Privacy Policy

This policy explains how Wisepops, operating the Shopiens product, handles personal data. It covers Shopiens account holders, visitors of shopiens.ai and users of the Shopiens app, and visitors to the websites of our customers.

Who we are. Shopiens is published by Wisepops SAS, 87 Boulevard Suchet, 75016 Paris, France, registered with the Paris Trade and Companies Register (RCS Paris) under number 792 748 477. Wisepops is the controller of the personal data described in sections A and A2. For any privacy request or question, write to support@shopiens.ai. Shopiens is hosted by Amazon Web Services (the app and its data, in the United States) and Cloudflare (the website and our edge network).

A. Shopiens account holders (we act as controller)

When you use a Shopiens account we process:

• your email address;
• your account, site and team records, and the version of our terms you accepted and when;
• the questions you ask in Shopiens' chat and its answers, kept until the conversation, the site or the account is deleted;
• a log of product events, such as sign-up, site creation and invitations;
• the settings and connections you create;
• for a Shopify install, the shop's contact email.

We limit sign-in attempts per email address and per IP address to protect accounts. Sign-in links are sent by email through our provider Postmark. Access tokens that Shopiens issues to your AI assistant are stored only as a hash. The credentials for third-party services you choose to connect (Shopify, Google Ads, Meta Ads) must stay replayable for us to call those services on your behalf, so they are stored rather than hashed: held on encrypted volumes, never exposed through our API or to your AI assistant, and deleted when you disconnect. The Shopify credential is used to set up and run the Shopify connection described in section C. The Google Ads and Meta Ads credentials are used only to list the ad accounts your login can access so that you can choose one, to read what section D describes for the account you chose, and to withdraw our own access when you disconnect.

Our legal bases are the performance of our contract with you and our legitimate interests in securing the service, supporting you and improving the product. We share this data with the service providers that help us run Shopiens: our hosting providers, Postmark for email, and Anthropic for the chat and our other AI features (see the sub-processor list). We keep this data for the life of your account. When you delete your account, we delete your user record and your chat history and, for the accounts you own, their sites, team records, settings, connections and the credentials described above. The product event log is kept after that, to measure how the product is used.

If you use Shopiens from inside your Shopify admin, we store the identifier Shopify assigns to your staff account so we can recognise you on your next visit. We do not store your name or your email address from Shopify.

If you type someone's email address for your site's emails, such as its Weekly Brief, we keep it with that site, with whether its owner confirmed, and delete it with the site. We first send it one email asking its owner to confirm, naming the site and, when you sign in with an email address, you. Nothing with the site's figures reaches the address before its owner confirms, and every email after that carries a link to stop them.

The same goes for an address you type for one of your site's teams, such as Marketing, to share a recommended action from your Weekly Brief with it. We keep the team's addresses with that site and delete them with the site. Each action you share is kept with the brief it came from, with the text you sent and the addresses it went to, and deleted with that brief's data after 25 months.

A2. Visitors of shopiens.ai and users of the Shopiens app (we act as controller)

We measure how our website and our app are used with our own tracker, which collects the data described in section B, including a first-party identifier cookie kept up to 13 months after your last visit. We do this to understand and improve our website and product, and our legal basis is our legitimate interest in doing so.

B. Visitors of our customers' websites (we act as processor)

When one of our customers (the site owner) deploys the Shopiens tracker, we process the following on their behalf and on their instructions:

• a first-party visitor identifier and a session identifier: random values stored in first-party cookies. There are no third-party cookies and no device fingerprinting. If the site owner enables cross-domain linking, this first-party identifier may be carried in the navigation URL between the site owner's own declared domains (including its Shopify checkout), so a visit spanning those domains is counted as one visitor; this is limited to the site owner's own domains and is never tracking across unrelated sites;
• per page view: the page URL including its query string (which can carry campaign parameters), the page title, the referrer and traffic source, the session landing URL and referrer, the browser timezone, scroll depth and visible time on the page;
• the events the site owner chooses to record: conversions (goals) and their value, tagged events, and the visitor properties the site owner declares (short values);
• derived on our servers when we receive the event: an approximate country and city, obtained from the visitor's IP address (the IP address is masked before it is stored in our analytics data), and the browser, operating system and device family from the User-Agent.

Cookies. The tracker sets these first-party cookies:

• _shopiens: the visitor identifier, kept 13 months and renewed on each visit, so it expires 13 months after the visitor's last visit;
• _shopiens_s: the session (a random identifier, the landing page URL, which can include its query string, and the referrer), which ends after 30 minutes of inactivity and after 4 hours at most;
• _shopiens_g: the keys of the goals already counted in the session, 30 minutes;
• _shopiens_probe: a candidate domain, kept 10 seconds, to check which domain can hold the cookies;
• _shopiens_p: on Shopify checkouts only, set by our checkout pixel, the order identifiers already recorded, 90 days.

Before the product was renamed, the same cookies were named _evarist, _evarist_s, _evarist_g, _evarist_probe and _evarist_p, and a browser may still hold them under those names, with the same content and durations. When the visitor comes back, the first three are copied to their new names, and the old ones are deleted once a visit begun before the rename has ended, or as soon as the visitor withdraws consent; the others expire as described above.

Email addresses. Email capture is off by default. We switch it on for a site when the site owner asks. When it is on, and only after the visitor has given consent through the site's consent tool, the tracker records the email address the visitor submits in a Wisepops form, or that the site passes to the tracker when the visitor identifies themselves, so the site owner can relate it to that visitor's sessions. Otherwise the tracker does not read what people type. On a Shopify store, our checkout pixel also records the search terms visitors submit in the store's search, as section C describes.

Retention. Identifiable visitor event and session data is deleted or anonymised after 25 months; after that we keep daily totals, which hold no visitor identifier. Captured email addresses are deleted after 12 months. When the site owner asks (or a visitor asks, through the site owner), we delete a site's or a visitor's data from our live systems within 30 days, and archived copies at the end of the 25-month retention. A Shopify order record that carries the visitor's identifier loses it within the same 30 days (section C).

C. Shopify stores: order data (we act as processor)

If the site owner installs our Shopify app, we additionally process, on their behalf and on their instructions, a limited set of order facts read from the Shopify Admin API, so that we can attribute sales to the traffic sources that produced them and analyse the store's orders over time:

• the order's identifier and order number, when it was created, placed, last updated and closed, the store's currency and the customer's, and its status (financial status, cancellation and its reason, test flag);
• its amounts, in both currencies: net payment, total price, subtotal, discounts, shipping, taxes and each tax line, tips and refunds;
• what was bought: each line's product and variant, the quantity ordered and what is left of it, its unit price before and after discounts, whether it is a gift card, the subscription plan it was bought on, and the discounts applied to it, with their code or name, never the description staff typed for a discount made on that one order;
• the order's discount codes, its shipping (the method, its carrier, price, taxes and discounts) and its refunds (when, how much and which lines);
• where it was sold: the sales channel and the app that created the order, and for a sale in a physical shop, the identifier of that shop's location;
• Shopify's record of the customer's visits: how many orders the customer had placed with the store, how many days passed from their first visit to the order, and for the first and the last visit, when it happened, its source, its campaign tags (UTM parameters), and its landing page and referrer without their query string;
• the order's tags, which we read to classify the order and neither store nor send;
• of the order's custom attributes, only the visitor identifier our tracker set, which we use to reconnect an order to the visit that produced it;
• product and inventory records (titles, types, categories, collections, options such as size, launch dates, prices, stock levels, and each day's stock level and price): information about the shop's catalogue, not about any person;
• for the weekly Brief, under the read_discounts, read_returns, read_shipping and read_markets permissions: discounts and their codes; returns (the product that came back, the quantity, the reason chosen from Shopify's list and the date, never a note the customer wrote, and never the order or the customer); and shipping rates and markets, of which we keep only the free-shipping threshold each market's rates set;
• under the read_customers permission, the identifier Shopify gives each order's customer, and nothing else about them. We never store it: we use it only to make a code that links one customer's orders on that site without naming them, and that nothing outside Shopiens can turn back into the identifier;
• under the read_all_orders permission, which Shopify approved, orders older than 60 days. For now we still read only the last 60 days.

We do not request customer names, email addresses, phone numbers or shipping and billing addresses. We never ask Shopify for them: the queries we send ask for no customer field but the identifier above. Shopify puts a customer's email address and phone number in the privacy requests it sends us about that customer, and we keep them only to carry out an erasure, as Retention below describes. An order can still relate to a person, which is why we treat this data as personal data and describe it here.

Our Shopify checkout pixel records the same conversion and funnel signals as the tracker described above (order identifier, order value, product identifiers), which steps of the checkout the visitor completed (contact, address, shipping and payment, never what they entered), the products and quantities in a checkout they start, and the search terms they submit in the store's search. A search term is free text the visitor typed: the pixel drops any term that holds an email address or a phone number before sending it, except a term made only of digits, which it keeps as a likely product code, and it keeps at most 256 characters. The pixel reads the visitor's privacy choice from Shopify: where the visitor has declined analytics, it sends nothing.

Retention. Individual order records are kept 25 months in our analytics data, like the visitor data of section B. The database our app runs on holds an order only until it reaches our analytics data. Beyond the 25 months we keep daily totals by traffic source, device, product and discount code. When the site owner asks, or uninstalls our app, we delete the store's order records from our live systems within 30 days, and archived copies at the end of the 25-month retention. When one of the store's customers asks the store to erase their data, Shopify tells us, and we delete the order records it lists for that customer from our live systems within 30 days, and archived copies at the end of the 25-month retention. Those orders then no longer count in the site's sales. When Shopify sends the customer's email address or phone number, we also erase the contact details our tracking captured for them: our analytics data receives that email address and phone number only to find those details, uses them for nothing else, and keeps them only until that is done. Returns are deleted 65 days after they were made. Discounts and free-shipping thresholds are read again each day, and one that no longer exists is deleted then. Orders, checkout steps, checkout products and search terms recorded by our checkout pixel follow section B's retention. Its daily totals also count, for the weekly Brief, how far checkouts got and how often each search term was searched, with no visitor identifier.

D. Ad platform connections

If the site owner connects an advertising account, we additionally process, on their behalf and on their instructions, campaign facts and reporting figures read from that platform's API, so that we can report what their advertising produced and relate their ad spend to what happened on their site.

From Google Ads:

• per campaign, ad group, ad and keyword: its Google identifier, name and status, its settings (campaign type, bidding strategy and targets, budget, start and end dates, ad headlines, descriptions and final URLs) and the tracking template or final-URL suffix it carries, which we use to reconnect a campaign to the visits it produced;
• per hour and per day: cost, impressions, clicks, conversions and their value, impression share and quality score, broken down by device, network, country, landing page, age band and gender, and the search terms that triggered the account's ads;
• the account's change history: which campaign, budget, bid, status, targeting or creative settings changed, when, and their previous and new values. We do not record who made a change.

From Meta Ads:

• per campaign, ad set and ad: its Meta identifier, name, status and objective, its settings (buying type, bidding strategy and amount, budget, start and end dates, the ad set's targeting settings, and the ad's title, text and link) and the URL parameters the ad carries, which we use to reconnect an ad to the visits it produced;
• per hour and per day: spend, impressions, clicks, purchases and the other results Meta reports, and their value, broken down by device, placement, country, age band and gender;
• the account's activity log: which campaign, budget, status or targeting settings changed, when, and their previous and new values. We do not record who made a change.

We never read who is in an audience or a customer list, the individual people who saw or clicked an ad, or any profile: targeting settings can name an audience, never its members, and every figure above is an aggregate about the advertising account and its campaigns.

This access is read-only on both platforms. Our integrations issue no write operations of any kind: we never create, modify, pause or delete campaigns, budgets or ads. From Meta we request the single ads_read authorisation scope. From Google we request the single scope the Google Ads API publishes (https://www.googleapis.com/auth/adwords) because Google publishes no read-only variant of it.

None of this describes an identifiable person: it is information about the advertising account and its campaigns, which is why this section sits apart from the personal data described above. Data obtained from an ad platform is used only to produce reporting for the account that authorised the connection. It is never pooled with other customers' data, sold, shared with third parties, used for advertising, or used to train any AI model, and it is disclosed to no one beyond the sub-processors listed at /subprocessors.

The site owner can disconnect at any time from their website's page in Shopiens. Disconnecting deletes the stored credentials immediately, and everything read from that account, including the campaign records, within 30 days. For Google, disconnecting also revokes our authorisation at Google, so the connection disappears from that Google account's list of apps with access. Meta issues no equivalent revocable credential to us, so if you also want the grant itself withdrawn at Meta, remove Shopiens from your Meta Business Integrations settings.

Retention. Campaign records, reporting figures and the change history are kept while the connection is active, and are deleted within 30 days of a disconnect or of the site's or the account's deletion.

E. Consent and legal basis

The site owner (the controller) is responsible for establishing a legal basis and for obtaining any consent required before the tracker runs. Shopiens uses privacy-preserving techniques: first-party only, no third-party cookies, no device fingerprinting, the visitor's IP address masked before it is stored in our analytics data, and retention capped at 25 months. Because Shopiens also enables individual-level analysis of visitor behaviour (not solely anonymous aggregate statistics), controllers should not assume it qualifies for narrow "audience-measurement" consent exemptions; obtaining any consent required under ePrivacy or cookie rules remains the controller's responsibility. We do not currently act on Do Not Track signals. Under the California CCPA/CPRA, Shopiens provides first-party analytics and does not "sell" or "share" personal information, so Global Privacy Control opt-out-of-sale signals do not apply to it.

F. Your rights

Subject to applicable law you may request access, rectification, erasure, restriction, portability, and may object to processing (GDPR / UK GDPR), and you have the CCPA rights to know, delete, and correct, and to non-discrimination for exercising them. Account holders can exercise these rights by writing to support@shopiens.ai or by deleting their account. If you are a visitor to a customer's website, please contact that site owner (the controller); we assist controllers in fulfilling such requests.

You also have the right to lodge a complaint with the French data protection authority, the CNIL (cnil.fr), or with the data protection authority where you live or work. We make no decision about you based solely on automated processing that has legal or similarly significant effects on you.

G. International transfers & contact

Personal data is processed in the United States by our providers. These transfers rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses, with the UK Addendum for UK data (see the DPA and the sub-processor list). To exercise a right or ask a question, write to support@shopiens.ai.