Compliance
GDPR & SMS consent
LBSMS is built so that sending SMS marketing in Europe stays compliant by default. Here is how it works and what remains your responsibility as a merchant.
Consent comes first
Marketing texts require the recipient's prior, explicit consent. LBSMS only includes customers whose SMS marketing consent is recorded as subscribed in Shopify — for example, through the checkout, a signup form, or the opt-in at your point of sale. Consent is checked again just before every marketing text is sent. We recommend you review your consent wording and records with a legal adviser.
Sign-up forms that collect consent properly
The LBSMS store pop-up, hosted sign-up page and QR code ask for explicit consent: the checkbox is never pre-ticked, your consent text and privacy policy link are shown next to it, and the consent is recorded in Shopify with its date and source. Only countries you allow are accepted, and repeated or automated sign-ups are blocked. New subscribers can receive a welcome text, which also includes the opt-out link.
Easy opt-out in every marketing text
Every marketing text includes an unsubscribe link. When a customer uses it, they are unsubscribed immediately, their status is updated in Shopify, and the number is added to your store's suppression list so it is never texted again unless the customer subscribes anew. You can also remove consent manually in the Shopify admin.
Quiet hours
By default, automated marketing texts are not sent between 21:00 and 09:00 in the recipient's local time. You can change the hours, block Sundays, and set rules per country — for example, stricter hours in France.
Frequency caps
Limit how many marketing texts each customer receives per week and set a minimum gap between them. Texts over the limit are skipped and are never charged.
Transactional vs marketing
Order confirmations and shipping updates are service messages and do not include an opt-out link. Campaigns, abandoned checkout reminders, welcome texts and Flow marketing texts are treated as marketing.
Data minimisation
We only copy the customer fields needed to target and send texts (name, phone, consent, country, tags and purchase totals). Sign-up forms only ask for a phone number, country and, optionally, a first name. We do not copy email or postal addresses, and we do not use customer data for any other purpose.
Deleting data
- Customer deletion requests sent through Shopify are processed automatically: the customer record and sign-up records are deleted, pending texts are cancelled and past messages are anonymised.
- When a store uninstalls LBSMS, all of its data is deleted 48 hours later when Shopify sends the store deletion request.
- To ask us directly to delete data, write to [email protected].
Processor terms
For your customers' data, you are the controller and LBSMS is your processor. A data processing agreement is available on request at [email protected]. See our Privacy Policy for the list of service providers and retention periods.