Privacy Policy

1. Information we collect

DropifyXL receives data through two paths: the Shopify app (installed on a merchant's store) and the marketing site (dropifyxl.com).

From the Shopify app (merchant install)

• Store profile: shop domain, owner email, currency, timezone, Shopify plan name.
• Catalog: products, variants, inventory levels, collections.
• Commerce data: last-90-days orders and customers (email, name, order count, total spent, first and last order dates), plus the payment gateway names recorded on each order, which is how we identify cash-on-delivery orders.
• Abandoned checkouts: checkout line items, value, and the shopper's email where present, used for the abandoned-cart recommendation and, on Plus, for cart-recovery draft emails.
• Protected customer fields: Shopify grants these individually. We hold approval for customer name and email only. We do not read customer phone numbers or postal addresses, and features that would be sharper with them abstain rather than guess.
• Derived analysis: the recommendations, revenue-opportunity estimates, store-score snapshots, and outcome measurements we generate from the data above. These are produced by us, retained per the schedule in section 5, and deleted with the rest of your data.
• Plus only — visitor analytics: when you enable the Web Pixel, we receive a narrow set of storefront events (page view, product view, add to cart, checkout started, checkout completed). Events are pseudonymized by a daily-rotating session ID — no cookies, no cross-session tracking.

From the marketing site

• Newsletter signup: email address + the signup source ("footer", "newsletter-section", etc.).
• Contact form: name, email, Shopify store domain, topic, message.
• Data-request form: name, email, optional shop domain, request type, details.
• Coarse IP prefix: for abuse-prevention only, we store the /24 (IPv4) or /48 (IPv6) network prefix — never the full IP address.

What we don't collect

We do not integrate with ad platforms (Meta, Google, TikTok) and we don't receive their data. We don't set cross-site tracking cookies. We don't process card or banking details — billing flows through Shopify Billing.

2. How we use information

Service delivery

• Run the rules engine to produce your prioritized recommendations, size each one as a revenue opportunity, calculate your store score, and measure what changed after you act on them.
• Send transactional email (first-scan notification, weekly / daily digest, trial-ending reminder, unsubscribe confirmation) on paid plans.
• Operate the in-app dashboard, action tracking, and onboarding state.

LLM polish

Recommendation copy is rewritten by an LLM (Anthropic Claude, OpenAI, or Google Gemini, selected via an internal config). We only send the rule-level structured output — product titles, counts, percentages, and fallback copy — never raw order records, customer names, email addresses, phone numbers, or addresses. Where a recommendation refers to specific customers, they are carried as internal database references that are resolved only when your dashboard renders, so there is no code path that places a customer identity into a recommendation prompt. Providers do not use our data to train their foundation models per their enterprise terms.

Draft customer emails (Plus only)

Plus merchants can ask us to draft a win-back or cart-recovery email addressed to one named customer. This is the single exception to the paragraph above, and it is always merchant-initiated: for that one request we send the recipient's first name only, so the greeting reads correctly, together with the merchant's shop name and, for cart recovery, the product titles and quantities left in the cart (public catalog data). We never send the recipient's email address, surname, phone number, address, or order history. The generated draft is returned to the merchant to review and edit; nothing is sent to the customer until the merchant chooses to send it. Merchants who never use this feature never have any customer identifier sent to an LLM provider.

Analytics about the product

We track aggregated metrics about how the app is used (how many recommendations are completed, which types resonate) to improve the rules and the UX. These are de-identified and can't be traced back to individual merchants or customers.

Communication & admin

• Service notifications and important updates.
• Billing state managed through Shopify.
• Support and troubleshooting you initiate.

3. Sharing & subprocessors

We do not sell personal or store data. We share only with the subprocessors required to deliver the Service, each bound by a written DPA. The full, current list is at /subprocessors — at the time of writing it covers Shopify (source platform), Supabase (Postgres), Vercel (app hosting), DigitalOcean (cron server), Resend (email), and one of Anthropic Claude, OpenAI, or Google Gemini (LLM polish).

Legal process

We may disclose information to comply with lawful requests, enforce our Terms, or protect the rights, property, or safety of users and the public.

Business transfers

In a merger, acquisition, or asset sale, data may transfer subject to this Policy. We'll notify merchants before any change in controller.

4. Security

The full technical summary is at /security. No method of transmission or storage is 100% secure, but we align our measures with industry best practice for apps handling commerce data.

5. Retention

• Shop data while installed: kept for the lifetime of the install, refreshed on webhook.
• After uninstall: the shop row is marked inactive and all data is deleted 90 days later. Request earlier deletion via the contact form.
• Web Pixel raw events (Plus): less than 36 hours, then rolled into anonymized daily summaries and deleted.
• Email logs: 30 days for deliverability debugging.
• Newsletter subscribers: until unsubscribe.
• Contact & data-request messages: 2 years after the last correspondence, then deleted.

6. Your rights

Depending on where you live (EU/EEA, UK, California), you may have the right to:

• Access and obtain a copy of your data (portability)
• Correct inaccurate information
• Request deletion of your personal data
• Object to or restrict certain processing
• Withdraw consent where processing is based on consent

Submit a request at /data-request (or use the general contact form). We respond within 30 days and verify identity by email before acting.

7. Cookies & tracking

DropifyXL uses only essential cookies on the marketing site — a CSRF token for the contact and data-request forms — and the session cookies Shopify itself manages inside the embedded admin app. We don't set analytics or advertising cookies, and we don't run cross-site trackers.

The Plus-plan Web Pixel on merchant storefronts sends anonymized events (no cookies, no PII, consent-aware via Shopify's Customer Privacy API).

8. International data transfers

Data may be stored and processed across multiple regions — the EU (Supabase Frankfurt), the US (Resend, OpenAI, Anthropic), or Google regions (Gemini) — depending on the subprocessor involved. Transfers from the EEA, UK, or Switzerland to third countries rely on the EU Standard Contractual Clauses and equivalent addenda, together with the technical measures described at /security.

9. Children

DropifyXL is a B2B product for Shopify merchants. We don't knowingly collect personal data from children under 16. If we learn we have, we delete it promptly.

10. GDPR webhooks (merchant obligations)

Shopify requires every app to implement three mandatory compliance webhooks. DropifyXL implements all three:

• customers/data_request — forwarded to the merchant to fulfill.
• customers/redact — we purge the identified customer's data within 48 hours.
• shop/redact — triggered 48 hours after uninstall; we complete deletion within 10 days.

We also run an independent daily purge job: any shop inactive >90 days is fully deleted as described in section 5.

11. Changes to this policy

We may update this Privacy Policy. Material changes are announced inside the app and on this page at least 30 days before taking effect.

12. Contact