Privacy Policy

• Account details. Your name, email address and password. We store the password only as a secure hash, never as the password itself. If you sign up with Google, Google gives us your name, email address, Google account ID and profile picture.
• Your connected accounts. When you connect Whop and Shopify, we store the access credentials those services issue us, encrypted, along with your Whop business ID and your store's address. We read your Shopify catalogue and write paid orders back to your store.
• Billing. We charge our platform fee to a card you add. Stripe collects and holds that card. We never see or store the full card number.
• How you use Pendym. The pages you visit on pendym.com and the steps you take in onboarding and the dashboard (see section 3).
• Device and browser details. Your IP address and browser user agent, and the advertising cookie and click IDs described in section 4. We store these with your account when you sign up, sign in or connect an account.
• What you send us. Feedback you send from the dashboard, and emails you send to hello@pendym.com.

• To create and secure your account and keep you signed in.
• To run the service: connect your Whop and Shopify accounts, run your checkout, write orders back to your store, show your dashboard and help with disputes.
• To charge the platform fee.
• To send you account emails, such as sign up and password reset codes.
• To understand how Pendym is used and to make it better.
• To measure which of our ads bring in merchants (section 3).
• To reply when you contact us.

We do not sell your personal information for money.

We advertise Pendym on Meta (Facebook and Instagram), X and Google, and use their tools to measure which ads lead to merchants signing up and setting up.

Where they run. Only on our marketing pages, sign in and onboarding. They never run in the Pendym dashboard or on any checkout page, so they never see shopper information.

What they receive in the browser. The Meta pixel, the X pixel and the Google tag see the pages you visit on those parts of the site, events such as starting or finishing sign up, and the cookies and device details those companies use to recognise a browser. Google's enhanced conversions also reads the contact details you type into our sign up form, hashes them in your browser, and sends the hashed values to Google.

What they receive from our servers. So that we can count milestones even when a browser blocks these tags, we also report them from our servers through Meta's and X's conversion APIs. The milestones are signing up, connecting Whop, connecting your store, your checkout going live, and your store's first order. With each one we send a hashed (SHA-256) copy of your email address, your IP address and browser user agent, and the click ID from the ad you clicked, if there was one. Meta also receives your hashed name, hashed country and a hashed account ID. A hashed value is scrambled so that the company can only match it against details it already holds.

These companies use what they receive under their own privacy policies: Meta, X and Google.

Product analytics. We use PostHog to see how pendym.com and the dashboard are used. It records page views and specific events we choose, and once you sign up or sign in it links them to your account, including your name and email address. We have switched off PostHog's session recording and automatic click capture, and we remove the query part of page addresses before anything is sent. PostHog never runs on checkout pages.

Pendym sets these cookies on pendym.com:

• Sign in. Keeps you signed in, for up to 30 days.
• Ad click IDs. If you arrive from a Meta or X ad, we keep the click ID from the link for up to 90 days so a later sign up can be credited to that ad. Only our servers can read these.
• Connection security. Short lived cookies that protect the Shopify and Whop connection steps. They expire within minutes.

Meta, X, Google and PostHog set their own cookies on the pages where their tools run, as described in section 3.

If you are buying from a store that uses Pendym, that store is responsible for your information and its own privacy policy applies. Pendym processes your details on the store's behalf so the checkout can work.

When you check out, we collect:

• Contact and delivery details. Your email address, name, shipping address, phone number if the store asks for it, any order note, and whether you chose to receive marketing.
• Your order. The items, prices, shipping method and any discount code.
• Your IP address and approximate country. Used to price the order for your market, to help detect fraud, and as evidence if a payment is disputed.
• A browsing ID. The store's Pendym code keeps a random ID in your browser that links the products you viewed and your cart to your checkout, for the store's own sales reports.

Your card. You enter your card into Whop's secure payment form, and Whop handles it. Pendym never receives or stores your full card number.

Your details are shared with:

• The store you are buying from, in its Shopify admin and its Pendym dashboard.
• Shopify, where your order and customer record are created. Once you enter your email address, the store's customer list can be updated with it, so the store can follow up if you do not finish. You are only added to the store's marketing if you tick the box.
• Whop, which processes your payment and, if a payment is disputed, receives the order details as evidence.

Pendym's own advertising and analytics tools never run on checkout pages. A store can add its own tracking tools, such as Meta, TikTok or Google, to its checkout. That is the store's choice and is covered by the store's privacy policy.

To see, correct or delete your details, contact the store you bought from. We will help the store respond.

We use these companies to run Pendym:

• Vercel, which hosts the site.
• Neon, which hosts our database.
• Stripe, which handles platform fee billing.
• Whop, which processes payments on Pendym checkouts and holds the Whop account you connect.
• Shopify, where your store, its orders and its customers live.
• Resend, which sends our emails.
• PostHog, for product analytics (section 3).
• Google, if you choose to sign in with Google.
• Meta, X and Google, to measure our advertising (section 3).

These companies handle information only to provide their service to us, except the advertising companies, which also use what they receive under their own policies. Some of them store and process information in the United States and other countries.

We may also share information if the law requires it, to protect Pendym, our users or others from fraud or harm, or as part of a sale or merger of our business, in which case this policy continues to apply.

Passwords are stored only as secure hashes. The credentials for your connected Whop and Shopify accounts are encrypted before we store them. Everything sent to and from Pendym is encrypted in transit. No system is perfectly secure, and if we learn of a breach that affects your information, we will tell you.

We keep your account information while your account is open. We may keep order, billing and dispute records for longer where we need them for accounting, legal or dispute reasons. Sign in sessions end after 30 days and ad click cookies after 90 days. When you close your account, we delete or anonymise your personal information, apart from what we have to keep by law.

Depending on where you live, you may have the right to access, correct, delete or export your personal information, and to object to or restrict some uses of it. To make a request, or to close your account, email hello@pendym.com. We will reply within 30 days. You can also complain to your local data protection authority.

You can limit advertising tracking yourself:

• Block or delete cookies in your browser settings, or use a tracker blocker.
• Meta: your ad preferences, in Accounts Centre in Facebook or Instagram.
• X: Settings, then Privacy and safety, then Ads preferences.
• Google: My Ad Center.

Pendym is a service for businesses and is not directed at children under 16. We do not knowingly collect information from children.

When our practices change, we update this page and the date at the top. If a change is significant, we will also email merchants.

Questions or requests about privacy: hello@pendym.com.