Privacy policy

Attravo Commerce LLC, a Florida limited liability company (“Attravo,” “we,” “us,” or “our”), builds Shopify apps, runs done-for-you services for Shopify brands, and is developing AI agents for Shopify stores. We support all of them through our own support chat and help center. This policy explains how we handle data across all of it.

Our apps are listed on the Shopify App Store and operate under the scopes verified and approved by Shopify. Our services engagements involve direct, scoped access to a customer’s Shopify store and connected tools under signed agreements.

Attravo Commerce LLC
66 W Flagler Street, Suite 900, Miami, FL 33130, USA
support@attravo.io

Four promises govern everything below. Where any other section could be read as narrowing them, these win.

• We do not keep your data after you leave. Uninstall an app or end a services engagement and your sessions, orders, and customer records are deleted. We do not hold a copy for later.
• We do not sell or share it. We do not sell personal data, share it with advertising networks, or trade it with anyone. Data goes only to the sub-processors we name publicly, and only to run the service you are paying for.
• We do not use it for unrelated work. Your data is used to deliver your service. It is not repurposed for another customer, sold as benchmarks, or mined for anything you did not ask for.
• We do not train AI models on it. Neither we nor our model providers use your store data, your shoppers’ data, or what you write to our support to train or fine-tune models.

This policy covers:

• Apps: Cart Drawer Upsell, Bundles & Quantity Breaks, Product Quiz Maker and Post Purchase Upsell, and any future app published under the Attravo developer account.
• Services: Conversion Rate Optimization, Retention Marketing, Theme Development, App Development, and custom work.
• Agents: the AI agents described on our agents page. These are in development and not yet generally available. The disclosures here apply from the day they are.
• Support: our support chat on this site, on our help center, and inside our apps; our help center at help.attravo.com; and the public roadmap for each app.
• Website: attravo.com, waitlists, newsletters, and contact forms.

Every App Store listing links here, so the app sections apply to you whether or not you ever engage us for services.

When a Shopify merchant installs one of our apps, we receive only the data permitted by the scopes the merchant approves during installation. Every scope is reviewed and verified by Shopify before our apps are published, and we request the minimum each app needs to function.

Store data

• Shop name, domain, primary email, plan, currency, and timezone.
• Products, collections, variants, and inventory levels required to render bundles, cart upsells, quiz recommendations, and post-purchase offers.
• Order data used for analytics, attribution, and revenue reporting back to the merchant.
• Checkout and post-purchase order data: the order a shopper has just paid for, its total, line items, currency, and payment status. Post Purchase Upsell uses this to decide which offer to show and to add an accepted item to that same order.
• Discount codes and promotions created by the app.

Shopper-facing app data

• Device and activity data (approximate location, IP address, browser, operating system) used for app analytics scoped to the shop.
• Cart and bundle session state, so shoppers do not lose progress on refresh.
• Quiz answers, and email or phone numbers a shopper explicitly submits through Product Quiz Maker. Where a merchant connects an email or SMS platform, those contacts sync to the merchant’s own account there.
• Post-purchase offer events: which offer was shown, on which page, whether the shopper accepted or declined it, and how long the decision took. Used for the merchant’s own reporting on their own store.

Payment data

Attravo never receives, stores, or processes payment card numbers or bank details, in any app. When a shopper accepts a post-purchase offer, Shopify authorizes and captures the charge against the payment method already attached to that order. We see only whether the charge succeeded and the amount. Card data stays inside Shopify’s PCI-compliant checkout at every point.

Merchant staff data

• Store owner contact details (name, email, address) used for billing and support.

For app data the merchant is the controller and Attravo is the processor. Merchants are responsible for having a lawful basis to collect shopper data through our apps and for disclosing it in their own store privacy policy.

Services engagements involve direct, scoped access to the customer’s tooling under a signed Master Services Agreement and the associated DPA.

• Shopify admin access with role-based permissions, limited to what the engagement requires.
• Read or read/write access to your email and SMS platform, analytics, and testing tools, as relevant to the engagement and as you grant it.
• Customer and order data used for cohort analysis, retention modeling, and CRO test design. We aggregate wherever the analysis allows it.
• Stakeholder contact data (name, email, role) for project communication.
• On app development engagements: a source repository in your organization, a development store, and scoped API credentials for the systems the app must talk to. We work against test data wherever the build allows it, and we do not copy production customer records into a development environment.

Access is revoked at engagement close, and any data we extracted during the engagement is deleted then too. The “Retention and deletion” section below gives the timing.

Our AI agents are in development. When they launch they will read store data to spot conversion leaks, watch retention signals, and flag operational anomalies. This section states how they will handle data so the commitment exists before the product does.

What agents read

• Store, product, order, and analytics data already covered above, under the scopes you approve.
• The outputs of previous agent runs, so an agent can build on its own prior analysis for your store and only your store.

How model providers are used

• Agents send prompts to third-party model providers, listed on our sub-processors section, to generate analysis and recommendations.
• We minimize what is sent. Personal data is excluded from prompts wherever the analysis does not require it, and we aggregate or pseudonymize where it does.
• Your data is not used to train or fine-tune any model, by us or by our providers.
• Prompts and outputs are retained only as long as needed to run the agent and show you its reasoning, and are deleted on the same schedule as the rest of your data.

Automated decisions and human oversight

Agents produce recommendations and, where you explicitly enable it, take actions inside scopes you have granted. You control which actions an agent may take without approval, and you can require review for any of them. We do not use agents to make decisions producing legal or similarly significant effects about individual shoppers. Agent output can be wrong, so material changes should be reviewed by a person before they ship.

• Contact form submissions: name, work email, store URL, interest area, and message body.
• Waitlist signups: email and any context you submit.
• Analytics: page views, referrer, device, and approximate location via Google Analytics. We do not run advertising or remarketing pixels, and we do not sell or share this data with advertising networks.
• Calls you book with us: your name, email, and answers, through Calendly.
• Conversations in the support chat on this site, as set out in the support section below.

Website analytics is entirely separate from app and store data. For details on cookies and how to opt out, see our cookies policy.

Our support chat, help center, and roadmaps run on our own platform, Attravo Support, at support.attravo.com. For this data Attravo is the controller: it is how we look after you, not something we process for a merchant.

Support chat

• What you write and send: your messages, files you attach (images, PDFs, and videos, up to 10 MB each), and an email address if you leave one, so the team can reach you if you go before they answer.
• The page you started the chat on, its address and title, so the team knows what you were looking at.
• If you are not signed in, a random ID for your chat session and nothing else about you until you tell us. If you open the chat inside one of our apps, the app signs you in: we receive your name and email from your Shopify staff account, and your store’s name, domain, Shopify plan, whether it is a development store, and your app plan, so we can help without asking.
• Feature ideas and votes you send from an app’s roadmap, linked to your chat contact.
• Whether a reply has been read, so the chat can show a count of new replies and a short preview of each once.
• Totals for our short announcements above the chat’s button, by the hour: how many times each was shown, opened, followed, or closed, and in which app. We count them without recording who.

AI answers

When the chat’s AI assistant is on, it reads your message together with our help articles, answers our team approved, pages from attravo.com, and, if an app signed you in, the store details above. It sends these to Anthropic, which writes the answer and does not use it to train models. Answers from the AI are labeled as such. It passes the conversation to our team when it cannot settle it, and you can ask for a person at any time.

Help center

• Reading statistics without cookies: which pages are read, for how long and how far down, what is searched for and how many articles it found, which links are followed out, and the referring site and device type. Readers are counted by a hash of the address, browser, and day, made on our server and impossible to follow from one day to the next. Nothing is recorded when your browser sends Do Not Track or Global Privacy Control.
• “Was this helpful?” votes. Voting sets a random ID in a cookie so you can change your vote, and we store only a hash of it.
• Articles with a video load it from YouTube in its privacy-enhanced mode, Vimeo with Do Not Track on, Loom, or Wistia, under their own privacy policies.

What each part stores in your browser is listed in our cookies policy.

Our apps run on Google Cloud Platform, with application data in a managed MongoDB database. Our support chat, help center, and roadmaps run on Cloudflare, with their data in Supabase in the United States. Data is encrypted in transit with TLS and encrypted at rest by our infrastructure providers.

• Production data is logically isolated per Shopify shop.
• Access to production systems is restricted by role and protected by multi-factor authentication.
• Backups are encrypted and rotated on a fixed schedule, so a deleted shop’s data ages out of backups rather than persisting indefinitely.
• A support conversation is open only to the person who started it and our team. Files sent in a chat are kept in private storage and opened through links that expire within an hour.
• Source code is version controlled. Customer data is never committed to a repository.
• We follow least-privilege access, dependency scanning, and a documented incident response process.

We are not currently certified under SOC 2 or ISO 27001. We describe the controls we actually operate rather than claiming an audit we have not completed. Ask us at support@attravo.io for a written summary of current controls.

A sub-processor is a third party we engage to process personal data on a customer’s behalf. This section is the authoritative list, and our DPA incorporates it by reference. Each provider is bound by written terms no less protective than this policy.

We keep the list short on purpose. Every entry is a party we actually use today. We do not list providers we are merely evaluating, and we do not pad it with tools that never touch customer data.

Current sub-processors

• Google Cloud Platform: Application hosting, compute, and storage for the Shopify apps.
  Regions: United States, European Union, Asia-Pacific
• MongoDB: Managed database holding app configuration and shop-scoped records.
  Regions: United States, European Union
• Shopify: App installation, OAuth, subscription billing, and order webhooks.
  Regions: United States, European Union, Canada. Scope: Apps only
• Stripe: Payment processing for services invoices, and the processor behind Shopify Payments.
  Regions: United States, European Union
• Amazon Web Services (SES): Transactional email for app and account notifications.
  Regions: United States
• Google Analytics: Aggregate traffic measurement on attravo.com.
  Regions: United States, European Union. Scope: Website only, never app or store data
• Supabase: Stores the support conversations people start with us and the files they send in them, our help center and its reading statistics, and our public roadmaps.
  Regions: United States. Scope: Support, help center and roadmaps
• Cloudflare: Serves attravo.com, our support chat and our help center, and protects them from abuse.
  Regions: Global network
• Anthropic: Writes AI answers in our support chat from our help articles, our website and, for merchants signed in through an app, their store's details. Prompts are not used to train models.
  Regions: United States. Scope: Support chat only
• Google Workspace: Email for our team and our support inbox, including replies to people who leave their email in a chat.
  Regions: Global
• Calendly: Scheduling when you book a call with us.
  Regions: United States. Scope: Website only

AI model providers

Engaged for our AI agents, which are in development and not yet generally available. Listed in advance so the disclosure is in place before the product ships rather than after.

• Anthropic: Model inference for the AI agents. Prompts are not used to train models.
  Regions: United States. Scope: Agents only, not yet generally available
• OpenAI: Model inference for the AI agents. Prompts are not used to train models.
  Regions: United States. Scope: Agents only, not yet generally available

Neither provider uses your data to train or fine-tune models. Agents send the minimum data an analysis requires, aggregated or pseudonymized wherever that is possible.

What is not on this list

Some tools we use never process customer personal data, so they are not sub-processors: source control and code review, where customer data is never committed to a repository, and internal team communication and project tracking, which carry project notes rather than store or shopper data.

During a services engagement we also work inside tools that you own and control, such as your Shopify admin, your email and SMS platform, and your analytics. Those remain your vendors under your own agreements. We are a user of them, not a processor behind them.

Changes and notice

Before a new sub-processor begins processing personal data, we give customers at least 30 days notice. Customers may object on reasonable data protection grounds. If we cannot find a workable resolution, the customer may terminate the affected service. To be notified of changes, email support@attravo.io and ask to be added to the sub-processor notification list.

We retain data only while we are actively providing the service. There is no post-relationship archive.

When you uninstall an app

• Deletion is triggered automatically by Shopify’s uninstall webhook and completes within 48 hours.
• Everything shop-scoped goes: sessions, order records, quiz responses, bundle and cart configurations, and analytics records.
• Residual copies inside encrypted backups age out on the next rotation, within 30 days. They are not restorable into production and are not used for any purpose in the meantime.

When a services engagement ends

• All access we were granted is revoked at engagement close.
• Data we extracted for analysis is deleted within 30 days of close, unless you ask us in writing to hold it for a follow-on sprint.
• Deliverables you paid for remain yours. Working copies on our side are removed.

Support conversations and the help center

• Support conversations and the files sent in them are business correspondence. We keep them while they help us support you, and delete a conversation, its files, and your chat contact within 30 days when you ask at support@attravo.io.
• Help center reading statistics are deleted after 13 months. They hold no names, emails, or addresses.

What we keep and why we keep it

Two narrow exceptions, neither of which includes your shoppers’ personal data: billing and tax records we are legally required to retain, and ordinary business correspondence such as the support conversations and email threads you start with us. Anything under a legal hold is retained until the hold lifts.

Shopify mandatory webhooks

We implement Shopify’s required privacy webhooks: customers/data_request, customers/redact, and shop/redact. Requests sent directly to us are honored within 30 days.

Depending on your jurisdiction (GDPR, UK GDPR, CCPA and CPRA, LGPD, and similar laws), you may have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your personal data.
• Request a portable copy of your data.
• Object to or restrict certain processing.
• Withdraw consent where processing relies on consent.
• Be free from discrimination for exercising any of these rights.
• Lodge a complaint with a supervisory authority in your jurisdiction.

We do not sell personal data and we do not share it for cross-context behavioral advertising, as those terms are defined under California law.

Shoppers: we process your data on behalf of the store you bought from, so start with that merchant. Email us at support@attravo.io and we will route your request to them and assist. Merchants and customers: email support@attravo.io directly. We respond within 30 days.

We are based in the United States and our sub-processors operate in the regions listed on the sub-processors section. Where personal data is transferred out of the EU, UK, or Switzerland, we rely on Standard Contractual Clauses or another legally recognized transfer mechanism.

Our apps, services, and agents are sold to businesses and are not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact support@attravo.io and we will delete it.

We update this policy as our products, sub-processors, or applicable laws change. Material changes are announced in the app dashboard and by email to active customers at least 30 days before they take effect. The “Last updated” date above reflects the most recent revision.

For privacy questions, data requests, or to report a concern:

Attravo
66 W Flagler Street, Suite 900, Miami, FL 33130, USA
support@attravo.io

We respond within 24 business hours.