Privacy Policy

1. Who we are

Kivviq is an analytics application for Shopify merchants. It reads a store's commercial data — together with the advertising and email platforms a merchant chooses to connect — and presents it back as dashboards and as answers from an AI analyst.

In data-protection terms, Kivviq acts as a processor for the merchant who installs it. The merchant is the controller of their store's data and of their shoppers' data; Kivviq processes that data only to provide the service described here. Where Kivviq holds data about the merchant's own staff — the accounts that sign in to the dashboard — it acts as a controller.

This policy explains what Kivviq collects, why, where it is kept, who else processes it, and how to have it deleted.

2. Shopify store data we access

When a merchant installs Kivviq and authorises it, Shopify issues an offline access token scoped to the permissions the merchant approved on the consent screen. Kivviq requests these read permissions:

• read_orders and read_all_orders — order totals, dates, sales channel, financial and fulfilment status, discounts, shipping, taxes, refunds, and line items. read_all_orders is used only when Shopify has approved access to history beyond the usual 60-day window.
• read_products and read_inventory — product and variant titles, prices and costs, used for margin and product-performance reporting.
• read_customers — used only to identify whether an order came from a new or returning customer, and to rank customers by lifetime value.
• read_discounts — discount codes, status and usage counts.
• read_draft_orders and read_returns — pending-order and return information used in sales and margin reporting.
• read_reports — Shopify reporting data used to reconcile dashboard metrics.
• read_customer_events — access required to configure the merchant-approved web pixel described below.

Kivviq requests one write permission: write_pixels. When a merchant chooses to enable attribution, it uses that permission to create or update this app's Shopify web pixel with the merchant's Kivviq workspace settings. It cannot create, modify, cancel or refund an order, change a product or a price, contact a customer, or write any other Shopify resource. All other permissions above are read-only, and permissions that turned out to have no consumer in the product were removed rather than left on the consent screen.

Kivviq also reads the store profile — shop name, myshopify.com domain, plan, and the merchant contact email Shopify holds for the store — to identify the connected account and to display it in the dashboard.

3. Protected customer data

Shopify designates some fields as protected customer data. Kivviq's use of them is deliberately narrow.

What is read. From each order, Kivviq reads the customer's Shopify identifier and account creation date. It does not request the customer's name, email address, phone number or postal address. The non-identifying fields are used to count unique and new customers and to compute repeat-purchase and cohort behaviour.

Order linkage. Kivviq links orders to storefront sessions using non-Level-2 identifiers such as the Shopify order id, customer id, checkout token and cart token when available. It does not read the order email for this reconciliation.

What is never read. Kivviq does not request or retrieve customer phone numbers, shipping addresses, billing addresses, or payment details from the Shopify Admin API. They do not appear in any query the application issues.

What is stored. Kivviq keeps a materialized commerce ledger for merchant reporting. It contains Shopify order identifiers and timestamps, status and channel fields, non-identifying customer ids, product and line-item identities, quantities, discounts, refunds, shipping, tax and monetary totals. It does not contain customer names, email addresses, phone numbers or postal addresses. Product and variant cost figures are also stored for margin calculations.

What is not sent to the AI model. Customer identity is excluded from the data supplied to the AI analyst. The analyst receives aggregate figures — revenue, order counts, channel splits, product performance — and, for high-value orders, the order number and total without any customer name or identifier attached.

4. Storefront pixel and shopper data

If a merchant enables attribution, Kivviq installs a Shopify web pixel that runs in Shopify's strict sandbox on the storefront. It records page views, product views, cart and checkout events, and purchases, so that revenue can be attributed to the marketing channel that produced it.

For each event, Kivviq stores:

• a randomly generated visitor identifier and session identifier, created by the pixel and stored in the shopper's browser — not supplied by Shopify and not linked to any account outside Kivviq;
• the page host and path only — query strings are never transmitted, so identifiers a merchant or an ad platform appends to a URL do not reach Kivviq;
• the referring URL and the first-touch and last-touch marketing parameters used for attribution;
• device type and browser family, derived from the request's user-agent header;
• the shopper's consent state as reported by Shopify's Customer Privacy API at the time of the event;
• the Shopify customer, order, cart and checkout identifiers associated with the event, where the storefront provides them.

Email addresses are never stored. Where the storefront supplies an email on a checkout event, it is hashed with SHA-256 on receipt and the original value is discarded before anything is written. The hash exists only so that a purchase can be matched to the session that produced it.

IP addresses are never stored. The requesting IP is hashed with a server-held salt and truncated before storage. The raw address is not written to the database, to the event log, or to any application log.

Bot traffic is discarded. Requests with no user-agent, or with a recognised crawler user-agent, are rejected and never stored.

The pixel records the shopper's consent state alongside each event so a merchant can see it. Kivviq relies on Shopify's own consent enforcement in the strict pixel sandbox and on the merchant's configuration of Shopify's customer privacy settings; it does not operate an independent consent banner or a second consent decision of its own.

5. Connected services

A merchant may connect additional accounts. Each is optional, each is connected with the merchant's own credentials, and each is read-only.

• Google Analytics 4 — aggregate reporting only: sessions, active users, page views, key events, revenue, and breakdowns by channel, country, city and page path. No user-level or individual GA4 data is retrieved.
• Google Ads — campaign and account performance: spend, impressions, clicks and conversions. No audience lists and no customer-identifying data.
• Meta Ads — account and campaign insights: spend, delivery and results. No audience or Custom Audience data.
• Pinterest Ads — ad account metadata and account- and campaign-level analytics: spend, impressions, clicks, checkouts and conversion values. No audience data and no customer-identifying data.
• Omnisend — email and SMS campaign performance, audience totals by subscription status, and the eight most recently created contacts, which are displayed in the Omnisend section of the dashboard and include those contacts' email addresses as held in the merchant's own Omnisend account.

The Omnisend section — including those eight contact rows — is written to a cache file on the application server so the dashboard survives a restart and Omnisend's rate limits. Nothing from any other connected service is stored with contact-level detail.

6. Why we process this data

Kivviq processes the data above for these purposes and no others:

• Providing the dashboards the merchant installed the app to see — sales, products, customers, cohorts, retention, advertising and email performance.
• Marketing attribution — connecting a purchase back to the channel and campaign that produced it, which is the reason the pixel exists.
• Answering the merchant's questions through the AI analyst, using their own data as evidence.
• Operating the service — authenticating users, enforcing workspace boundaries, rate limiting, diagnosing faults, and metering AI usage and cost.

Kivviq does not sell data, does not share one merchant's data with another merchant, does not build cross-merchant profiles, does not use merchant or shopper data to train AI models, and does not use any of this data for its own advertising.

7. AI processing

The AI analyst is built on Anthropic's Claude models, accessed through Anthropic's API. When a merchant asks a question, Kivviq sends the question, the conversation so far, and the specific evidence needed to answer it — aggregate metrics from the connected sources, and the text of any document the merchant attached to that conversation.

Customer identity is excluded from that evidence, as described in section 3. Where the merchant asks about individual visitor journeys, the analyst can receive pseudonymous pixel visitor and session identifiers; it does not receive names, email addresses or email hashes.

Kivviq records telemetry about each AI request — timing, which model ran, token counts and cost. That telemetry contains no prompt text, no answer text and no tool results; the schema has no column for them. The questions and answers themselves are stored separately as the merchant's own conversation history, so they can reopen a thread.

8. Storage and retention

Kivviq runs on Railway (application hosting) and stores durable data in Supabase (managed PostgreSQL and object storage). Database access is backend-only through a service-role credential; row-level security is enabled on every table with no policies for anonymous or authenticated roles, so nothing but the application server can read or write. The browser never connects to the database.

What is stored durably:

• storefront pixel events and derived visitor sessions and journeys;
• the merchant's AI conversations and their message content;
• documents a merchant uploads to the analyst, together with the extracted text used to answer questions about them;
• strategy records, saved questions, opportunity findings, dashboard layouts and preferences a merchant creates;
• product and variant cost figures used for margin calculations;
• connection records for each authorised data source, and AI usage telemetry;
• the name, email address and profile picture of each user who signs in.

Shopify commerce evidence. The durable commerce ledger stores only the reporting fields described in section 3. Level-2 Shopify customer fields — name, email, phone and postal address — are not requested or stored. Provider responses may also be held briefly in an in-memory cache to serve a dashboard request.

Retention. Kivviq does not currently operate an automatic expiry schedule. Data is retained for as long as the merchant's account exists, and is deleted when the merchant disconnects a source, deletes the record, asks us to delete it, or when Shopify sends a redaction request for their store — see section 10. The one exception is the pixel event log file on the application server, which rotates at 64 MB and keeps a single previous generation.

Credentials. Access and refresh tokens for connected accounts are encrypted at rest with AES-256-GCM before they are written, using a key held only in the server environment and never in the database. Each encrypted value is cryptographically bound to the workspace, the provider and the specific field it belongs to, so a token lifted from one row cannot be decrypted into another. Tokens are never logged and never sent to the browser.

9. Subprocessors

These are the third parties that process data on Kivviq's behalf:

Kivviq runs no third-party analytics or advertising script of its own, in the dashboard or on the storefront. The only script it places on a storefront is its own Shopify web pixel, described in section 4.

Shopify, Google Analytics, Google Ads, Meta, Pinterest and Omnisend are the merchant's own sources, not Kivviq's subprocessors. Kivviq reads from them under the merchant's authorisation and their own privacy terms continue to apply.

10. Deletion, uninstalling, and your rights

Disconnecting a store. A workspace owner or administrator can disconnect Shopify from within Kivviq. The stored access and refresh tokens are destroyed immediately and the connection record is deleted, so Kivviq can no longer read anything from the store. This revokes Kivviq's copy of the credentials; it does not uninstall the app from Shopify, which is done from the Shopify admin.

Uninstalling the app. Uninstalling in Shopify revokes Kivviq's access token, and Kivviq destroys its stored copy of that store's credentials on receiving Shopify's uninstall notification. No further Shopify data can be read from that moment. An uninstall is deliberately NOT an erasure: merchants uninstall to change plan, to pause, or by accident, and Shopify's own design allows 48 hours in which a reinstall restores the account intact. The merchant's history is kept for that window.

Erasure after uninstall. Shopify sends a shop-redaction request 48 hours after an uninstall. On receiving it Kivviq deletes that store's Shopify credentials, its authorization records, its storefront analytics — in the database and in the server's own event log — and the product cost records derived from its catalogue. It does not delete the merchant's Kivviq account, their uploaded documents, their saved analyses, or data from any other service they connected: Shopify's request covers Shopify's data, and the rest is the merchant's own. A merchant who wants their whole Kivviq account erased can ask at privacy@kivviq.ca.

Deleting individual records. Merchants can delete their own saved questions, question history, dashboards and layouts from within the app. Deleting an uploaded document permanently removes the extracted text and every retrievable chunk of it; the document's filename, size and type are retained as a tombstone so that a conversation which referenced it still makes sense.

Merchant rights. Depending on where a merchant is established, they may have rights of access, correction, erasure, restriction, objection and portability over the data Kivviq holds about them. Write to the address above and we will respond within 30 days.

Shopper rights. Kivviq holds shopper data as a processor for the merchant. A shopper should direct an access or erasure request to the store they bought from; Kivviq will act on the merchant's instruction, or on a request forwarded through Shopify, and will confirm completion to the merchant. A shopper may also write to us directly at the address above and we will route the request to the merchant and act on it.

11. Shopify privacy and compliance webhooks

Shopify defines three mandatory privacy webhooks that apps receive on a merchant's or a shopper's behalf, and one lifecycle webhook that reports an uninstall:

• customers/data_request — a shopper has asked the merchant for the data an app holds about them.
• customers/redact — a shopper has asked for their data to be erased. Shopify sends this 10 days after the request, or 6 months after their last order.
• shop/redact — sent 48 hours after a store uninstalls the app or closes, requesting erasure of that shop's data.
• app/uninstalled — sent when a merchant uninstalls the app.

All four are implemented. Each delivery's signature is verified against the application's own secret before anything is read from it, and an unsigned or mis-signed request is refused. A request arriving through any of these channels is actioned within the deadline Shopify sets. Because these requests concern shopper data that Kivviq holds only as a pseudonymous pixel record, the erasure performed is the removal of the storefront events, sessions and journeys associated with the identifiers named in the request, together with any hashed email derived from them.

A merchant who wants confirmation that a specific request has been completed can ask at privacy@kivviq.ca and will receive a written response.

12. Security

These are the controls the application actually implements:

• Transport encryption. The service is served over HTTPS; every outbound call to Shopify, Google, Meta, Omnisend, Anthropic and Supabase is over TLS.
• Encrypted credentials at rest. Provider tokens are sealed with AES-256-GCM and bound to their workspace, provider and field, as described in section 8.
• Authentication. Dashboard access requires a Google account on an explicit allowlist. Google's ID token is verified against the application's own client id and a verified email is required; the Google token itself is never stored. The session is an HTTP-only, Secure, SameSite=Lax signed cookie that expires after seven days.
• Tenant isolation. Every request resolves its workspace from server-side membership records, never from a value the client sends. A user with no membership is refused outright, and data routes additionally refuse a workspace whose data sources are not provisioned. This boundary is covered by an automated audit that boots the real server and probes every API route as four different identities.
• Database access control. Row-level security is enabled on every table with no anonymous or authenticated policies; only the backend service role can read or write, and the browser has no database connection.
• Private object storage. Uploaded documents live in a private bucket. No public URL and no signed URL is ever minted; bytes reach a browser only through an API route that re-resolves the workspace from the session first.
• OAuth integrity. Shopify callbacks are HMAC-verified in constant time, shop domains are validated against Shopify's own hostname format before any credential is sent, and each authorisation uses a single-use, expiring state nonce.
• Secrets are never logged. Tokens, API keys, authorization codes and provider error bodies are excluded from logs by construction, because provider error responses can echo the request parameters back.
• Rate limiting and CORS. AI endpoints are rate limited per user, and browser origins are restricted to an explicit allowlist.

No system is perfectly secure. If you believe you have found a vulnerability in Kivviq, please write to privacy@kivviq.ca rather than disclosing it publicly, and we will respond.

13. International data transfers

Kivviq is operated from Canada. Its subprocessors — Railway, Supabase, Anthropic and Google — operate infrastructure in the United States and other countries. Data processed by Kivviq will therefore be transferred to and stored in jurisdictions outside the merchant's own, including the United States.

Where a merchant or their shoppers are in the European Economic Area, the United Kingdom or Switzerland, such transfers are made on the basis of the European Commission's Standard Contractual Clauses or an equivalent transfer mechanism offered by the subprocessor concerned. A merchant who needs the specific hosting region for a record of processing activities can request it at privacy@kivviq.ca.

14. Children

Kivviq is a business tool sold to merchants. It is not directed at children, and it does not knowingly collect data from anyone it knows to be a child. It has no mechanism for determining a storefront visitor's age, and it collects no data from storefront visitors beyond the pseudonymous analytics described in section 4.

15. Changes to this policy

This policy will be updated when what Kivviq does with data changes — a new connected service, a new subprocessor, or a change to what is stored or for how long. The revision date at the top of this page changes with it. Material changes will be communicated to connected merchants directly.

16. Contact

For any question about this policy, or to make an access, correction or deletion request:

privacy@kivviq.ca

We aim to acknowledge within five business days and to complete a verified request within 30 days.