Decisioner Privacy Policy

Last updated: 2026-10-18

1. Who we are

Decisioner ("the App", "we", "us") is a Shopify app operated by Lalettayin LTD, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.
Contact for privacy questions: privacy@decisioner.co.uk.

2. Scope and roles

This policy explains how the App processes personal data when a merchant installs it on a Shopify store.

Merchant data (the store and its staff users): we are the controller of the data we need to run the merchant relationship (account, support, billing status, product analytics of how staff use the App).
Customer data (the merchant's shoppers): the merchant is the controller. We process it only as the merchant's processor, on the merchant's instructions, under our Data Processing Addendum (https://decisioner.co.uk/legal/dpa.html). Shoppers who want to use their privacy rights should contact the merchant first. We help the merchant answer.

Shopify is the platform the merchant uses. Shopify's own processing is covered by Shopify's privacy policy, not by this one.

3. What the App does

The App reacts to customer events in the merchant's store that the merchant turned on: an abandoned checkout, a cart or product browsing left without an order, a new account, a first order fulfilled, a large refund. For each one it decides whether to send a message, when to send it, which merchant-approved message and channel to use and whether to include a discount within the merchant's limits. A customer gets at most the merchant's daily message limit across all of them. The email is sent through the merchant's own Klaviyo account or through the merchant's own Shopify Flow workflow. The App only messages customers whose email marketing state is SUBSCRIBED.

4. Personal data we process

4.1 Customer data (as processor)

Data	Purpose	Stored by the App?
Shopify customer ID	link a checkout to a customer; start the merchant's Flow workflow	yes, with an internal pseudonymous key
Email address	consent check in Klaviyo; the recipient of the Klaviyo event	no — read at the time of the call, never stored or logged
Email marketing consent state, data-sale opt-out	only consenting customers are messaged; opted-out customers are not processed	no (only the pass/fail result)
Order history summaries (lifetime order count; last 60 days order count, spend, recency, discount use)	decide whether and when to send, as coarse bands	bands only, and only if the merchant turned on learning
Cart total, item count, product category groups	decision input; merchant category exclusions	yes
Checkout token, checkout ID, recovery link	avoid duplicates; the link in the email	yes
Customer time zone (from Klaviyo)	quiet hours in the customer's local time	only the local-time bucket
Order ID, order value, discount used	measure the outcome and the effect of messages	yes
Storefront events from the App's web pixel (product viewed, added to cart, checkout started, collection viewed, search submitted) — only with the visitor's analytics and marketing consent	decide whether a browse or cart message is useful	only coarse facts (event type, time, product category group), 90 days; never page addresses, search words, product titles or contact details
A pseudonymous visitor key (a keyed hash of Shopify's client id) linked to a customer — only after a checkout of that customer or a click on a link in one of the App's messages, and only with consent (incl. sale-of-data consent)	recognise a returning customer on the storefront	yes, 30 days after the last use
Storefront sign-up (email) with double opt-in	record the customer's own confirmed opt-in	the confirmed consent record (wording version and hash, region, time), never the email address

We do not process customer names, phone numbers, postal addresses or free text from the cart. We do not fingerprint devices, match by IP address, device or browser, use identity graphs or combine data across stores. Without consent the web pixel sends nothing. We do not log webhook payloads or pixel payloads.

Some product categories (health care, mature, religious and ceremonial, tobacco) are grouped as "sensitive". They are never sent to the decision model and are excluded by default.

4.1a Storefront pixel, visitor linking, tracked links and sign-ups (as processor)

Web pixel. The App's Shopify web pixel listens only to these storefront events: product viewed, product added to cart, checkout started, checkout contact information submitted, collection viewed and search submitted. It runs only while the visitor allows both analytics and marketing in the store's consent banner, re-checks consent before every send and stops when consent is withdrawn. It sends only ids, the event name, the time and the consent state; the App keeps coarse facts (event type, time bucket, product category group) for 90 days. It never sends or keeps page addresses (URLs), search words, product titles, form fields, keystrokes or contact details, and there is no session replay of shoppers.
Visitor linking (identity stitching). A visitor is identified only by a keyed hash (HMAC with a per-store secret) of Shopify's browser client id. This is pseudonymous data, not anonymous data. It is linked to a customer only after that customer's checkout in the store or a click on a link in one of the App's own messages, and only when the visitor also allows the sale/sharing of data. A link lasts 30 days after its last use (sliding) and is never used across stores. A login on the storefront is recorded only as an unverified claim and never triggers a message. Without a link an event waits at most 30 minutes and is then dropped.
Tracked links. Links in the App's messages carry a short signed token (dc) with the store, the decision reference, an expiry of at most 7 days and its purpose. It contains no email address or customer id, is verified on our server and can be used once. It is read only by the App's pixel, so only with the visitor's analytics and marketing consent; this follows the EDPB Guidelines 2/2023 on the technical scope of Art. 5(3) of the ePrivacy Directive, which treat tracking links as access to the user's terminal equipment. The App adds no open-tracking pixel of its own; tracking in the merchant's email tool is the merchant's setting there.
Sign-ups (double opt-in). A storefront sign-up never grants consent by itself. The App sends one confirmation email with a signed, single-use link valid for 2 days; consent is recorded only when the visitor presses Confirm on the opened page. The evidence kept is the wording version, a SHA-256 hash of the wording shown, the region, the source form and the time; never the email address. Unconfirmed requests are deleted after 3 days.

4.2 Merchant data (as controller)

Store domain, store settings in the App, plan status, consents and attestations given in the App.
Staff user ID of the person who approves messages, gives consents or downloads data exports.
Product analytics of staff use of the App (page views, feature events, errors, and masked session replay of the App screens). These events contain no shopper personal data. Text inputs are masked and the Shopify admin URL query (tokens, store parameters) is removed before sending.
Merchant-written message templates and brand voice, which the merchant may send to our AI drafting feature.
The merchant's Klaviyo private API key, encrypted at rest.

5. Automated decisions

The App makes automated marketing decisions: whether to send a message, when, which merchant-approved message and channel, and which discount tier within the merchant's limits. These decisions have no legal effect and no similarly significant effect on the shopper. A discount is only a bonus over the normal price: a shopper without an offer can still buy at the normal price, and no price, credit, access or eligibility to buy is decided. By default a staff member approves each message before it is sent. A random 5–10 % of customers (holdout) receive no message, so the merchant can measure the effect. The decision model does not receive protected attributes (such as health, religion, ethnicity, sexuality, gender, age or disability), proxies for them, or direct identifiers, and no discount depends on them. Shoppers who have questions about a decision or want a person to look at it contact the merchant; the merchant can reach us at privacy@decisioner.co.uk.

5.1 Learning from the merchant's store (opt-in, per store)

Learning is off by default. Only if a staff user of the store ticks the learning consent box and presses "I agree" does the App train and update machine-learning models (the per-store choice model and the per-store calibration of the decision model's estimates) on that store's Shopify data (orders, checkouts and message outcomes). Those models are used only for that store. Data from one store is never pooled with other stores' data, never used for another store and never used for any general or shared model; the starting values every store begins with come from synthetic data only. The merchant can withdraw at any time in Settings; the App then stops learning and deletes the learned data at once (and on uninstall and shop/redact). We keep the wording version, a SHA-256 hash of the exact text shown, the staff user, the store and the time as the record of the consent.

6. Legal bases

Customer data: processed on the merchant's instructions (the merchant chooses its own legal basis, normally consent for email marketing).
Merchant account and service data: performance of our contract with the merchant.
Product analytics and security logs: our legitimate interest in running, securing and improving the App.
Legal obligations (for example, keeping GDPR request records).

7. Who receives the data (subprocessors)

We use the subprocessors in our subprocessor list (https://decisioner.co.uk/legal/subprocessors.html): Google Cloud (hosting and AI drafting in the EU), Klaviyo (only if the merchant connects it), PostHog EU (product analytics of staff use), TypeSafe (decision model, pseudonymous banded features only, no identifiers), and, for pre-release testing only, Supabase. We do not sell personal data. We do not share it for advertising, ad retargeting or any cross-site or cross-store profile.

No training by model providers. Google Vertex AI and TypeSafe process requests for inference only and must not use the data to train or improve their models. Google's Vertex AI terms exclude training on customer data; for TypeSafe the commitment is part of the data-processing addendum that must be signed before any real store data is sent (until then it receives synthetic and development store data only).

8. International transfers

The App is hosted in the EU (Google Cloud europe-west1). Some subprocessors are based in, or may access data from, the United States (TypeSafe, Klaviyo, support access by other providers). We rely on the European Commission's Standard Contractual Clauses and additional measures (minimisation, no direct identifiers to the decision model, encryption in transit). For transfers from the United Kingdom and Switzerland we use the UK International Data Transfer Addendum and the Swiss FDPIC amendments to the EU SCCs.

9. Retention

Decision, delivery and outcome records: 13 months.
Customer profile summaries: 13 months after the last activity.
Detailed decision-model call log: 30 days, then aggregated without personal data.
Data exports for GDPR requests: link valid 7 days.
Webhook receipts and job payloads: 7 days.
Storefront events: 90 days. Visitor-to-customer links: 30 days after the last use. Unconfirmed sign-up requests: 3 days.
GDPR request records and export access log: 3 years, with the customer key removed when the request is completed.
After uninstall: the Klaviyo key and sessions are deleted at once; all store data is deleted 30 days after uninstall unless the merchant reinstalls first. Shopify's shop/redact request always deletes all store data.
Backups expire within 30 days, so deleted data leaves the backups within 30 days.

10. Security

Encryption in transit (TLS) on every connection; database access only through mutually authenticated TLS; encryption at rest by our hosting provider; additional AES-256-GCM encryption for the Klaviyo key, internal keys and data exports; least-privilege access with multi-factor authentication; access logging of the database, secrets and data exports. We notify affected merchants without undue delay, and within 24 hours of becoming aware of a personal data breach.

11. Your rights

Shoppers: contact the merchant where you shopped. Shopify forwards the merchant's data access and deletion requests to us, and we answer within 30 days.
Merchants and staff users: you can ask for access, correction, deletion, restriction, portability or objection by writing to privacy@decisioner.co.uk. You can revoke the learning consent in the App settings at any time; this deletes the learned data.
You can complain to your data protection authority. Our lead supervisory authority is the Information Commissioner's Office (ICO), United Kingdom.

12. Children

The App is a business tool for merchants. It is not directed to children.

13. Changes

We publish changes on this page and update the date at the top. We tell merchants in the App about material changes before they take effect.

14. Contact

Lalettayin LTD, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom, privacy@decisioner.co.uk.

15. For merchants: your obligations and a template paragraph

As the controller of your customers' data you must (1) name Decisioner as a service provider in your privacy policy, (2) use a consent banner connected to Shopify's Customer Privacy API that describes Decisioner's pixel as marketing/personalisation tracking, (3) collect email marketing consent lawfully, (4) manage tracking and storage in your own email tool and Flow workflow, and (5) forward customer requests through Shopify. A template paragraph for your privacy policy and banner text for the marketing category follow; adapt them to your store and have them reviewed.

Template paragraph for your privacy policy

Marketing messages and Decisioner. We use Decisioner, a Shopify app, as our service provider to decide whether, when and with which message or discount to contact customers who leave a checkout, a cart or products without ordering, and after some orders. Decisioner uses order and checkout information from our Shopify store and, only if you allow analytics and marketing cookies, coarse browsing events from our store (for example "viewed a product" or "added to cart" with the product category and time; never page addresses, search words or anything you type into forms). If you also allow the sale or sharing of data, a visit can be linked to your customer account after you check out or click a link in one of our messages; this link uses a pseudonymous key (a keyed hash of a browser identifier) and lasts 30 days after its last use. Links in our messages carry a short signed token so that we can recognise the click. Browsing events are kept for 90 days. Decisioner's decisions are automated marketing decisions: they never change the normal price you can buy at (a discount is only an extra offer), they do not use sensitive characteristics, and a small random group of customers receives no message so that we can measure the effect. [We review each message before it is sent. — delete if you use automatic sending.] Decisioner keeps decision and outcome records for up to 13 months. You can withdraw marketing consent through the unsubscribe link in any message or your cookie settings, and you can ask us for access to or deletion of your data at [YOUR CONTACT].

Marketing and personalisation: lets us and our service provider Decisioner use the products you view or add to your cart on this store to decide which follow-up message or offer to send you, and to recognise you when you return from one of our messages. Not shared with other stores.