Privacy Policy.

PersonalizerAI (“we,” “us,” “our”) operates the PersonalizerAI application for Shopify and the website at personalizerai.com. This Privacy Policy explains how we collect, use, store, and protect information when you use our services.

This policy applies to Shopify merchants who install PersonalizerAI (“Merchants”), the people who use the app on a Merchant’s behalf (“Merchant Staff”), visitors to Merchant stores where PersonalizerAI is active (“End Customers”), and visitors to our website (“Website Visitors”).

1. Information We Collect

1.1 From Merchants (via Shopify)

When you install PersonalizerAI, we access certain data from your Shopify store through Shopify's API. This includes:

• Store information: store name, domain, Shopify plan, locale, and timezone
• Product catalog data: product titles, descriptions, images, prices, tags, collections, variants, and inventory status
• Order data: order history, line items, order values, and timestamps (used to train recommendation models)
• Customer behavior data: browsing events, search queries, product views, add-to-cart actions, and purchase events (collected via our storefront script)

1.2 From End Customers (Shoppers on Merchant Stores)

When an End Customer visits a Merchant's store where PersonalizerAI is installed, we may process:

Behavioral Data (via our storefront script and the Shopify Web Pixel)

• Pages, products, and collections viewed, and the referring URL
• Search queries, search result clicks, and recommendations shown or clicked
• Add-to-cart, remove-from-cart, checkout, and purchase events
• A random visitor identifier and session identifier, user agent, browser locale, and viewport size

These events follow the shopper's analytics choice on the Merchant's cookie banner, as reported by Shopify's Customer Privacy API. We do not receive events from a shopper who declines analytics. Where the Merchant's Shopify privacy settings require consent before analytics, we receive events only after the shopper allows it; where they do not, we receive events unless the shopper declines. We do not collect IP addresses or device location.

Order & Customer Data (via Shopify API, as authorized by the Merchant)

• Shopify customer ID (an opaque number), order totals, line items, and timestamps
• Email and SMS marketing consent status, customer tags, order count, and amount spent
• Coarse location: city, province, and country only

We do not receive or store shopper names, email addresses, telephone numbers, street addresses, or postal codes.

We process this information solely on behalf of the Merchant to provide personalization, analytics, and customer modeling services, including training models for that Merchant's store as described in Section 3.3. We do not use End Customer data for our own marketing purposes and do not combine data across different Merchant stores.

1.3 From Merchant Staff Using the App

When you or anyone on your team opens PersonalizerAI, in the Shopify admin or at dash.personalizerai.com, we collect information about how the app is used. This is about the people using the app, not your shoppers: no End Customer data is sent to our product analytics provider.

• Identity from Shopify: the staff member’s Shopify user ID; their email address, only when Shopify has verified it; whether they are the store owner or a collaborator (such as an agency or developer); and their language setting. We read these from Shopify when a staff member opens the app and refresh them at most every 30 days. We do not receive staff names or passwords.
• Product usage: pages viewed, buttons clicked, settings saved, and features used in the app, together with the store they belong to.
• Session recordings: recordings of how the app’s pages were used. Everything typed into form fields is masked, and network activity is recorded as addresses and timings only, never the content of requests or responses.
• Error reports: technical details when the app or our servers hit an error.
• Survey answers: if a staff member chooses to answer a short in-app survey.

We use this information to provide support, find and fix problems, understand which features help Merchants, and contact staff about their account. It is processed by PostHog in the United States. We rely on our legitimate interest in operating and improving a business service.

Turning it off: anyone on your team can switch off Share usage analytics in the app’s Settings. While it is off, the app sends no usage data, session recordings, or survey prompts to PostHog for your store. Error reports from our servers are still sent so we can keep the service running, and we keep each staff member’s Shopify user ID and email in our own database to identify them in the app.

1.4 From Website Visitors (personalizerai.com)

When you visit our website, we may collect:

• Contact information you voluntarily provide: name, email address, store URL
• Usage data: pages visited, time on site, referral source (via analytics tools)
• Cookies: see Section 6 for details

2. How We Use Your Information

2.1 To Provide and Improve Our Service

• Generate AI-powered product recommendations tailored to each Merchant's catalog and customer behavior
• Power AI Search functionality on Merchant stores
• Train and improve our proprietary recommendation and search models
• Track and report revenue attribution
• Monitor app performance, diagnose issues, and optimize widget delivery

2.2 To Communicate

• Respond to support, sales, or partnership inquiries
• Send service-related communications (app updates, performance reports, billing notices)
• Send marketing communications only with explicit consent (and with an easy unsubscribe)

2.3 For Billing and Attribution

We track revenue attributable to our recommendations and search results using click-only attribution. This data powers the merchant-facing analytics and attribution dashboard and lists each attributed sale by Shopify order number so Merchants can audit it against their own order data.

3. AI and Data Processing

PersonalizerAI uses artificial intelligence from Google and Anthropic to process and understand catalog, store design, behavioral data and internally to improve our products. Our proprietary recommendation and search models are trained separately for each Merchant, on that Merchant's data only, to generate personalized results (see Section 3.3).

3.1 How AI Processes Data

• Catalog data is analyzed to understand product relationships, attributes, and categories.
• Order and behavioral data is used to identify customer intent, purchasing patterns and customer preferences.
• When a shopper is logged into the Merchant's customer account and has allowed analytics processing, we may link their browsing sessions to their Shopify customer ID to enable cross-session personalization.
• Our AI models generate real-time, per-session recommendations and search results.

3.2 Third-Party AI Providers

We use AI services from Google and Anthropic. Data sent to these providers is processed according to their respective data processing agreements and is not used to train their general models.

3.3 Model Training

Our models are trained separately for each Merchant's store, only on that store's data. We never combine data from different Merchant stores to train a model, and we do not use one Merchant's data to benefit another Merchant's recommendations or search results.

• The Merchant's consent: we train models on a store's data only after the Merchant has agreed to it in the app during setup. The app records which terms the Merchant agreed to, when, and which Shopify account agreed. Setup cannot be completed without this consent.
• What the models learn from: that store's product catalog, its orders and customer data received from Shopify, and its storefront events, as described in Section 1. Events from shoppers who declined analytics tracking are never sent to us, so they are never used.
• Withdrawing consent: a Merchant can withdraw consent by contacting support@personalizerai.com or by uninstalling the app. When the app is uninstalled, training on that store's data stops, and the store's data is deleted when Shopify asks us to, about 48 hours after uninstall.
• No cross-merchant profiles: we do not build consumer profiles or identity graphs across Merchant stores, and we do not link a shopper in one store to a shopper in another.

3.4 Automated Decision-Making

PersonalizerAI uses automated systems to generate product recommendations and search results. These systems do not produce legal or similarly significant effects on individuals within the meaning of Article 22 of the GDPR.

4. Data Sharing and Third Parties

We do not sell, rent, or trade any personal or Merchant data. We share data only as necessary to operate our services:

• Infrastructure and Hosting: Google Cloud (including Vertex AI for Gemini models), Cloudflare, Hetzner, Shopify.
• Analytics and Product Monitoring: PostHog (the PersonalizerAI app and website; see Section 1.3), Google Analytics (website and documentation).
• Communications and Support: SendGrid, Help Scout.
• Website only: Meta Platforms and Google Ads (advertising), Cal.com (demo booking), Cloudflare Turnstile (form spam protection). We do not share Merchant store customer data with advertising platforms.

Legal requirements: We may disclose data if required by law, regulation, legal process, or governmental request.

5. Data Retention

• Merchant account data: Retained for the duration of the subscription plus 90 days after uninstallation.
• Behavioral, order, and profile data: May be retained for up to 24 months. Data older than this may be aggregated or anonymized.
• Merchant Staff usage data: Session recordings are deleted after 30 days. Other product usage events and error reports are kept for as long as they help us support Merchants and improve the service, and are deleted on request. Staff identity records in our database are deleted with the store’s data after uninstallation (Section 3.3).
• Website visitor data: Contact form submissions retained for 12 months.
• Upon request: Merchants can request deletion of all their data.

6. Cookies and Tracking

6.1 On Merchant Stores

PersonalizerAI uses browser storage on Merchant stores, not third-party tracking cookies. A random visitor identifier is kept in local storage until the shopper clears their browser data, a session identifier is kept per tab and rotates after 30 minutes of inactivity, and cart attributes record which recommendation led to an add-to-cart so the Merchant can see attributed orders. These identifiers are strictly functional: they carry no personal information and are never shared across Merchant stores. Analytics events are additionally gated by the shopper's choice on the Merchant's cookie banner, as reported by Shopify's Customer Privacy API.

6.2 In the PersonalizerAI App

Our product analytics (Section 1.3) stores identifiers in the browser’s local storage, plus a first-party cookie at dash.personalizerai.com, to tell one staff member and one visit apart. They are not used for advertising and are not created while Share usage analytics is off.

6.3 On personalizerai.com

Our website may use Essential cookies, Analytics cookies, and Advertising Cookies.

7. Your Rights

7.1 For Merchants

You have the right to Access, Correction, Deletion, Data portability, Restrict processing, and Withdraw consent. To exercise these rights, contact support@personalizerai.com. To withdraw your consent to model training on your store's data, contact us at the same address or uninstall the app (see Section 3.3). To stop product usage analytics for your store, switch off Share usage analytics in the app’s Settings; to have a staff member’s usage data deleted, email us (see Section 1.3).

7.2 For End Customers

End Customers should contact the Merchant directly to exercise their privacy rights, as the Merchant is the data controller.

7.3 GDPR (European Economic Area) & 7.4 CCPA (California)

We provide full support for GDPR and CCPA compliance. To exercise your rights under these frameworks, contact support@personalizerai.com.

8. Data Security

We implement industry-standard security measures including Encryption in transit (TLS/SSL) and at rest, Access controls, Regular security reviews, and Secure API communication.

9. International Data Transfers

PersonalizerAI is operated by Infilimits Technologies Private Limited, a company incorporated in India. Merchant and shopper data is stored on Google Cloud in the United States and on Hetzner servers in Germany. Requests to our storefront script and AI gateway pass through Cloudflare's global network, and analytics for our dashboard and website are processed by PostHog in the United States. Our staff access data from India. For transfers from the EEA, we rely on Standard Contractual Clauses or other approved transfer mechanisms.

10. Children's Privacy

PersonalizerAI is a business-to-business service and is not directed at children under 16.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify Merchants of material changes via email or in-app notification.

12. Contact Us

PersonalizerAI is operated by Infilimits Technologies Private Limited. Registered address: 12-A, Srajan Estate Phase 5, Bareilly, Uttar Pradesh, India.

Email: support@personalizerai.com
Website: https://personalizerai.com/contact