Privacy Policy

Introduction

This policy ("Privacy Policy") describes how Plurality Digital Inc. d/b/a Shoplift (together with its affiliated companies, "Shoplift", "we", "us" and/or "our") may collect, use, disclose, and otherwise process user data when you visit https://www.shoplift.ai/ ("Website") or use our application, our API, and associated platforms (our "Application" and together with the Website, our "Services").

Please review this Privacy Policy carefully. Our Terms of Service at https://www.shoplift.ai/terms-of-service also apply to your use of the Services. This Privacy Policy may change from time to time (see Changes to Shoplift's Privacy Policy), and the date it was last updated is listed at the top of this page. If you have questions about our privacy practices, please contact us (see How to Contact Us).

Our Roles

Shoplift acts as a controller (or "business" under the California Consumer Privacy Act, the "CCPA") for Personal Information about visitors to our Website, prospective customers, and the users of merchant accounts on our Application. Shoplift acts as a processor (or "service provider") for the information our script collects from visitors to our merchants' storefronts, which we process on the merchant's behalf under our Data Processing Addendum at https://www.shoplift.ai/data-processing-addendum. See Merchant Store and Storefront Data below.

Information We Collect

The term "Personal Information" in this Privacy Policy refers to information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to an individual. It does not include aggregated or anonymized information that is maintained in a form that is not reasonably capable of being associated with or linked to an individual.

We collect the following categories of Personal Information, with respect to the following types of data subjects:

• User Data: Personal Information concerning customers' organizational account details and users of the platform on behalf of such customers, as well as the customer's business needs and preferences, as identified to us or recognized through our engagement with them.
• Prospect Data: Personal Information relating to visitors of our websites, participants at our events, and any other prospective customer, user or partners who visit, purchase, or otherwise interact with our Services.

Specifically, we collect or generate the following types of Personal Information about such individuals through our Services:

• Usage and device information concerning customers, users, and prospects (such as connectivity, technical and aggregated usage data, such as user agent, IP addresses and approximate location based upon such IP addresses (geolocation), device data (like type, operating system, device ID, browser version, locale and language settings used), activity logs (including cloud logs), API request logs (including the key identifier, endpoints called, request volume, and originating IP address), session recordings, website chat feature data, log-in credentials to the Services, the cookies and pixels installed or utilized on their device, and inferred or presumed data generated from users' use of the Services);
• Information concerning our customers, users and prospects, such as contact and business details including name, email, phone number, position, workplace, and professional information, related business insights, our communications with such individuals (and any analyses thereof), feedback and testimonials received, as well as any expressed, presumed, or identified needs, preferences, attributes, and insights relevant to our potential or existing engagement, purchasing details including interest and/or purchase history and commercial information, including records of our products or services purchased, obtained, or considered.

For the purposes of the CCPA, in the past 12 months, we have collected the following categories of personal information, as defined in the CCPA: identifiers; customer records information (such as name, email address, and phone number); commercial information; audio and visual information (recordings of calls and meetings); Internet or other electronic network activity information; geolocation data (approximate location derived from IP address); professional or employment-related information; and inferences drawn from the foregoing. Account log-in credentials are sensitive personal information, and we use them only to provide and secure the Services.

We have collected such Personal Information from the following sources:

• Automatically, when you use our Services.
• Merchants and Users.
• Service providers.

You are not legally required to give us Personal Information, but without account and contact details we cannot provide the Services.

Merchant Store and Storefront Data

Data from Shopify APIs: With your consent, upon installing Shoplift from the Shopify App Store, Shoplift sends and receives data to and from your Shopify store using the Shopify GraphQL Admin API and Webhooks, including the Theme, Assets, Products and Orders objects, to provide core features such as A/B testing, conversion analysis, app blocks and custom sections. Shoplift cannot operate without access to those objects. Shoplift does not store customer names, email addresses, phone numbers or street addresses from order data. We process store data on your behalf as a service provider or processor under our Data Processing Addendum, and do not use it for our own advertising or sell it.

When a merchant installs Shoplift, our script runs on the merchant's storefront and collects information about visitors and their activity on the store (such as IP address, device and browser type, pages viewed, referrer and campaign parameters, test and personalization assignments, and cart, checkout and order events) in order to deliver and measure tests and personalizations. Where the merchant connects other tools, such as Google Analytics or Klaviyo, the script also exchanges information with those tools on the merchant's behalf. We process this information on behalf of the merchant as a service provider or processor, under our Data Processing Addendum and the merchant's instructions. We do not use it for our own advertising or sell it. If you are a visitor to a merchant's store, that merchant's privacy policy governs, and you should direct any privacy requests to the merchant.

How We Use Personal Information

We use information that we collect about you or that you provide to us, including any Personal Information, to:

• Provide, operate and maintain the Services and monitor their use.
• Fulfill the purpose for which you provided the information, or any other purpose we describe when you provide it.
• Communicate with you, including by email, text message and telephone.
• Improve, test and troubleshoot the Services and understand how they are used.
• Market our products and services to you. Each marketing communication includes an opt-out, and you can ask us at any time to stop marketing communications (see How to Contact Us).
• Personalize your experience, remember your preferences when you return, and deliver content, offers and ads relevant to your interests on our Services and third-party sites.
• Protect the safety, security and integrity of the Services and our business.
• Perform our contracts with you, including our Terms of Service, and enforce our rights.
• Provide AI features, including by sending the relevant content to AI model providers as described under Disclosure of Your Information.
• For any other purpose with your consent.

Retention of Personal Data

We retain Personal Information for as long as we deem it as reasonably necessary in order to maintain our relationship and provide you with our Services and offerings; in order to comply with our legal and contractual obligations; or to protect ourselves from any potential disputes (i.e., as required by laws applicable to log-keeping, records and bookkeeping, and in order to have proof and evidence concerning our relationship, should any legal issues arise following your discontinuance of use).

To determine the appropriate retention period for Personal Information, we consider the amount, nature, and sensitivity of the data, the potential risk of harm from unauthorized use or disclosure of your Personal Information, the purposes for which we process the data, and applicable legal requirements.

Please note that except as required by applicable law or our specific agreements with you, we will not be obligated to retain your Personal Information for any particular period, and we are free to securely delete, anonymize, or restrict access to it for any reason and at any time, with or without notice to you.

Disclosure of Your Information

Within Shoplift: Shoplift entities may disclose Personal Information to other Shoplift entities for purposes and uses consistent with this Privacy Policy.

Service Providers: Shoplift engages third parties and service providers to provide services on our behalf to our Services users, in categories including cloud hosting and infrastructure, product analytics, customer relationship management, call scheduling, customer support, email delivery, payment processing, and AI model providers. These service providers are prohibited from using your Personal Information except for these purposes, and they are required to maintain the confidentiality of your information. Our current sub-processors for merchant data are listed in Annex III of our Data Processing Addendum at https://www.shoplift.ai/data-processing-addendum.

AI Model Providers: Some features of our Services use large language models provided by third parties, currently Anthropic and OpenAI. When a merchant uses those features, the content its users submit (such as prompts and test descriptions) and the store data the feature reads (such as product data, aggregated store data, audience segment data and test performance data) are sent to those providers to generate a response. We do not send visitor personal information collected by our storefront script to these providers. A merchant may ask us to disable AI features for its account at any time by emailing legal@shoplift.ai. Under our agreements with these providers, your content is not used to train their models, and the providers retain inputs and outputs for no more than 30 days before deleting them.

Your Employer: If you are using the Services in connection with your role as an employee or contractor of a company or other legal entity, we may share your information with such entity.

Third-Party Tools You Connect: If you use the Shoplift API with a third-party application, AI assistant, or other tool, that tool will receive the data you or it retrieve through the API, and may take actions in your account on your behalf. Those tools are not our service providers. Their collection and use of information is governed by their own privacy policies, and we are not responsible for them.

Legal Requirements: Shoplift may disclose your Personal Information if required to do so by law or in the good faith belief that such action is necessary to: (i) comply with a legal obligation or with applicable law, court order, or governmental regulation, including to respond to any government or regulatory request; (ii) to enforce or apply our Terms of Service and other agreements to which Shoplift is a party; or (iii) if we believe disclosure is necessary or appropriate to protect the rights, property, or safety of Shoplift, our customers, or others.

Third Parties in the Context of a Corporate Transaction: We may disclose Personal Information as reasonably necessary to a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of Shoplift's assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which Personal Information held by Shoplift about our Services users is among the assets transferred.

We do not sell Personal Information in exchange for money. In the past 12 months we have shared identifiers and Internet or other electronic network activity information with our advertising partners for targeted advertising, which California law calls cross-context behavioral advertising, as described under Online Advertising below. In the same period we disclosed each category of Personal Information listed above to our service providers for the purposes described in this policy. You can opt out as described under Your Privacy Rights and Choices.

Automatic Data Collection Tools

What We Collect:

As you navigate through and interact with our Services, we may use automatic data collection technologies to collect certain information about your equipment, browsing actions, and patterns, including traffic data, location data, cloud logs, communication data, and information about your computer and internet connection, including your IP address, operating system, and browser type. We and our service providers use session-replay and chat tools that record your interactions with the Services and the content of chats. We use the following tools for automatic data collection:

Cookies

A cookie is a small file placed on your device when you visit a website. We use the following types of cookies:

• Strictly necessary cookies, which enable core functionality such as security, network management and accessibility.
• Personalization cookies, which remember choices that change how the Services behave or look, such as your language or region.
• Analytical/performance cookies, which let us count visitors and see how they move around the Services so that we can improve them.
• Marketing cookies, which record your visits, the pages you view and the links you follow so that we, and third parties that provide services to us, can make the Services, our advertising and our marketing messages more relevant to your interests.

If you visit our Website from the European Economic Area, the United Kingdom, or Switzerland, we ask for your consent before setting any cookies other than strictly necessary cookies, and you may decline or withdraw consent at any time through the cookie settings on our Website.

Web Beacons

Pages of our Services and email communications may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags, and single-pixel gifs) that permit us to track traffic on our Services, for example counting users who have visited certain pages or opened an email or recording the popularity of certain content.

Third-Party Use of Automatic Collection Tools:

Some content or applications, including advertisements, on our Services are served by third parties, including advertisers, ad networks and servers, content providers, and application providers. These third parties may use cookies, alone or in conjunction with other tracking tools, to collect information about you when you use our Services. The information collected may be associated with your Personal Information or they may collect information, including Personal Information, about your online activities over time and across different websites and other online services. They may use this information to provide you with interest-based advertising or other targeted content.

We do not control these third parties' tracking technologies or how they may be used. If you have any questions about an advertisement or other targeted content, you should contact the responsible provider directly.

How We Use Information Collected Automatically:

We use or may use the data collected through automatic data collection tools to: (a) remember information so that an individual will not have to re-enter it during their visit or the next time they use our Services; (b) provide and monitor the effectiveness of our Services, including marketing communications; (c) monitor aggregate metrics such as total number of visitors, traffic, and usage on our Services; (d) diagnose or fix technology problems; (e) understand browsing activities on our Services and across third-party platforms; and (f) otherwise to plan for and enhance our Services.

Choices About Cookies:

You can manage non-essential cookies through the cookie settings on our Website and through your browser settings, which also let you delete or block cookies. Blocking some cookies may affect how the Services work. Our Website does not respond to browser "Do Not Track" signals, but it does honor Global Privacy Control signals as described under Your Privacy Rights and Choices.

Online Advertising

This section concerns advertising for Shoplift's own business. We do not use data collected by our storefront script from our merchants' shoppers for advertising.

What We Collect and How We Use It:

We participate in interest-based advertising and use third-party advertising companies to serve targeted advertisements based on an individual's browsing history. We permit third-party online advertising networks, social media companies, and other third-party services, to collect information about an individual's use of our Services over time so that they may play or display ads on other websites, or services an individual may use, and on other devices an individual may use. The collection and use of information by third-party cookies may be limited by certain operating systems and/or browsers. Typically, though not always, the information used for interest-based advertising is collected through data collection technologies, such as cookies, embedded scripts, location-identifying technologies, and similar technology which recognize the device an individual is using and collect information, including click information, browser type, time and date the individual visited the website, AdID, approximate location, and other information. We may share a common account identifier (such as a hashed email address or user ID) with our third-party advertising partners to help identify an individual across devices. We and our third-party partners use this information to make the advertisements an individual sees online more relevant to their interests, as well as to provide advertising-related services such as reporting, attribution, analytics, and market research.

Choices About Online Ads:

An individual can opt out of interest-based advertising from many ad networks through the sites below.

• In the United States, please visit: www.aboutads.info/choices, or http://www.networkadvertising.org/choices/
• In the European Economic Area, please visit: https://www.youronlinechoices.eu/
• In Canada, please visit: https://youradchoices.ca/

When electing to opt-out through these sites, they will place an "opt-out" cookie on your device indicating that you do not want to receive interest-based advertisements. Opt-out cookies only work on the internet browser and device they are downloaded onto. If an individual wants to opt-out of interest-based advertisements across all browsers and devices, they will need to opt-out on each browser on each device they actively use. If an individual deletes cookies on their device generally, they will need to opt-out again.

Please note that when an individual "opts-out" of receiving interest-based advertisements, this does not mean they will no longer see advertisements from us. It means that the online ads that an individual does see from Digital Advertising Alliance participants should not be based on their interests. We are not responsible for the effectiveness of, or compliance with, any third-parties' opt-out options or programs or the accuracy of their statements regarding their programs. In addition, third parties may still use cookies to collect information about an individual's use of our Services, including for analytics and fraud prevention as well as any other purpose permitted under the Digital Advertising Alliance's principles.

Your Privacy Rights and Choices

If you want to learn more about the Personal Information that Shoplift has about you, or you would like to update, change, or delete that information, please contact us by email at legal@shoplift.ai.

You may opt out of receiving marketing emails from us by following the instructions in those emails or by emailing us at legal@shoplift.ai.

If you are a resident of the EU, UK, California, or another jurisdiction with an applicable privacy law, you may have certain rights available to you. These rights may include:

• The right to be informed about our data collection practices;
• The right to access and rectify or correct your data;
• The right to erase or delete your data;
• The right to data portability;
• The right to restrict the processing of your data;
• The right to object at any time to our use of your Personal Information for direct marketing, or to processing based on our legitimate interests;
• The right to opt out of the sale or sharing of your information;
• The right to opt out of marketing emails and text messages;
• The right to limit our use of any automated decision-making processes;
• The right to lodge a complaint to your local data protection authority, and;
• The right to withdraw consent (to the extent applicable).

California residents may opt out of the sharing of Personal Information for cross-context behavioral advertising by clicking "Do Not Sell or Share My Personal Information" (or "Your Privacy Choices") in the website footer or by enabling the Global Privacy Control signal in a supported browser. We apply Global Privacy Control signals to the browser that sends them and to any account we can link to it. To opt out of sharing based on your email address, email legal@shoplift.ai. California residents may request the categories and specific pieces of Personal Information we hold about them, its sources, our purposes and the recipients. We verify requests using the email address on file. You may use an authorized agent, who must show your signed permission.

To exercise any applicable statutory right available to you, please contact us via email at legal@shoplift.ai. We will respond to your request as soon as reasonably possible within the applicable statutory period. If we deny your request, you may appeal by replying to our decision, and we will respond within the period required by applicable law. If you are in the United Kingdom, you may also complain to us about how we handle your Personal Information at legal@shoplift.ai.

The information that we collect through or in connection with the Services is transferred to and processed in the United States for the purposes described above. Shoplift may also engage service providers located outside your country of residence. The data protection laws of those countries may differ from the laws where you live. Where we transfer personal data from the EEA, UK, or Switzerland to a country that has not been found to provide adequate protection, we rely on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, or another lawful transfer mechanism. You may request a copy of these safeguards from legal@shoplift.ai.

Non-Discrimination

We will not discriminate against you for exercising your privacy rights, including by denying you services, charging different prices or providing a different level of service, except as permitted by the CCPA.

GDPR

Under the EU General Data Protection Regulation ("GDPR") and the UK GDPR, for individuals in the European Economic Area, the United Kingdom and Switzerland, we rely on the following legal bases: performance of a contract (providing the Services), consent (non-essential cookies and advertising, which you may withdraw at any time), legitimate interests (improving and securing the Services and marketing to business contacts), and compliance with legal obligations.

Where we collect, use, disclose and otherwise process your information based on legitimate interests, we may rely on the following interests:

• Marketing our products: We use your information as necessary to pursue our legitimate interests in marketing our products to you. For example, where permitted by digital marketing law, we may contact you by email to let you know of products you might be interested in.
• Providing, improving and developing our products: We use your information as necessary to pursue our legitimate interests in tailoring and improving our products. For example, we may send you a survey or questionnaire to understand your experience in purchasing from us.

The controller of your Personal Information is Plurality Digital Inc. d/b/a Shoplift, 712 Fifth Ave, Floor 7, New York, NY 10019.

Non-Personal Information

Data made available through the Shoplift API (such as test configurations, aggregated test results, audiences, and campaigns) does not include personal information about your store's customers or visitors.

Children

Our Services are not intended for anyone under 18, and we do not knowingly collect Personal Information from children under 18. If you believe we have collected Personal Information from a child under 18, please contact us at legal@shoplift.ai. We do not knowingly sell or share the Personal Information of anyone under 16.

Changes to Shoplift's Privacy Policy

Shoplift may revise this Privacy Policy from time to time. We will post changes on this page and update the date at the top. If we make material changes, we will notify you by email or through the Services before they take effect.

Data Security

Shoplift takes reasonable steps to protect your Personal Information from loss, misuse, and unauthorized access, disclosure, alteration, or destruction, taking into account the risks involved in the processing and the nature of the Personal Information. However, no application, Internet, or email transmission is ever fully secure or error-free, and we do not guarantee the security of any Personal Information. You are also responsible for ensuring that your account, passwords, and API keys are protected. We are not responsible for circumvention of any privacy settings or security measures contained within our Services.

How to Contact Us

Should you have any questions or concerns about this Policy, you can contact us at legal@shoplift.ai or by mail at Plurality Digital Inc. d/b/a Shoplift, 712 Fifth Ave, Floor 7, New York, NY 10019.