Privacy Policy

Who is responsible

• Merchant information. For information about merchants and their stores (installation, settings, plan), we are the controller.
• Shopper information. Quiz answers and contact details that shoppers enter on a store are collected on behalf of the merchant who runs that store. The merchant is the controller and we act as the merchant's processor (service provider). Shoppers should contact the store to exercise their privacy rights; we help the merchant answer.

Information about merchants

• Store and access data. The store's myshopify.com domain and the access token Shopify issues when the App is installed (with the refresh token that renews it), its permissions and expiry date. We use them to call Shopify's APIs for the store.
• Store details read from Shopify. Store name, customer contact email, store owner email, primary domain and currency. They are used to address results emails and to send test emails only to the store's own addresses. They are kept in memory for up to one hour and are not saved in our database.
• Settings. The email sending method, sender name and address, reply-to address, the default Klaviyo list, the storefront path of quiz pages, and the last error message returned by the email provider or Klaviyo (it can mention a recipient's address and is cleared once sending works again).
• Third-party API keys. Resend, SendGrid or Klaviyo API keys the merchant enters. They are stored encrypted and only shown masked.
• Quizzes. Questions, texts, image links, design, rules and the products, collections and pages they point to (IDs and titles).
• Plan and dates. The current plan, when it was last checked with Shopify, and when the App was installed or uninstalled. Payments are handled by Shopify; we never receive card details.
• Store catalog. Products, collections, pages, the store's languages and whether the App's theme embed is turned on are read through Shopify's API when needed. Apart from the IDs and titles saved with quizzes and responses, this data is only cached in memory for a few minutes and is not saved in our database.

Information about shoppers, collected for merchants

When a shopper uses a quiz on a store that runs the App:

• Quiz responses. A random identifier created in the browser for each quiz attempt, the answers (including text typed into short-answer questions), the language, how the quiz was shown (inline, popup, drawer or quiz page) and when it was started and completed.
• Contact details, only if the quiz asks for them. Email address, first name and whether the shopper agreed to receive marketing emails.
• Customer account ID. If the shopper is logged in to a customer account on the store, Shopify passes the customer's numeric ID, which is saved with the response.
• Results. The recommended products (ID, title and score), an explanation of which answers led to each recommendation, the pages linked or redirected to, the unique discount code created for the shopper (if the merchant offers one) and whether the results email and the Klaviyo sync were sent.
• Quiz activity. Views, starts, answered questions, completions and add-to-cart clicks, each with a time and the attempt identifier.
• Order attribution. When a shopper adds products to the cart from a quiz, the App adds hidden cart attributes (_quiz_id, _quiz_session) and a line item property (_quiz). When an order carrying them is placed, Shopify notifies the App and we keep only the order ID, order number, total and currency, linked to the quiz and the attempt. We do not store the customer's name, addresses, phone number or payment details from the order.
• Email send log. For every results email, test email or Klaviyo sync: a normalized email address (lowercase, without "+" tags or Gmail dots), the store, the quiz, the kind of message and the time. It is used only to apply sending limits and prevent abuse.
• Customer data requests. When a customer asks the store for their data and Shopify passes the request on to the App (customers/data_request), we save Shopify's request ID, the customer's email address and customer ID, the requested order IDs, how many quiz responses and attributed orders we found, when the request arrived and when it was marked as handled. We use them only to show the request to the merchant in the App until it is answered.
• Browser storage. For popups and drawers that open automatically, the App's script saves in the shopper's browser (local or session storage) when the quiz was last shown, so the merchant's frequency setting is respected. The App does not set its own cookies.
• Technical data. The App does not store IP addresses or browser user agents in its database. Quiz requests from the storefront reach the App through Shopify's App Proxy; on standalone quiz pages the browser also loads the quiz script directly from our server. For security and troubleshooting, our hosting provider keeps server logs for up to 30 days: the IP address and browser user agent of each connection, the requested address (for storefront requests it includes the store and, for logged-in shoppers, the customer ID that Shopify adds) and the App's error messages, which can include an error returned by an email provider or Klaviyo.

How we use information

• To show quizzes, calculate recommendations and display them to shoppers.
• To create unique discount codes in the merchant's store, when the merchant enables them.
• To email shoppers their results, when the merchant enables results emails and the shopper enters an email address.
• To send quiz data to the merchant's own Klaviyo account, when the merchant connects it: email address, first name and a "Completed Quiz" event with the answers, recommended products and discount code. Only shoppers who gave marketing consent are subscribed to the merchant's list.
• To give merchants analytics: the quiz funnel, answers per question, attributed orders and revenue, individual responses and CSV exports.
• To apply plan limits, prevent abuse (for example, how many emails one address can receive), keep the App secure and fix problems.
• To answer support requests and meet legal obligations, including privacy requests sent through Shopify.

We do not sell personal information and we do not use shopper information for advertising or for our own purposes. The only information used across stores is the email send log: to stop the App's built-in email sender from being misused, the number of results emails it sends to the same address is limited across all stores.

Where the GDPR applies, we rely on the performance of our contract with merchants, our legitimate interests in running, securing and improving the App, and our legal obligations. For shopper information, the merchant decides the legal basis (for example, consent for marketing emails).

Sharing and service providers

We share information only with the providers needed to run the App:

• Shopify: the platform the App runs on (authentication, App Proxy, catalog data, discount codes, orders and billing).
• Railway (Railway Corporation): hosting of the App's servers and database.
• Resend: delivery of results emails and test emails sent with the App's built-in sender (recipient address, sender name and the email content: first name, recommendations and discount code). Resend keeps a record of sent emails for a limited time under its own retention policy.
• The merchant's own Resend or SendGrid account: if the merchant connects one, emails are sent through it under the merchant's agreement with that provider.
• Klaviyo: only if the merchant connects their own Klaviyo account, as described above.
• Google Fonts: the App's admin pages load a typeface from Google, which receives the IP address of the merchant's browser. Storefront pages do not.

We may also disclose information when the law requires it, to protect rights and safety, or as part of a merger or acquisition, under the terms of this policy.

International transfers

Our providers may process information outside your country, including in the United States. Where the GDPR applies, such transfers rely on an adequacy decision (for example the EU-U.S. Data Privacy Framework, for certified providers) or on the European Commission's Standard Contractual Clauses.

Data retention

• Completed responses and attributed orders stay available to the merchant while the App is installed.
• Quiz activity events are deleted after 13 months.
• Quiz attempts that were started but never completed are deleted after 90 days.
• The email send log is deleted after 30 days.
• Customer data requests are deleted 90 days after they are marked as handled, or one year after they arrived, whichever comes first.
• Deleting a quiz deletes its responses, activity and attributed orders.
• When a merchant uninstalls the App, the store's access tokens are deleted right away. Quizzes and other data are kept so that a reinstall can restore them, and are deleted when Shopify sends the store redaction request (shop/redact), normally 48 hours after the uninstall.
• These clean-ups run automatically on our servers every day, whether or not anyone opens the App: shortly after each server start, then every 24 hours (a failed run is retried an hour later). An item is therefore deleted within about a day after its period ends. Server logs are kept for up to 30 days; database backups kept by our hosting provider expire on the provider's schedule.

Privacy requests and Shopify privacy webhooks

The App handles Shopify's mandatory privacy webhooks:

• customers/data_request: we find the customer's responses (by email, customer ID or order) and save the request as described above. The App shows it to the merchant on its home page and in Analytics, with a one-click export of everything stored for that customer, until the merchant marks it as handled. The merchant sends the data to the customer. Merchants can also export a customer's data at any time from Analytics, Customer data requests.
• customers/redact: we erase the customer's email, first name, customer ID, answers, recommendation explanation and marketing consent from their responses, delete their entries in the email send log and erase the email address, customer ID and order IDs from their saved data requests. Those requests are marked as handled and the rest (Shopify's request ID, the counts and the dates) is kept until the retention period above ends, so that a late copy of the same request from Shopify is not saved again. Order references (order ID, number and total) and anonymous counts are kept for the merchant's statistics. Information already sent to a merchant's own Klaviyo, Resend or SendGrid account is under the merchant's control and has to be deleted there.
• shop/redact: we delete all data stored for the store.

Merchants can also write to quizsupport@horcrux.ro to access, correct, export or delete their own information.

Your rights

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal information, to object to or restrict its use, to withdraw consent at any time, and to lodge a complaint with a data protection authority (in the EU, in the member state where you live, work or where the issue occurred). California residents have the right to know, delete and correct their personal information and not to be discriminated against for using these rights. We do not sell or share personal information for cross-context behavioral advertising.

Shoppers should send requests to the store where they took the quiz, and we will help the merchant respond. Merchants can contact us directly.

Security

• All connections to the App use HTTPS.
• Requests from Shopify (webhooks and App Proxy) are verified with Shopify's signatures, and the admin uses Shopify session tokens.
• API keys entered by merchants are encrypted with AES-256-GCM.
• Every request only reaches the data of its own store, and sending limits protect the email features from misuse.
• Access to the production systems and database is limited to the people who operate the App.

No system is completely secure. If a breach affects personal information, we will inform the affected merchants and the authorities as the law requires.

Children

The App is not directed to children. Merchants must not use it to knowingly collect personal information from children under 16, or under the age set by local law.

Changes to this policy

We may update this policy when the App changes. We will change the date at the top and tell merchants about significant changes in the App or by email.

Contact

• Company: Horcrux Inovative SRL
• Address: Creatiei 24A, Timisoara, Romania
• Email: quizsupport@horcrux.ro
• Website: www.horcrux.ro