Cursy: Currency Converter privacy policy
Last updated
20 October 2026
In short
- Cursy has no access to orders, customers or payment data.
- We store only data about the shop and its rate settings.
- The storefront sends us no buyer data.
- After the app is uninstalled, all of the shop’s data is deleted.
Who we are
Cursy: Currency Converter (“Cursy”) is an app for Shopify stores. It is developed and supported by Base X Tech Ltd, 27 Old Gloucester Street, London WC1N 3AX, United Kingdom. This policy explains what data Cursy processes when a merchant installs it in their store.
The policy of the basetechgroup.com website is a separate document: Website privacy policy.
What Cursy receives from Shopify
Cursy does not request access to orders, customers or products. Through Shopify’s APIs it receives only the following data about the shop:
- the shop address (
*.myshopify.com) and its Shopify ID - the store currency, time zone and country
- whether prices include tax; which currencies are enabled in Shopify Markets
- the access token Shopify issues to the app at installation
- the state of the Cursy subscription (active, trial, plan), from Shopify’s Partner API
We need this data to compute the rate in the store’s time zone, check that the store sells in US dollars, warn about Shopify Markets and taxes, and give access by subscription. Cursy does not receive names, emails or other data of the store’s staff.
What we store
- The shop data listed above and the subscription state
- Rate settings the merchant enters: display currencies, rate source, fixed rate, markup, minimum rate, rounding
- The shop’s rate history: every daily rate version, its source, rules and publication time
- Server logs: the shop address, app events, and the IP address and time of requests when the Cursy admin is opened in Shopify
Cursy downloads bank rates (NBU, Monobank, PrivatBank, ECB) from their public services once for all shops. No shop or buyer data is sent to the banks.
On the storefront
| What | How it works |
|---|---|
| Requests to us | The storefront makes no requests to Cursy’s servers: the rate arrives with the page from the shop’s data in Shopify. So we receive no IP addresses, actions or other data of buyers. |
Cookie lp_cur | Remembers the chosen currency in the buyer’s browser (UAH, EUR, USD) for 30 days. It is needed for the switcher to work; it is not sent anywhere and is not used for advertising or analytics. |
| Cart attributes | Two service fields are added to the cart:
|
| Rate on the page | The store’s current rate (with source, markup and rounding rule) is embedded in the storefront page code, so any visitor can see it. |
How we use data
Only to provide the Cursy service: compute and publish the shop’s rate, show prices on the storefront, give access by subscription, answer support requests and fix failures. We do not sell data, use it for advertising or build buyer profiles.
Where data is processed
Base X Tech Ltd is based in the United Kingdom. The app and its database run on Heroku in the EU region, and so do the server logs. We use no separate log processing service.
How long we keep data
| Data | How long |
|---|---|
| Shop data, settings, subscription state, rate history | While the app is installed; after uninstall, until Shopify’s deletion request (see below) |
| Access token | Deleted immediately when the app is uninstalled |
| Server logs | Only the most recent entries in Heroku’s log buffer, not archived |
Cookie lp_cur | 30 days in the buyer’s browser |
| Public bank rates | Without limit; they contain no shop data |
What happens after uninstall
When a merchant uninstalls Cursy, we delete the access token immediately. About 48 hours later Shopify sends a request to delete the shop’s data (shop/redact), and we delete everything related to the shop: shop data, settings and rate history.
The rate metafield stays in your store, because after uninstall the app no longer has access to it; you can delete it in the Shopify admin (Settings → Custom data). We recommend clicking “Disable Cursy” before uninstalling so the rate stops being used right away.
Requests about buyer data
Cursy is subscribed to Shopify’s mandatory personal-data requests:
customers/data_request: provide a buyer’s datacustomers/redact: delete a buyer’s datashop/redact: delete a shop’s data
Cursy stores no personal data of buyers, so for the first two requests there is nothing to provide or delete. We handle the shop deletion request as described above.
Your rights
A merchant can ask for a copy of their shop’s data, its correction or deletion: email hello@basetechgroup.com from an address linked to the store and include the *.myshopify.comaddress.
For buyers: Cursy stores no personal data of yours; for questions about an order, contact the store. If you believe we have violated your rights, you can contact the data protection authority in your country.
Security
Connections to Shopify and to the database are encrypted. Every request from Shopify to the app is checked by its signature; requests without a valid signature are rejected. No payment data passes through Cursy.
Changes to this policy
If we change what data Cursy processes, we will update this page and the date at the top.
Contact
Base X Tech Ltd
27 Old Gloucester Street, London WC1N 3AX, United Kingdom
hello@basetechgroup.com
Last updated
20 October 2026