Legal
Privacy Policy
Last updated: October 16, 2026
1. Who we are
LBSMS ("Low Budget SMS", "we", "us") is an SMS marketing app for Shopify stores, operated by Pluri Ventures LLC, Austin - Texas. You can reach us at [email protected].
2. Our role
- Merchants (Shopify stores that install LBSMS): we are the controller of the account and billing information we need to provide the service.
- Merchants' customers (people who receive texts): the merchant is the controller. We act as a processor on the merchant's behalf and only process this data to deliver the service the merchant uses. Questions about these texts should go to the store that sent them first; we will help the store answer.
- Website visitors: we are the controller of the minimal technical data described below.
3. Data we process
Merchants
- Store details from Shopify: store domain and name, contact email, currency, time zone and storefront address.
- Settings you choose in the app: sender name, opt-out text, quiet hours, campaigns, automations and segments.
- Credit balance and purchase history. Payments are processed by Shopify; we never see card details.
- A Shopify access token, stored encrypted, so the app can work on your behalf.
Merchants' customers
- From Shopify: first and last name, phone number, SMS marketing consent status and date, country, customer tags, number of orders, amount spent and last order date. We do not copy email addresses or postal addresses.
- For abandoned checkout texts: phone number, first name, the checkout recovery link and cart total, kept for up to 30 days.
- Messages: the text sent, phone number, delivery status, cost and the number of clicks on links in the text (we do not record the clicker's IP address).
- Opt-outs: phone numbers that unsubscribed, so they are never texted again by that store.
- Sign-up forms (store pop-up, hosted sign-up page, QR code): phone number, country, first name if given, the form used and the date. This is passed to Shopify to record the SMS marketing consent. The sender's IP address is used only to limit abuse and is discarded within two hours.
- Discount codes: when a store uses {discount_code}, a code is created in the store's Shopify account and linked to the text, so orders using it can be attributed.
Website visitors
Our web server records standard technical logs (IP address, date, requested page, browser type) to keep the service secure and working. The public website uses no analytics, advertising or tracking cookies.
Hosted sign-up pages may use Cloudflare Turnstile to tell people from bots. The store pop-up keeps a small entry in the visitor's browser storage to remember that it was closed or completed, so it is not shown again; it is not used for tracking.
4. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing the app: syncing customers, sending campaigns and automated texts, reporting results | Performance of our contract with the merchant (Art. 6(1)(b)); for customers' data, the merchant's instructions under our processing terms (Art. 28) |
| Billing and credit management | Contract (Art. 6(1)(b)) and legal obligations such as accounting (Art. 6(1)(c)) |
| Respecting opt-outs and quiet hours | Legal obligation (Art. 6(1)(c)) and legitimate interests (Art. 6(1)(f)) |
| Security, fraud and abuse prevention, server logs | Legitimate interests (Art. 6(1)(f)) |
| Support requests | Contract or legitimate interests |
Marketing texts are only sent to customers whose SMS marketing consent is recorded in Shopify. Merchants are responsible for collecting that consent lawfully.
5. Service providers
We use these providers to run LBSMS. Each only receives the data it needs:
| Provider | Purpose | Data |
|---|---|---|
| Shopify | App platform, data source and billing | Store and customer data described above |
| Plurinetworks (SMS gateway) | Delivering text messages to mobile networks | Recipient phone number, sender name and message text |
| US | Hosting of our servers and database | All data stored by the app |
| Cloudflare | Bot protection (Turnstile) on our staff login and on hosted sign-up pages | Technical browser data and IP address needed for the check |
Mobile network operators handle each text to deliver it to the recipient. We do not sell personal data and do not share it for advertising.
6. International transfers
Some providers may process data outside the European Economic Area. When that happens, we rely on an adequacy decision or the European Commission's Standard Contractual Clauses, together with additional safeguards where needed.
7. Retention
- Customer and message data is kept while the store uses LBSMS, so the merchant can see results and history.
- When Shopify asks us to delete a customer's data (customers/redact), we delete the customer record, cancel any queued texts and anonymise their messages.
- When a store uninstalls the app, Shopify sends a deletion request 48 hours later (shop/redact) and we delete all of that store's data.
- Abandoned checkout data is deleted after 30 days; technical webhook records after 7 days; IP addresses used to limit sign-up abuse within two hours.
- Sign-up records are kept while the store uses LBSMS and are deleted with the customer's data.
- Billing records are kept for as long as accounting and tax law requires.
8. Security
All traffic uses HTTPS. Shopify access tokens are encrypted at rest (AES-256-GCM). Access to the servers and to our staff portal is restricted, protected with two-factor authentication and logged. No system is perfectly secure, but we work to protect your data and will notify affected merchants and authorities of a personal data breach as the law requires.
9. Your rights
Under the GDPR and similar laws you can ask to access, correct, delete or export your personal data, to restrict or object to its processing, and to withdraw consent at any time. Customers can stop marketing texts at any time with the opt-out link included in every marketing message.
If you are a customer of a store, the quickest route is to contact that store; you can also write to [email protected] and we will pass your request to the store and help it respond. You also have the right to complain to your data protection authority.
10. Cookies
The public website and hosted sign-up pages set no cookies of their own. Inside Shopify, the app authenticates with Shopify session tokens and does not use tracking cookies. The store pop-up stores one browser-storage entry (no cookie) to avoid showing again. Our staff portal uses one strictly necessary session cookie.
11. Children
LBSMS is a business service for Shopify merchants and is not directed at children.
12. Changes and contact
We may update this policy as the service changes. We will post the new version here with a new date and, for material changes, let merchants know in the app or by email. For any privacy question, contact [email protected].