Zoomifi - Bought Together AI Privacy Policy
Zoomifi - Bought Together AI (“the App”) is provided by Zoomifi to merchants who use Shopify to power their stores. The App generates "frequently bought together" product recommendations on storefront product pages by analyzing the co-occurrence of products in past orders. This Privacy Policy explains exactly what data we access, how long we keep it, how we protect it, and what happens when a merchant uninstalls.
1. Information we access
From the merchant's Shopify store
Once a merchant installs the App, we access the following data via Shopify's Admin API and via webhook subscriptions:
| Field | Source | Used for |
|---|---|---|
| Order ID and order created date | orders/create webhook + bulk-operations backfill |
Idempotency key — preventing duplicate ingestion of the same order if Shopify redelivers a webhook — and enforcing the 30-day retention limit below |
| Order line item product IDs | Same as above | The only recommendation signal — incremented into a per-shop co-occurrence aggregate (e.g. "product A and product B were in the same order N times"). Each order counts once per pair, however many units were bought |
| Order line item variant IDs | orders/create webhook |
Received with each line item; not stored in our database |
| Product handles, titles, vendors, and image URLs | Admin API (including the product fields on order line items during the one-time backfill) | Rendering the recommendation cards on the storefront (link target, label, thumbnail) and finding products in the App's admin |
We do not access or store: customer ID, customer name, customer email, customer phone, customer address, billing address, shipping address, line item quantities, line item prices, order monetary fields (subtotal, total, tax, shipping, currency), discount codes, gift cards, payment method, fulfillment status, tracking, cart abandonment data, browsing history, or session data.
The recommendation engine is intentionally customer-anonymous: every shopper visiting a given product page sees the same recommendations. There is no per-customer personalization, and we never store who placed an order. We do keep the Shopify order ID for up to 30 days (see section 2). Shopify, and the merchant, can link that ID to the customer who placed the order, which is why we act on Shopify's customer data requests (see section 4).
From the merchant directly
When a merchant installs the App, we receive their store name, shop domain, store email address, owner name and contact email, and their Shopify plan, plus any configuration values they enter in the App's admin (recommendation rules, card style). This is standard merchant-account information.
We send the store's name, domain, email addresses, plan and install and uninstall dates to Zoomifi's marketing portal, which sends the App's welcome email and, after an uninstall, a short feedback survey.
If the merchant uses Help inside the App, the name, email address, subject and message they enter, together with the store name, shop domain and optional app diagnostics, go to Zoomifi's support system so we can reply.
2. Data retention
For each order we keep three things: the Shopify order ID, the date the order was placed, and the product IDs in it. We use them to avoid counting the same order twice if Shopify resends it, and to build pattern-based recommendations. A scheduled job runs once a day and deletes every order placed more than 30 days ago, together with its product IDs. Older orders brought in by the one-time import of a store's order history are counted and then deleted on the next daily run.
The co-occurrence counts and the recommendation pairs built from them
are what drive recommendations. They store only product pairs and
numbers, for example (shop, product A, product B, count),
with no order IDs and nothing about customers. They, along with
products, settings and the merchant's account, are kept while the App
is installed and deleted as described in section 4.
3. How we protect data
- In transit: All Shopify API traffic uses TLS 1.3. Inbound webhooks are HMAC-verified against the Partner App secret before any payload is parsed; invalid signatures return 401. Storefront recommendation requests are signed via Shopify App Proxy HMAC and rejected if the signature is missing or invalid.
- At rest: Database storage is on AWS EBS volumes encrypted with AES-256 using AWS KMS-managed keys. Shopify access tokens are stored server-side only and are never exposed to browser JavaScript.
- Access control: The application database is not exposed as a public service. SSH access is restricted to a single IAM-bounded operator account. All merchant-facing admin actions are gated by Shopify session-token verification — only an authenticated merchant admin session can invoke them.
4. What happens when a merchant uninstalls
Deletion happens in two steps. The store's data is deleted within 48 hours of uninstalling, or at the latest within 7 days if Shopify's deletion request does not arrive.
- Right away. When Shopify tells us the App was
uninstalled (the
app/uninstalledwebhook), we delete the store's Shopify access tokens, mark its subscription inactive, and stop showing recommendations for the store. We keep the rest of the store's data for now: the store record and merchant contact details, settings, products, recommendations, co-occurrence counts, and any orders still inside the 30-day window. The daily 30-day order cleanup keeps running in the meantime. - When Shopify sends
shop/redact. Shopify sends this request 48 hours after an uninstall, and sometimes sooner. We then delete, in one database transaction, the store record, billing records, settings, products, manual and automatic recommendations, co-occurrence counts, orders and their product IDs, the merchant's user account (unless it is linked to another store) with its sessions and password reset tokens, and any queued or failed background jobs for the store. We also ask Zoomifi's marketing portal to erase what it holds for the store: it deletes the store's contact details and keeps only anonymous install and uninstall counts and survey answers that can no longer be linked to the store. If the request has still not arrived 7 days after the uninstall, a daily job deletes the same data in the same way. - If the merchant reinstalls the App before that request arrives, nothing more is deleted and the App carries on with the store's existing data. A repeated request changes nothing.
A few short-lived copies expire on their own rather than being deleted by step 2: cached values within a day, and browser sessions not tied to a merchant account within two hours. Server logs, which can include the shop domain, are not part of step 2; they are deleted after 14 days. Help requests sent to Zoomifi's support system are not deleted by step 2 either; email [email protected] to have them removed.
Customer data requests
customers/redact: when a customer's data must be erased, Shopify sends the list of that customer's orders. If we still hold any of them, we delete those orders and their product IDs. Because counts can't be traced back to a single order, we also reset the store's co-occurrence counts and automatic recommendations, which then build up again from the store's other orders. We hold no name, email, address or other customer details, so there is nothing else to delete.customers/data_request: we record the request and check which of the listed orders we still hold. The most we can hold for a customer is the order ID, the date the order was placed and the product IDs, for orders placed in the last 30 days.
5. Sharing of data
We do not sell, rent, or share merchant or customer data with third parties for advertising or marketing purposes. The only third parties that touch the data are infrastructure providers necessary to operate the service:
- Amazon Web Services (compute, database) — covered by AWS's data-processing addendum.
- Shopify (the platform the App is built on) — covered by Shopify's Partner Program data-handling terms.
We may also disclose information when required to do so by law, subpoena, court order, or other legal process, or to protect our legal rights.
6. Your rights
If you are a resident of the European Economic Area, the United Kingdom, California, or another jurisdiction with data-protection rights, you have the right to request access to, correction of, or deletion of personal data we hold about you. To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.
Data may be stored or processed outside your country of residence, including in the United States and Canada.
7. Changes to this policy
We may update this policy from time to time to reflect changes to our practices or to legal or regulatory requirements. The "Last updated" date at the top of the page reflects the most recent revision.
8. Contact
For any privacy-related question or request, contact us at [email protected].