Somix Lab
Privacy policy
The short version
Somix shows product recommendations on a store’s storefront. To report which recommendations earned money, it reads orders. It reads the parts of an order that identify the sale — the order’s id, its total, its currency, its date — and it does not store anything that identifies the person who placed it. No customer name, email address, postal address or phone number is ever written to our database, even though Shopify sends them to us in the same message.
What the app reads
The app requests these permissions when a merchant installs it:
- Products
- To list a store’s catalogue when a merchant chooses which products to recommend, and to preview a widget with their real products. The app also writes a product’s recommendations to that product’s own metafield, so the storefront can read them without contacting us.
- Orders
- To attribute revenue to a widget. See below — this is the only permission that touches customer data, and the app is deliberately narrow with it.
- Themes
- Read-only, to check whether the app’s block has been added to the live theme, so the setup guide can tick its own steps.
- Discounts
- To create the automatic discount that applies to a bundle. The discount is applied by a Shopify Function; the app does not see a cart or a checkout.
Orders, specifically
When a shopper adds a bundle from a Somix widget, the widget marks those cart lines with a property naming the widget. When the order is placed, Shopify notifies the app, and the app reads that property back. Attribution is therefore a lookup, not a guess: no order is matched by timing, by product, or by any characteristic of the shopper.
From each order the app stores exactly five things:
- the order’s Shopify id
- which widget the line came from
- the amount attributed to it
- the currency
- the date it was created
Shopify’s notification also contains the customer’s name, email address, shipping address and phone number. The app reads none of them into storage. They are discarded with the rest of the message once the five values above have been taken.
These rows are deleted automatically on a rolling schedule. Once deleted, only the daily totals remain — a count and a sum per widget per day, which cannot be traced back to an order or a person.
What shoppers’ browsers send
The widget records three things: that it was shown, that something in it was clicked, and that something was added to the cart. These are counted in the browser and sent as a single message when the shopper leaves the page. That message contains the widget’s id and three numbers. It contains no cookie, no identifier, and nothing that could distinguish one shopper from another.
Nothing is sent at all unless the store’s own consent settings allow analytics. Where consent has not been given, or is not yet known, the counts are discarded rather than held.
Product data shown in a widget comes from Shopify’s own recommendations endpoint and from the store’s theme. The storefront makes no request to Somix for it.
Where it is kept
Data is stored on servers in the European Union and the United States, operated by our hosting, database and cache providers. Access tokens issued by Shopify are held encrypted at rest and used only to make the API calls described above.
Somix does not sell data, does not share it with advertisers, and does not use it to train anything.
When a merchant uninstalls
Uninstalling revokes the app’s access immediately. Shopify notifies the app, which deletes the store’s cached data at once and its stored records within 48 hours, in line with Shopify’s requirements for app developers.
A merchant may also request erasure at any time by writing to the address below, whether or not the app is still installed.
Requests from shoppers
If a shopper asks a merchant what data Somix holds about them, or asks for it to be deleted, Shopify passes that request to the app and the app answers it. In practice the answer is usually that there is nothing to return: the app stores no field that identifies a person.
Contact
Questions about this policy, or about data held for your store: support@somixlab.com