StorePilot App Privacy Policy

What this policy covers

This page describes the StorePilot AI Shopify app — what it processes on a store where it's installed, and about that store's shoppers. Visits to this marketing website are covered separately by the website privacy policy.

Who we are

The StorePilot AI app is operated by Misha Gavura, a sole proprietor trading as StorePilot AI, at 3188 Lower Residence Ln, Kelowna, BC V1V 1V8, Canada. That is the data controller for the purposes of GDPR, PIPEDA and equivalent privacy laws, and the counterparty to any data-protection agreement covering this app. For any privacy question, email hello@usestorepilot.com.

What the app collects on your storefront

Behavior events come from two collectors: a Shopify Web Pixel (which runs inside Shopify's own sandbox) and an app-embed block you can switch off with one toggle in the theme editor. Both are gated by consent (next section).

• What an event contains: the event type (e.g. product viewed, added to cart, checkout started, checkout completed), a coarse page type ("product page", "cart"), and for public storefront pages only the page path (e.g. /products/linen-shirt — never a query string, and never account, order or checkout paths), a device class (mobile / tablet / desktop), a traffic-source category (e.g. organic, social, direct), a coarse region bucket derived from the store's own locale settings (never from a shopper's IP address), an A/B-test arm tag when an experiment is running (which variant the session was shown — "A" or "B", nothing more), and an opaque, rotating session ID.
• Which page element was used: for clicks, hovers, dead clicks and form fields, the app records the element's kind (button, link, image, variant option…), its visible on-page label (e.g. the text of an "Add to cart" button or an image's alt text, at most 80 characters, with anything that looks like an email, phone or card number removed), its position and size on the page, the theme section it sits in, and for links the path it points to. This is your store's own page content, never what a shopper types. Merchants can exclude any area by adding a data-storepilot-private attribute.
• Products and search: product, variant and collection IDs, cart and checkout line quantities and unit prices, the order total (amount and currency) when a checkout completes, and the words typed into the store's own search box (at most 80 characters; searches that contain an email or phone number are not recorded). For form fields: the field's label, how long it was used, how many edits were made and whether it showed an error — never the value.
• A/B-test visitor ID: with your consent, we store a random visitor ID in your browser (local storage, key storepilot_vid) to keep you in the same test version across visits. It is not linked to your name, email or customer account. It rotates every 90 days (held longer only while you are in a running test), is stored with a coarse browser type (Safari/iOS or not — never the full user agent), and is deleted, on your device and on our servers, when you withdraw consent.
• What is never captured: no names, no emails, no IP addresses (never collected in the first place), no query strings, no user agents, no customer IDs, no shipping or billing addresses, and never the value of any form field a shopper types into.
• Not session replay: the app extracts behavioral features; it does not record video, keep mouse paths, or replay a shopper's screen.

Consent

Both collectors are gated by Shopify's Customer Privacy API. Events are recorded only where that API says analytics processing is allowed for the visitor. In opt-in regions such as the EU and UK, nothing is collected until the shopper consents; if a shopper withdraws consent mid-session, collection stops and unsent events are discarded.

Store context (optional)

To ground its recommendations, the app can read anonymized aggregates about your catalog, pricing, and the last 60 days of sales through Shopify's Admin API — totals and product-type tallies. This runs only when you trigger it from the app's Settings. No customer details and no order-level records are retained: no order IDs, no addresses, no customer IDs, no individual order rows.

How long we keep data

Raw behavior events, session journeys, and the daily de-identified aggregates built from them are all deleted on the same retention window you choose in the app's Settings. The default is 90 days, and how far you can extend it depends on your plan: up to 90 days on Free, 180 days on Starter, 365 days on Growth, and 730 days on Scale. A nightly sweep enforces whichever is shorter, the window you chose or the one your plan allows, so moving to a smaller plan shortens the window too. What persists beyond that window is your experiment history and results, the tests you ran and what they concluded, which contain no visitor-level data.

Sub-processors

• Anthropic — drafts the wording of recommendations and experiments. It receives only de-identified numeric aggregates and generation instructions — never customer text, never order rows, never personal details.
• Fly.io — hosts the app and its Postgres database.
• Shopify — the pixel runs in Shopify's sandbox, and storefront events and admin data flow over Shopify's own infrastructure.

Your rights, and your customers' rights

GDPR and CCPA requests — access, deletion, correction — are handled through the data-request page. The app also honors Shopify's mandatory privacy webhooks: customer data request, customer redact, and shop redact. When Shopify sends one, we run the corresponding lookup or deletion. When you uninstall the app, Shopify sends a shop-redact request and we delete the store's data on receipt.

Changes

We'll update this page when the app's practices change and revise the date above. Questions? hello@usestorepilot.com.