Privacy policy
Flapp Bilişim A.Ş. provides Pagnetic, a Shopify application that answers shopper questions on a store with the product facts and store policies the merchant approved, and measures whether it adds revenue, against a comparison group of shoppers.
Information we process
- Shop identity, installation credentials, staff authorization identifiers, and app configuration.
- Merchant product titles, descriptions, variants, campaign labels, shipping and refund policies, and merchant-approved content.
- Questions and searches shoppers type on the store. Each is answered in memory; we keep a one-way hash of it and a few properties such as its length, not the text.
- Pseudonymous assignment, decision, render, cart, checkout, order, and refund measurements needed to calculate experiment and comparison-group results.
- AI agent source (e.g. ChatGPT), not the address: when a shopper arrives from an AI agent, the store pixel sends only the agent’s name, never the referring page, the link or its parameters. The name is stored on the page-view, product-view and completed-checkout events of that browser session, alongside the same pseudonymous identifiers as other pixel events, for the raw event retention period (90 days by default), and as daily counts per product without any identifier.
- Shopify order identifiers, purchase and refund amounts, currency, payment and cancellation status, and timestamps needed to link an approved message test or feature to its sales result and adjust that result for refunds. Order status shown to a signed-in shopper is read from Shopify when the shopper asks and is not stored.
- Support and incident contact information supplied by the merchant.
We intentionally do not request or retain buyer names, postal addresses, email addresses, or phone numbers. Free scans are processed transiently; we store an anonymous outcome event, not the submitted URL or page copy. When a store opens or installs the app, we store a keyed one-way hash of its shop domain.
Why we process it
We use this information to operate the app, generate source-grounded previews, prevent unsupported content from being served, run merchant-authorized experiments, calculate revenue per session and refund-adjusted results, secure the service, and provide support.
Sharing and subprocessors
- Shopify: the platform the app is built for, including installation, store data, billing and privacy requests.
- Microsoft Azure: runs the app, its database and its logs, in Germany West Central (Frankfurt), Germany. Encrypted database backups are staged on this provider’s storage.
- Microsoft Azure (Blob Storage): keeps encrypted off-server copies of the database backups and the receipts of privacy requests.
No AI model provider is used for answers: answers quote approved text, and shopper questions are not sent to an AI model provider.
We do not sell buyer or merchant data or use it for unrelated advertising.
Retention and deletion
Raw experiment events default to 90 days and aggregate experiment records default to 730 days, subject to the merchant’s configured policy and legal requirements. Shopify privacy webhooks are supported. Store-scoped operational data is deleted following a verified shop-redaction request; security and request audit records retain only one-way identifiers. If a store has asked for a refund under the 90-day proof guarantee and the refund is not yet resolved, we keep that store’s shop domain with the claim until it is resolved, so the refund can be paid; it is then erased. Deleted data can remain in encrypted backups until those backups are removed on their retention schedule.
Security
We use scoped access, encryption for sensitive operational contacts, signed Shopify requests, allow-listed telemetry, rate limits, immutable approvals, backups, audit logs, and an original-storefront kill switch.
Your choices
Shopper event collection follows the store’s Shopify Customer Privacy consent state. Merchants control content approval, test activation, pause, deletion, and uninstall.
Contact
Privacy questions and requests: privacy@flapp.ist.