What we hold, why we hold it, and how to make us stop.

Zinx Signal is operated by Zinx. There are two kinds of people in this policy and we hold a different role for each.

Merchants

You, if you have an account. For your account data we are the controller, which means we decide what is collected and why.

Shoppers

People visiting a store that has installed us. For their data we are a processor acting on the merchant's instructions. The merchant is the controller, and it is their privacy policy a shopper is owed.

If you are a shopper who has landed here from a store, the cookie page is the part that concerns you, and section 03 below lists everything we ever see.

Identity

Your name, email address and profile picture, from the Google account you sign in with. We never receive your Google password.

Workspace

Workspace name, members you invite, their roles, and the experiments you configure.

Store connection

Your myshopify domain, shop name, currency, and an access token issued by Shopify. Tokens are encrypted at rest, and so is the storefront password if your store has one. The token carries only the permissions you approve; for price and offer tests those include creating discounts and, during a price rise, changing product prices.

Billing

Your plan, its status, and your billed visitor usage. Payment is handled entirely by Shopify, so we never see a card number.

Support

Anything you send us by email, for as long as the thread is useful.

The lawful basis is contract: none of the above can be dropped without the product ceasing to work.

When a merchant installs us, a small script runs on their storefront and a Shopify web pixel runs at their checkout. Between them, this is everything recorded:

Visitor identifier

A random value we generate and store in a first-party cookie. It is not a Shopify customer id, not derived from any personal detail, and cannot be mapped to a person by anyone but the browser holding it.

Group assignment

Which group of which experiment the visitor is in. It is also written onto the shopper's Shopify cart as a cart attribute, together with the visitor identifier, so checkout can apply a price or offer test and the order carries the group. These attributes hold our identifiers and nothing else.

Device class

Desktop or mobile. Not a model, not a fingerprint.

New or returning

Whether we had seen this browser before.

Traffic source

The campaign's own utm_source when the link carries one, and otherwise a coarse channel we derive from the referrer (direct, search, social or referral), plus the referring site's hostname.

Country

A two-letter country code for where the visitor appears to be, worked out from their browser's time zone and, failing that, its language setting. No IP address is stored or looked up. When neither answers, the country is left blank rather than guessed.

Market

The two-letter code of the Shopify market the visitor is shopping in, read from the merchant's own localisation. Someone in France browsing a US storefront is two separate facts, which is why this is not the same field as Country.

Time zone and language

The browser's IANA time zone (for example Europe/Paris) and its language tag (for example en-GB). These are what Country is derived from, and they are kept so a later correction to that mapping can be applied to rows already recorded.

Landing page

The path a visitor arrived on, with the query string removed.

Funnel steps reached

Whether the visitor viewed a product, viewed a collection, added to cart, began checkout, or ordered. Each is recorded once, as a yes or no. For a collection we also keep its title, so the results can be broken down by collection.

Order facts

For a completed order: the Shopify order id, totals, discounts, shipping, and the products and quantities on it.

The order id is the only field that could be tied back to a named customer, and only by someone who already has access to the merchant’s Shopify admin. We hold nothing that lets us identify a shopper.

Not collected, at all: names, email addresses, postal addresses, phone numbers, payment details, IP addresses, or any behaviour on a page beyond the funnel steps a shopper reached.

The browser’s user agent is checked inside the browser, to keep search and shopping crawlers out of tests. It is not sent to us or stored.

Consent comes first

Before writing anything at all, the script asks Shopify’s Customer Privacy API whether analytics processing is permitted for that visitor. If the answer is no, nothing is written and nothing is measured, and anything stored on a previous visit is deleted from the device. Merchants can also set an experiment to treat an absent answer as a refusal.

Convex

Database and backend functions. Where the data lives.

Vercel

Hosting for the dashboard and marketing site.

Google

Two separate things. Sign-in: they see that you signed in, and none of your store data. Analytics: Google Analytics runs on the public marketing pages only, so it records visits to pages anyone can read — never your workspace, your experiments or your results.

Shopify

The platform itself: the source of your store data, the delivery route for our pixel, and the processor of your subscription.

We do not sell data, we do not share it with advertising networks, and we do not use one merchant’s results to inform another’s. Nothing here is used to train a machine-learning model.

Experiment results

Kept while your account is active, because a result you cannot look back at is not a result.

Visitor and order rows

Kept while the experiment they belong to exists. Deleting an experiment deletes them.

After uninstalling

Shopify notifies us, and 48 hours later everything we hold for that store is erased. Access tokens are revoked immediately.

Deleting a workspace

The workspace disappears immediately and its contents are erased in batches: experiments, results, visitor and order rows, members, invites and usage. Your Shopify access token and storefront password are destroyed as part of it.

The one record that survives that

The store's domain and the date its free trial began. It is kept so that deleting a workspace and reconnecting the same store cannot mint a new trial each time. It holds nothing about shoppers and no credentials.

Account closure

Erased on request, within 30 days.

If you are in the UK, the EU or California you have rights of access, correction, deletion, portability and objection. To use any of them, email [email protected]. We answer within 30 days.

Shopper requests are automated

Shopify requires three privacy webhooks of every app, and ours do real work rather than answering 200 and filing nothing:

Data request

We assemble everything held against the named orders and store the answer for the merchant to forward.

Customer redaction

The order rows are erased. Aggregate counters are deliberately left alone. They contain no identifier, and unwinding one order from a running total would corrupt a live experiment for no privacy gain.

Shop redaction

Everything for that store, including experiments, events, tokens and the connection itself, is deleted in batches.

• Shopify access tokens and storefront passwords are encrypted at rest, and no endpoint returns one to a browser.
• Tokens are short-lived and rotated automatically, so a leaked one expires within the hour.
• Every backend function checks workspace membership before touching workspace data, including the ones a browser never calls.
• Webhooks verify Shopify’s signature before the body is read.
• Internal errors never reach the client. You see a message written for you; the detail stays in our logs.
• All traffic is over TLS. There is no unencrypted route in.

No system is perfect. If you find something, tell us at [email protected] and we will treat it as urgent.

If this policy changes in a way that affects what we collect or who we share it with, we will email account holders before it takes effect. The date at the top of this page is the date the current version came into force.

Questions, requests, or a disagreement with anything above: [email protected].