Tap Vortex app privacy policy

Who is responsible for what

• Merchants (Shopify store owners who install Tap Vortex) decide to use the app on their store. For information about their shoppers, the merchant is the controller, and Tap Vortex processes that information on the merchant's behalf and on their instructions.
• For merchants' own account information, Tap Vortex is the controller.

Shoppers who want to use their privacy rights should contact the store they shopped with. We'll help the store answer.

Information we collect from merchants

When you install Tap Vortex, Shopify gives us:

• Your store details: your shop's myshopify domain and an access token so the app can work. We keep these to keep you signed in to the app.
• Read access to your products, orders, themes and files. We use these to:
• Products: show your real products in the page designer and on vortex pages, and match products to quiz answers.
• Themes and files: read your live theme's colours, logo and font so a new vortex starts in your store's look. We never change your theme files.
• Orders: see the details below.
• What you create in the app: your vortex designs, page settings, tests and their settings, and follow-up choices.
• Your Klaviyo connection (optional): if you connect Klaviyo, we store your Klaviyo private API key encrypted (AES-256-GCM), plus the list you chose and the names and IDs of the follow-up flows we created for you. We never show the key again after you save it.
• Billing: plans and trials run entirely through Shopify. We see which plan you're on and how many trial days are left. We never see your payment details.

Information collected on your storefront (about your shoppers)

Vortex pages run on your store's own address (your-store.com/apps/vortex/...). Here's what they collect.

1. A random visitor ID and the shopper's "memory" To let a shopper pick up where they left off, the vortex remembers:

• their answers to your questions, chosen size, and whether they chose a subscription;
• the step they reached;
• what's in their bag (product variant, quantity, title, price as shown, image link) and the bag total;
• the product they were matched with, and up to six products they opened;
• which version they saw in an A/B test and which side of a "vortex vs current page" test;
• where they came from: the ad source, campaign and ad name from the link's tags, and the referring site (click IDs from ad networks are kept only as yes/no flags, never their values);
• each visit to the vortex: the date, the page reached, time active on the page, device type (phone, tablet or desktop) and the store's market country;
• how many times they've visited.

This is stored against a random visitor ID created in the shopper's browser. It isn't their name or account.

The memory is kept in the shopper's own browser (local storage). It is also sent to our servers only when Shopify's Customer Privacy API reports that the shopper allows analytics. If they don't, nothing about them reaches our servers and the memory stays only on their device, with one exception: if they type their email into a sign-up form and tick the box to get emails, we receive that email and their consent so the store can send what they asked for.

2. Activity events With the same consent, we record events such as "reached the questions page", "added to bag", "started checkout", "played the video" or "tapped a doubt". Each comes with a short detail (for example the bag value or the doubt text). These power the merchant's Reports, test results and the insights described below.

3. Email address (only if the shopper gives it) If you add a sign-up block and a shopper types in their email:

• we save it with their memory, so follow-ups can use their answers and bag;
• the vortex submits it to your store's own customer sign-up, so it shows in your Shopify Customers list, tagged vortex (plus the vortex name and their matched product);
• it's added to their cart as "Vortex email", so it appears on the order if they buy;
• if you connected Klaviyo, we send it to your Klaviyo account with their answers, match, bag and a link back to their vortex. If your store already runs Klaviyo's own onsite script, the vortex passes the email and bag events to that script too.

The shopper is signed up to marketing emails (in Shopify and in your Klaviyo list) only if they tick the consent box in the form. Every follow-up email we create for you includes an unsubscribe link.

4. Orders When an order is placed through a vortex checkout, Shopify sends us an order notification. From it we keep only: the order ID and number, total, currency, the products ordered (title, variant, quantity and price), and the tags our page added (vortex name, random visitor ID, the shopper's answers and match, test version, and the ad source of their visit). From these we write a short plain-English reason for the order (for example "Said dry skin, under $60. Bought their match."), shown to the store on the order. We don't keep the customer's name, email, phone number or address from the order. Orders that didn't come from a vortex are ignored.

5. Cookies and browser storage

The test cookies are only set once analytics is allowed. Shopify's own cookies and any scripts the store has installed (shown through Shopify's page header) are covered by the store's own privacy policy.

6. Resume links Follow-up emails contain a link with the shopper's visitor ID, so the link reopens their saved answers and bag. Anyone who has that link can see those answers and bag (not the email address), so shoppers shouldn't forward it.

How we use information

• To run the app and show each shopper their own journey on your store.
• To show you Reports, test results and revenue per visitor.
• To show you your shoppers' memory: each shopper's story (an anonymous timeline of their visits, answers, bag and orders), what shoppers are asking for, which ads bring which shoppers, bags left behind and their likely reason, suggested matching changes from your own order data (never applied without your approval), a weekly briefing, and answers to questions you ask about your own data.
• To build audiences you choose and, on your instruction, sync them to your Klaviyo account or prepare a hashed file for you to upload to Meta.
• To send follow-up events and sign-ups to your Klaviyo account, when you connect it.
• To suggest product matches when you press "Match with AI" (see Anthropic below).
• To support you, keep the service secure, and meet legal duties.

We don't sell personal information. We don't use shopper data for our own advertising, and we don't combine data across different stores.

Who we share it with (service providers)

We may also share information if the law requires it, or to protect our rights or users' safety.

How long we keep it

• While the app is installed: your vortexes and settings are kept so the app keeps working. By default, shopper events and visits are deleted after 13 months and a shopper's memory 13 months after their last visit. You can shorten this to 30 days, 3 months or 6 months in Your data, export everything we hold for your store, and delete any shopper at any time. Questions you ask in Ask are kept for 90 days. Credited orders keep only their total and currency after 13 months: the link to the shopper's visitor ID is removed, so Reports totals stay correct but the order can no longer be tied to a visit.
• After you uninstall: your app sessions are deleted at once, and your Klaviyo key and Meta connection are removed straight away. About 48 hours later Shopify asks us to erase your store's data (shop/redact). We then delete your vortexes, shopper memory, events, credited orders, tests and settings.
• Customer erasure requests: when a store's customer asks to be erased, Shopify tells us. We delete that shopper's memory and events. Their credited orders are anonymised: the order ID and visitor ID are removed, leaving only the total and currency.
• Customer data requests: when a customer asks the store for their data, Shopify tells us and we prepare everything we hold for that shopper straight away. It appears under Your data in the app for the store owner to download, with a notice on Home (and an email, when email is set up), and is kept for 90 days.

Data you've sent to your own Klaviyo account stays there under your control. Delete it in Klaviyo.

Security

All traffic is encrypted in transit (HTTPS/TLS). Our database is encrypted at rest. Klaviyo keys are encrypted again before they're stored. Access to production systems is limited to the people who run the app. Requests from your storefront reach us through Shopify's app proxy, which signs each request, and we reject any that aren't signed correctly. Shopify notifications are checked with Shopify's signature (HMAC).

Where it's stored

Our providers may store and process information outside Australia, including in the United States. Where the law requires it, we rely on suitable safeguards for these transfers.

Your rights

Depending on where you live (for example under the Australian Privacy Act, the GDPR/UK GDPR, or Californian law), you may have the right to see, correct or delete your information, object to or restrict how it's used, or complain to a privacy regulator.

• Merchants: email hello@tapvortex.com.au.
• Shoppers: contact the store you shopped with. They can action it in Shopify, and we'll follow their instructions. You can also email us and we'll pass it to the right store.

In Australia you can complain to the Office of the Australian Information Commissioner (oaic.gov.au) if you're not happy with our answer.

Children

Tap Vortex is a tool for businesses. We don't knowingly collect information from children.

Changes

If we change this policy we'll update the date at the top. If a change matters, we'll tell merchants in the app or by email first.

Contact

Tap Vortex · ABN 93 831 446 721 · Australia hello@tapvortex.com.au · https://www.tapvortex.com.au