Privacy Policy

Introduction

This Privacy Policy ("Policy") describes how Zipify Lab ("we", "us", or "our") collects, uses, and discloses your personal information when you visit, use our services, or interact with PerfectMatch (the "App") or otherwise communicate with us (collectively, the "Services"). For purposes of this Privacy Policy, "you" and "your" means you as the user of the Services, whether you are a Shopify merchant, website visitor, or another individual whose information we have collected pursuant to this Privacy Policy.

We are committed to protecting your privacy and being transparent about our data practices. Please read this Policy carefully. By using and accessing any of the Services, you agree to the collection, use, and disclosure of your information as described in this Privacy Policy. If you do not agree to this Privacy Policy, please do not use or access any of the Services.

Information We Collect

Store Owner Information

When you install and use our App, we collect minimal information:

• Shop Domain: Your Shopify store domain for authentication and service provision.
• Email Address: We collect and use your email address solely for the purpose of communicating about GDPR-related webhook notifications and essential service communications required by Shopify's platform policies.
• Shop Metadata: App access tokens and subscription plan information.

Product Catalog Data

To provide our AI-powered product quiz generation services, we temporarily access and process your product information including:

• Product metadata and attributes
• Product titles, descriptions, and variants
• Product images

Important: This data is processed in real-time for analysis and AI quiz generation purposes. We do not permanently store your full product catalog on our servers. Product recommendations in quizzes are stored only as Shopify GIDs.

Customer Data

While we do not collect direct Personally Identifiable Information (PII) like names, email addresses, or payment information from your customers, we do collect certain data directly from merchants' customers when they interact with the quiz widget on your storefront. This includes:

• Device and Browser Identifiers: We collect persistent identifiers (such as the Shopify _shopify_y cookie or session storage IDs) to track unique interactions.
• Quiz Interactions: We log the answers selected during the quiz, completion status, and the current URL.
• Analytics Data: This information is sent to our analytics provider (PostHog) using a distinct identifier to help you understand quiz performance, drop-off rates, and conversion metrics.

Information We Collect through Shopify APIs

When you install our App, we access certain information through Shopify's APIs under the following scopes:

• read_products & unauthenticated_read_product_listings: To read and analyze your product catalog information for AI quiz generation and product matching.
• read_themes: To integrate our quiz widget seamlessly with your storefront.
• write_metaobject_definitions, write_metaobjects, read_metaobject_definitions: To store the quiz definitions and configuration.
• read_orders: To calculate aggregated analytics related to quiz performance.
• write_subscription_charges: To process your app subscription billing.

Information We Collect through Cookies

We also automatically collect certain information about your interaction with the Services ("Usage Data"). To do this, we may use cookies, pixels and similar technologies ("Cookies"). Usage Data may include:

• Log Data: Technical logs for troubleshooting and service improvement.
• Usage Information: Information about how you interact with the App, including features used and actions taken.

For specific information about the Cookies that we use related to powering our store with Shopify, see Shopify's Cookie Policy.

How We Use Information

We use the information we collect for the following purposes:

1. Service Provision: To analyze your product catalog, generate AI-powered quizzes, and provide product recommendations.
2. Analytics: To provide you with aggregated data on quiz views, completions, and associated revenue.
3. Compliance: To comply with legal obligations and Shopify's platform requirements.
4. Security: To detect, prevent, and address security issues or fraudulent activity.
5. Technical Support: To troubleshoot issues and provide customer support.
6. Communication: To send essential service notifications and respond to GDPR webhook requirements.

Data Storage and Retention

Minimal Data Storage

We practice data minimization across different categories of data:

• Quiz Configuration: We store quiz settings, questions, and matching rules required for the quizzes to function on your storefront.
• Product Data: We do not permanently store your full product catalog data. Product information is fetched on-demand via the Shopify Admin API.
• Analytics Data & Logs: We store quiz interaction events and system logs to provide analytics dashboards and ensure app stability. Some analytics properties are hashed or anonymized where possible.

Data Retention Period

We retain different types of data for different periods:

• Active Subscriptions: Quiz configuration and store data are retained as long as the App is installed on your store.
• Upon Uninstallation: When you uninstall the App, your store is marked as inactive and our access to your Shopify data is immediately revoked. We will permanently delete your store's configuration and associated data upon receiving a valid Shopify GDPR redaction webhook (shop/redact), or after a prolonged period of inactivity in accordance with our standard retention policies.
• Analytics Events: Customer quiz interaction events and analytics data stored in our third-party analytics provider are typically retained for 12 to 24 months.
• System Logs & Webhooks: Technical logs and webhook records are retained for short periods (e.g., 30 to 90 days) for debugging and security purposes.
• Session Data: Temporary session data is deleted upon session expiry.

Data Sharing and Disclosure

We Do Not Sell Your Data

We do not sell, rent, or trade any information to third parties for marketing purposes.

Service Providers

We may share limited information with trusted third-party service providers who assist us in operating our App:

• AI Processing Services: (e.g., Anthropic, OpenAI) For providing AI-powered quiz generation.
• Analytics Services: For understanding App usage and compiling analytics (PostHog).
• Cloud Infrastructure Providers: For hosting and database services (AWS).

All service providers are contractually obligated to protect your data and use it only for the purposes we specify.

Legal Requirements

We may disclose information if required to do so by law or in response to:

• Prevention of fraud or security threats.
• Protection of our rights, property, or safety.
• Requests from government authorities or legal processes.

Data Security

We implement appropriate technical and organizational security measures to protect the information we process:

• Regular Audits: Periodic security assessments and updates.
• Access Controls: Strict access controls limit who can access information.
• Encryption: Data in transit is encrypted using industry-standard protocols (TLS/SSL). Sensitive app sessions and stored data are protected using strong encryption standards.

However, please note that no method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect information, we cannot guarantee absolute security.

Your Rights and Choices

General Rights

• Access: Request access to the information we hold about you.
• Correction: Request correction of inaccurate information.
• Deletion: Request deletion of your information.
• Data Portability: Request a copy of your information in a portable format.

How to Exercise Your Rights

To exercise any of these rights, please contact us at:

Email: privacy@zipify.com

We will respond to your request within 30 days.

Uninstalling the App

You can stop our access to your store data at any time by uninstalling the App from your Shopify admin. Upon uninstallation, your account is marked as inactive. Data will be deleted upon receiving a valid Shopify GDPR redaction request or according to our retention schedule.

International Data Transfers and Processing Locations

Zipify Lab is established in the United States. The information we collect, including store data and analytics, is primarily stored and processed in the United States using secure cloud infrastructure providers (such as AWS). By using our App, you acknowledge that your information will be transferred to, stored, and processed in the United States and potentially other jurisdictions outside of your home country.

GDPR Compliance (European Users)

If you are located in the European Economic Area (EEA) or United Kingdom (UK), you have additional rights under the General Data Protection Regulation (GDPR):

Legal Basis for Processing

• Contract Performance: Processing necessary to provide our services.
• Legal Obligations: To comply with applicable laws.
• Legitimate Interests: For service improvement and security purposes.
• Consent: You provide consent when installing and using our App.

Data Transfers

If we transfer data outside the EEA, we ensure appropriate safeguards are in place, such as adequacy decisions by the European Commission or Standard Contractual Clauses (SCCs).

CCPA Compliance (California Users)

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA):

• Right to Know: What personal information we collect, use, disclose, and sell.
• Right to Delete: Request deletion of your personal information.
• Right to Non-Discrimination: We will not discriminate against you for exercising your rights.
• Right to Opt-Out: We do not sell personal information, so opt-out is not applicable.

Shopify-Specific Disclosures

Integration with Shopify

Our App integrates with Shopify's platform and is subject to Shopify's App Store requirements, Partner Program Agreement, and API Terms of Service.

Webhooks

We use Shopify webhooks to:

• Ensure compliance with data protection requirements.
• Maintain service functionality by keeping store metadata up to date (via shop/update).
• Process app uninstalls to mark your store as inactive and revoke access (via app/uninstalled).
• Process subscription changes for billing purposes (via app_subscriptions/update).
• Process new orders to track quiz performance and aggregate analytics (via orders/create). During this process, we immediately discard any customer PII and only store anonymized, aggregate metrics.
• Respond to GDPR data requests (via customers/data_request, customers/redact, and shop/redact).

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of any material changes by updating the "Last Updated" date at the top of this Policy and posting the updated Policy in the App.

Data Controller

For the purposes of GDPR and other data protection laws, the data controller is Zipify Lab.