What we hold, why we hold it, and how to make us stop.

Zinx Signal is operated by Zinx. There are two kinds of people in this policy and we hold a different role for each.

Merchants

You, if you have an account. For your account data we are the controller — we decide what is collected and why.

Shoppers

People visiting a store that has installed us. For their data we are a processor acting on the merchant's instructions. The merchant is the controller, and it is their privacy policy a shopper is owed.

If you are a shopper who has landed here from a store, the cookie page is the part that concerns you, and section 03 below lists everything we ever see.

Identity

Your name, email address and profile picture, from the Google account you sign in with. We never receive your Google password.

Workspace

Workspace name, members you invite, their roles, and the experiments you configure.

Store connection

Your myshopify domain, shop name, currency, and an access token issued by Shopify. Tokens are encrypted at rest, and so is the storefront password if your store has one.

Billing

Your plan, its status, and your billed visitor usage. Payment is handled entirely by Shopify — we never see a card number.

Support

Anything you send us by email, for as long as the thread is useful.

The lawful basis is contract: none of the above can be dropped without the product ceasing to work.

When a merchant installs us, a small script runs on their storefront and a Shopify web pixel runs at their checkout. Between them, this is everything recorded:

Visitor identifier

A random value we generate and store in a first-party cookie. It is not a Shopify customer id, not derived from any personal detail, and cannot be mapped to a person by anyone but the browser holding it.

Group assignment

Which group of which experiment the visitor is in.

Device class

Desktop or mobile. Not a model, not a fingerprint.

New or returning

Whether we had seen this browser before.

Traffic source

A coarse channel — direct, search, social, referral — and the referring site's hostname.

Country

A two-letter country code, read from Shopify's own localisation. No city, no region, and no IP address is stored.

Landing page

The path a visitor arrived on, with the query string removed.

Order facts

For a completed order: the Shopify order id, totals, discounts, shipping, and the products and quantities on it.

The order id is the only field that could be tied back to a named customer, and only by someone who already has access to the merchant’s Shopify admin. We hold nothing that lets us identify a shopper.

Not collected, at all: names, email addresses, postal addresses, phone numbers, payment details, IP addresses, or any behaviour on a page beyond the funnel steps a shopper reached.

Consent comes first

Before writing anything at all, the script asks Shopify’s Customer Privacy API whether analytics processing is permitted for that visitor. If the answer is no, nothing is written and nothing is measured — and anything stored on a previous visit is deleted from the device. Merchants can also set an experiment to treat an absent answer as a refusal.

Convex

Database and backend functions. Where the data lives.

Vercel

Hosting for the dashboard and marketing site.

Google

Sign-in only. They see that you signed in; they see none of your store data.

Shopify

The platform itself — the source of your store data, the delivery route for our pixel, and the processor of your subscription.

We do not sell data, we do not share it with advertising networks, and we do not use one merchant’s results to inform another’s. Nothing here is used to train a machine-learning model.

Experiment results

Kept while your account is active, because a result you cannot look back at is not a result.

Visitor and order rows

Kept while the experiment they belong to exists. Deleting an experiment deletes them.

After uninstalling

Shopify notifies us, and 48 hours later everything we hold for that store is erased. Access tokens are revoked immediately.

Account closure

Erased on request, within 30 days.

If you are in the UK, the EU or California you have rights of access, correction, deletion, portability and objection. To use any of them, email [email protected]. We answer within 30 days.

Shopper requests are automated

Shopify requires three privacy webhooks of every app, and ours do real work rather than answering 200 and filing nothing:

Data request

We assemble everything held against the named orders and store the answer for the merchant to forward.

Customer redaction

The order rows are erased. Aggregate counters are deliberately left alone — they contain no identifier, and unwinding one order from a running total would corrupt a live experiment for no privacy gain.

Shop redaction

Everything for that store — experiments, events, tokens, connection — is deleted in batches.

• Shopify access tokens and storefront passwords are encrypted at rest, and no endpoint returns one to a browser.
• Tokens are short-lived and rotated automatically, so a leaked one expires within the hour.
• Every backend function checks workspace membership before touching workspace data — including the ones a browser never calls.
• Webhooks verify Shopify’s signature before the body is read.
• Internal errors never reach the client. You see a message written for you; the detail stays in our logs.
• All traffic is over TLS. There is no unencrypted route in.

No system is perfect. If you find something, tell us at [email protected] and we will treat it as urgent.

If this policy changes in a way that affects what we collect or who we share it with, we will email account holders before it takes effect. The date at the top of this page is the date the current version came into force.

Questions, requests, or a disagreement with anything above: [email protected].