Champ › BigCommerce privacy policy
BigCommerce privacy policy
Champ for BigCommerce · Effective 6 November 2026
This policy explains what Champ for BigCommerce collects when a merchant installs it on a BigCommerce store, what it does with that data, and how to get it removed. It describes actual practice. Champ for Shopify has its own privacy policy.
Who we are#
Champ for BigCommerce is a BigCommerce application operated by 
. Contact: support@getchamp.net.
There are two groups of people in this policy: merchants, who install Champ on their BigCommerce store, and community members, who are the merchant's own customers posting in that merchant's community. For community content, the merchant is the data controller and Champ is the processor acting on their instructions.
What we collect from merchants#
- Your store hash, store name, storefront URL, time zone, currency, store address and the store's admin and order email addresses, read from BigCommerce at install.
- The user ID and email address of each control panel user who opens Champ, so the right people can manage the community.
- An API access token that lets Champ work with your store, stored encrypted. It is deleted when you uninstall Champ.
- Community settings you choose in Champ: spaces, appearance, moderation rules and notification options.
- Billing status and plan, from BigCommerce. Champ never sees or stores a payment card.
What we collect from community members#
- The BigCommerce customer ID, name, email address and customer group of members who sign in, so posts can be attributed, notifications sent and private spaces respected.
- Content members submit: discussions, replies, reactions, follows, reports and display names.
- The name and email address of a guest who posts without signing in, where the merchant allows guest posts. A guest's email address is never shown on the storefront.
- When the merchant turns on "Verified owner" badges: which products a member has bought and how many orders they have placed. Champ stores product IDs and an order count, not order contents, prices or addresses.
- Read state, notifications and email preferences, so unread counts and digests work.
Champ does not store IP addresses with posts. An IP address is used briefly in memory to limit request rates and is not kept.
Access scopes#
Champ asks BigCommerce for these scopes, and uses each only for the purpose stated:
| Scope | Why Champ needs it |
|---|---|
| Customers: read | Identify a signed-in customer and their customer group. |
| Orders: read | Show "Verified owner" badges, when the merchant turns them on. |
| Products: read | Link discussions to products and show product names and images. |
| Content: modify | Create the community page on your storefront. |
| Checkout content: modify | Add the Champ storefront script. |
| Information & settings: modify | Read store name, currency, time zone and address. |
| Sites & routes: modify | Keep old links working when you change the community URL. |
| Channel settings: read | Detect which storefronts the store runs. |
| App extensions: manage | Add the Champ panels to product and customer pages in the control panel. |
| Metafields access: standard | The lowest level BigCommerce offers. Champ does not read or write metafields. |
Champ does not read payment data and does not change orders, products or customers.
Cookies and browser storage#
Champ sets no cookies. A signed-in member's session token is kept in the browser's session storage for that tab, and an unfinished post draft is kept in local storage on the member's device. Neither is sent to anyone else. There is no advertising network, no third-party analytics tracker and no cross-site profiling in the community.
This marketing site — getchamp.net, the pages you are reading now — uses Plausible Analytics, which we host ourselves. It sets no cookies, stores no personal data and does not follow you to any other site. It is not loaded on merchants' storefronts.
Who we share it with#
Nobody, except the service providers needed to run the app:
- BigCommerce — authentication, store and customer data, and billing.
- Our hosting and database providers — where the application and its database run.
- Cloudflare R2 — encrypted database backups.
- Our email delivery provider — to send notification and digest emails.
Spam checks run inside Champ. Post content is not sent to an outside spam service.
We do not sell personal data, and we do not use community content to train machine learning models.
Retention#
Community content is kept while Champ is installed. When a merchant uninstalls Champ, the API access token is deleted at once. The rest of the store's data is kept for 30 days, so that a reinstall in that time restores the community, and is then deleted. After that, Champ keeps only the store hash and the trial dates, so a reinstall does not start a second free trial. A merchant can ask us to delete the data sooner at any time (see below). The text of a post that a moderator removes is cleared after 90 days. When BigCommerce tells Champ that a customer was deleted, Champ removes that member, their reactions, reports and held posts, and shows their published posts as "Former member". Encrypted backups are kept for 7 days and then deleted.
Your rights#
Members should contact the merchant whose community they posted in — the merchant controls that data. Merchants can download all community data from Champ › Settings › Data, and can email us to delete a store's data or a member's data at any time. We confirm when the data is gone, including from backups as they expire.
Changes#
If this policy changes materially, the effective date above changes with it and merchants are notified by email.