Privacy Policy

LiquidLift (“we”, “us”, “our”) provides a Shopify application that enables merchants to show personalised video offers to their storefront visitors and attribute resulting revenue. Our app is available at app.liquidlift.app.

For questions about this policy, contact us at hello@liquidlift.app.

From merchants (Shopify store owners)

• Shopify store domain and shop ID
• Shopify OAuth access token (AES-256 encrypted at rest — never stored in plaintext)
• Billing plan and subscription status
• Brand settings (store name, colours, welcome copy, integration credentials)

From storefront visitors (your customers) — session data

• Anonymous session ID (UUID generated in the visitor's browser, stored in localStorage)
• Cart token (Shopify-generated, used solely for order attribution)
• Page referrer URL and UTM parameters if present
• Browser user agent string
• Behavioural events: overlay shown, CTA clicked, checkout redirect, form submission

From storefront visitors — with explicit consent

The following data is only collected when a visitor actively submits the LiquidLift welcome form and checks the consent box:

• Email address (stored in plaintext for operational use — see section 3 — and as a SHA-256 hash for Meta Conversions API matching)
• First name (if entered voluntarily)

From the merchant's Shopify customer record (when visitor is logged in)

When a visitor is logged into their Shopify account on the merchant's store, LiquidLift may read the following data via the Shopify Customer API to enrich the session record and improve ad attribution accuracy:

• Lifetime purchase value, order count, average order value
• Customer tags and account creation date
• Phone number, city, country
• Marketing consent and email verification status
• Date of last order

This enrichment only occurs when the merchant has granted the read_customers scope during app installation. Enriched data is stored against the session record and used solely for the purposes described in section 3.

From attribution and orders

• Shopify order ID, total value, and currency
• Cart token (to link the order back to a LiquidLift session)
• Google Click ID (gclid) and Meta browser cookies (_fbp, _fbc) if present

We do not collect: payment card data, social security numbers, government IDs, or IP addresses.

• Attribution: matching attributed orders to LiquidLift sessions via cart token to calculate revenue impact for the merchant dashboard.
• Analytics: aggregating impressions, clicks, and conversions per campaign.
• Personalisation: displaying the visitor's first name in the overlay if they provided it.
• Billing: calculating merchant subscription fees based on the number of active campaigns.
• Meta Signal Sync: transmitting hashed signals (email, phone, name, city, country) to the merchant's own Meta pixel via the Conversions API. Data is sent to the merchant's own Meta Ads account only — not to LiquidLift's or any third party's account. All values are SHA-256 hashed before transmission.
• Klaviyo sync: if the merchant has connected Klaviyo, email addresses and enrichment properties captured with consent are synced to the merchant's own Klaviyo list. We do not access or retain Klaviyo data ourselves.
• Service improvement: debugging and improving the overlay experience.

We do not sell data to third parties. We do not use merchant or visitor data for our own advertising.

Merchants: processing is necessary to perform the contract (the LiquidLift subscription agreement).

Storefront visitors — session data: processing is based on the merchant's legitimate interest in understanding conversion performance. No PII is collected at this stage.

Storefront visitors — email and name: processing is based on the visitor's freely given, informed consent via the form checkbox. Visitors can decline without any effect on their shopping experience.

Shopify customer enrichment: processing is based on the merchant's legitimate interest in improving ad attribution accuracy, where the merchant holds a direct relationship with their customer under their own privacy terms.

• All data is stored in Supabase (PostgreSQL), hosted on AWS infrastructure in the EU (Ireland, eu-west-1 region).
• The Next.js application is hosted on Vercel (global edge network).
• Shopify access tokens are encrypted at rest using AES-256-GCM before being written to the database.
• Developer API keys are stored as SHA-256 hashes only — plaintext is never written to the database.
• All data in transit is encrypted via TLS 1.2+.
• Row-level security policies in Supabase restrict each merchant's data to their own account.
• Webhook payloads from Shopify are verified using HMAC-SHA256 signature validation before processing.

• Session and event data: retained for 24 months from creation, then deleted.
• Order attribution records: retained for the duration of the merchant's subscription plus 12 months.
• Merchant account data: retained until the merchant uninstalls the app. Following uninstallation, all data is deleted within 48 hours in accordance with Shopify's GDPR redaction requirements.
• Lifetime purchase records: retained for 7 years for financial audit purposes, after which personal identifiers are removed.

Merchants using LiquidLift are responsible for:

• Disclosing to their customers that LiquidLift is active on their storefront and may collect session and behavioural data.
• Including LiquidLift in their store's privacy policy as a data processor.
• Ensuring their use of LiquidLift (including Meta Signal Sync and Klaviyo integration) complies with applicable law (GDPR, CCPA, ePrivacy, etc.).
• Submitting data subject access and deletion requests to hello@liquidlift.app within 30 days of receiving them from their customers.

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request erasure of your data
• Object to or restrict certain processing
• Withdraw consent at any time (where processing is consent-based)
• Data portability
• Lodge a complaint with your local data protection authority (in the UK: the ICO; in the EU: your national DPA)

To exercise any of these rights, contact hello@liquidlift.app. We will respond within 30 days.

LiquidLift uses browser localStorage on the merchant's storefront to store:

• An anonymous session ID (UUID) — used to tie events across a single browsing session
• Campaign snooze timestamps — so the overlay doesn't show repeatedly to the same visitor

These values contain no personal information and are never transmitted to third parties. They persist until the visitor clears their browser data.

LiquidLift reads (but does not write) the Meta browser cookies _fbp and _fbc if present, solely to improve Meta Conversions API event matching for the merchant.

Data may be processed in countries outside the UK and EEA, including the United States, by our sub-processors (see section 7). Where this occurs, we rely on Standard Contractual Clauses (SCCs) or equivalent transfer mechanisms approved by the relevant data protection authority.

We may update this policy from time to time. Material changes will be communicated to merchants via email or an in-app notice at least 14 days before they take effect. Continued use of LiquidLift after the effective date constitutes acceptance of the updated policy.

LiquidLift
Email: hello@liquidlift.app
Website: liquidlift.app