appear on your Shopify invoice. Shopify's billing terms apply to those charges, including taxes, currency and payment.
• You can cancel at any time by uninstalling the app, or change plans in the app. Refunds are limited to those Shopify provides under its billing terms.
• If we change prices, we will give you at least 30 days' notice, and the new price applies from your first billing period after that.

5. Your responsibilities

• Your program: you decide how your rewards program works and you are responsible for the program terms you give your customers, including point values, eligibility and any changes. CounterQuest can write program terms from your settings to help, but they are your terms.
• Lawful use: you will use the app only for lawful purposes and in line with Shopify's terms, and not to send spam, mislead customers, or run promotions that are unlawful where you operate.
• Notices and consents: you will give your customers the privacy notices, and get the consents, that the law requires for the data the app processes for you (for example marketing consent, birthdays and push notifications), and you have a lawful basis to share that data with us.
• Settings: you are responsible for your tax, discount, points and reward settings being accurate and right for your business, and for checking imported balances before you apply an import.

6. Availability

We make reasonable efforts to keep CounterQuest running, secure and working with Shopify, and to fix problems promptly. We do not guarantee that the service will be uninterrupted, error-free or always compatible with Shopify or other apps, which can change without notice. Maintenance, outages at Shopify or our hosting providers, and events outside our control can affect the service.

7. Data ownership

You own your store data, including your customers' rewards data, and most of it is stored in your own Shopify store. You can export your members and backups as spreadsheets at any time from the app. We use your data only to provide the service to you, as described in the DPA and our Privacy Policy. We may use aggregated information that identifies no person or store (for example, how many stores use a feature) to operate and improve CounterQuest.

8. Suspension

We may suspend or limit access to the app if your subscription is unpaid after any grace period, if the app is used in breach of these terms or the law, or if your use threatens the security or stability of the service or other merchants. Where practical we will tell you first and give you a chance to fix the issue.

9. Disclaimer

CounterQuest is provided "as is" and "as available". To the extent the law allows, we disclaim all other warranties, express or implied, including merchantability, fitness for a particular purpose and non-infringement. Rewards are discounts and gift cards in your store, and their cost to your business is yours.

10. Limitation of liability

To the extent the law allows: (a) neither party is liable for indirect, incidental, special, consequential or punitive damages, or for lost profits, revenue, goodwill or data, even if told they were possible; and (b) each party's total liability arising out of or relating to these terms is limited to the fees you paid for CounterQuest in the 12 months before the event giving rise to the claim. These limits do not apply to your payment obligations or to liability that the law does not allow to be limited.

11. Changes to these terms

We may update these terms as the app or the law changes. We will change the effective date above and, for material changes, tell merchants by email or in the app at least 30 days before they take effect. If you keep using the app after that date, you accept the updated terms; if you do not accept them, you can uninstall the app.

12. Termination

You can end this agreement at any time by uninstalling the app. We can end it with 30 days' notice, or right away if you materially breach these terms. When it ends, your subscription stops and your data is deleted as described in the DPA (section 11). Export anything you want to keep before uninstalling. Sections 7, 9, 10 and 13 of these terms, and the DPA's confidentiality and deletion terms, survive termination.

13. Governing law

These terms are governed by the laws of the Commonwealth of Pennsylvania, USA, without regard to its conflict-of-laws rules. The state and federal courts in Pennsylvania have exclusive jurisdiction over any dispute, unless the law where you are based requires otherwise.

14. General

These terms, with the DPA and the Privacy Policy, are the whole agreement about CounterQuest. If any part is unenforceable, the rest stays in effect. Not enforcing a term is not a waiver of it. You may transfer this agreement only with our consent or as part of a sale of your business; we may transfer it as part of a sale or reorganization of CounterQuest. Neither party is liable for delays caused by events beyond its reasonable control.

15. Contact

Help with the app: support@counterquest.app. Privacy and data protection: privacy@counterquest.app. Post: CounterQuest, 15 Hershey Rd, Shippensburg, PA 17257, United States.

Part 2: Data Processing Addendum

This DPA is part of the Terms of Service and applies whenever CounterQuest processes personal data about your customers or staff for you. You accept it by installing or using the app. If this DPA conflicts with the Terms of Service on personal data, this DPA wins.

1. Roles

For your customers' and staff's personal data, you are the controller (the "business" under the California Consumer Privacy Act and similar US state laws), and CounterQuest is your processor (your "service provider" or "processor" under those laws). For merchant account data, such as your store domain and billing status, CounterQuest is a controller, as described in the Privacy Policy.

2. Details of the processing

• Subject matter: providing the CounterQuest rewards and loyalty app to your store.
• Duration: while the app is installed, plus the deletion periods in section 11.
• Nature and purpose: reading, storing, updating and deleting data to run your rewards program as you set it up: awarding and taking back points, issuing and applying rewards, showing balances and progress to customers and staff, alerts and notifications, imports, reports, backups and exports.
• Categories of data: customer identifiers (Shopify customer ID, referral codes); name, email address and phone number; points balances and history, badges, quests and other activity counters; birthdays, if collected; interests the customer picks; order totals, items, discount codes and refunds used to award points; customer tags and email marketing status; gift card last four characters and balances, and store credit balances; want lists; push notification subscriptions; files you upload to import from another loyalty app (which can include names, emails, phone numbers, balances, birthdays and tiers); and records of manual points changes by staff.
• Data subjects: your customers (including people listed in import files) and the staff who use the app.
• Sensitive data: the app is not designed for special categories of data (such as health data) or payment card data, and you should not put them into it.

3. Instructions

We process personal data only on your documented instructions, unless the law requires otherwise (in which case we will tell you first, if the law allows). Your instructions are these terms, the settings you choose in the app, and the actions you and your staff take in it, such as turning on a feature, running an import or requesting a customer's deletion. We will tell you if we believe an instruction breaks data protection law.

4. Confidentiality

Only people who need access to run and support the service can access personal data, and they are bound by confidentiality obligations. We access a store's data only to provide, secure, support or fix the service, or when the law requires it.

5. Security

We use appropriate technical and organizational measures to protect personal data, including:

• HTTPS for all connections to the app;
• encryption at rest provided by our hosting and database providers;
• a dedicated database login limited to the app's own data;
• verification of requests: Shopify's signature on webhooks and storefront (app proxy) requests, and Shopify session tokens for admin and register requests;
• 2-step login on the accounts we use to run the service, strong unique passwords, and secrets kept only in our host's environment settings, never in source code;
• an access log of staff views and exports of customer data in the app, kept for 90 days;
• collecting and keeping as little data as we can: most rewards data stays in your own Shopify store, backups hold customer IDs only, and import files are cleared a day after the import finishes;
• a written security incident response plan, reviewed at least once a year.

6. Sub-processors

You authorize us to use the sub-processors listed under "Service providers" in our Privacy Policy: currently Shopify, Vercel, Supabase, Resend, Cloudflare, Google Fonts (our website only) and browser push services. Each is bound by data protection terms that protect personal data at least as well as this DPA, and we remain responsible for their work. We give notice of changes by updating that list and its effective date before a new sub-processor handles your data, and we email merchants about significant changes. If you object on reasonable data protection grounds, email privacy@counterquest.app; if we cannot resolve the objection, you can end the agreement by uninstalling the app.

7. Data subject requests

We help you answer your customers' requests to access, correct, delete or port their data. On each customer's page in the app you can download everything the app holds about that customer, and your staff can correct points and profile details. Deletion requests sent through Shopify (customers/redact) are carried out as described in the Privacy Policy. If a customer contacts us directly about your store, we will refer them to you.

8. Assistance

Taking into account the nature of the processing and the information available to us, we will give you reasonable help with security, breach notifications, data protection impact assessments and consultations with authorities that relate to the app.

9. Personal data breaches

If we become aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to your personal data, we will notify you without undue delay, and within 72 hours of confirming it. We will tell you what happened, which data and stores are affected, what we have done and what you should do, and keep you updated as we learn more, so you can meet your own notification duties. We will also notify Shopify as its terms require.

10. Return of data

While the app is installed you can export your members (CSV), backups (spreadsheets) and any customer's data from the app at any time. Most rewards data is stored in your Shopify store itself.

11. Deletion

When you uninstall the app we delete its access sessions right away. Shopify sends a shop deletion request (shop/redact) about 48 hours after uninstall; when it arrives we delete all of your store's data in our database, as listed in the Privacy Policy, unless the law requires us to keep it. App-owned data stored in your Shopify store is removed by Shopify on its own rules and timing. Our hosting providers' short-term logs and backups expire on their normal schedules.

12. Audits and information

On written request to privacy@counterquest.app, once a year (or more often after a breach affecting your data, or when a regulator requires it), we will give you reasonable written information showing how we comply with this DPA, such as answers to a security questionnaire and a description of our measures and sub-processors. Information we share is confidential.

13. International transfers

We and our sub-processors process data in the United States (some providers run global networks). Where the law requires a transfer safeguard, for example for data from the EU, EEA, UK or Switzerland, transfers rely on the Standard Contractual Clauses (and the UK addendum) in our sub-processors' data processing terms. To the extent the law requires them between you and us, the Standard Contractual Clauses (controller-to-processor module) are incorporated into this DPA by reference.

14. US state privacy laws (CCPA and similar)

As your service provider, CounterQuest will not: sell your customers' personal information, or share it for cross-context behavioral advertising; keep, use or disclose it for any purpose other than providing the app to you, or outside our direct business relationship with you; or combine it with personal information from other sources, except as those laws allow a service provider to do. We will give it the level of privacy protection those laws require, tell you if we can no longer meet these obligations, and let you take reasonable steps to stop and fix any unauthorized use. We understand and will comply with these restrictions.

15. Liability

Each party's liability under this DPA is subject to the limitation of liability in the Terms of Service, to the extent the law allows.