Privacy Policy

01Who we are

Shopsicle is operated by Magou Investments LLC, 2222 W. Grand River Ave, Ste A, Okemos, MI 48864, United States (“Shopsicle”, “we”, “us”). This policy explains what personal data we handle, why, and the choices you have.

It covers this website (our marketing site, early-access list and design-partner requests) and the Shopsicle app for Shopify stores. Access to the app is currently limited while we prepare for public availability.

02What we collect on this website

Your email address, if you join early access. We use it to contact you about early access and Shopsicle. Early-access signups do not enable advertising measurement.

Your store website address, if you enter it to identify your store. We use it to identify your Shopify store and open Shopsicle’s Shopify listing, where Shopify handles store selection and installation. For custom domains, our Studio service resolves the Shopify address first. If you request early access elsewhere, we keep the address with that request. We do not put the raw address in generic event properties. A hashed canonical store identity may match merchant acquisition conversions as described below. Entering a URL does not grant access to your store or its private shopper data.

Design-partner requests. If you apply, we save your email, store address, the requested offer, and when you agreed to feedback and contact. We use them to review your request, confirm the offer and setup, and arrange product feedback check-ins. You can withdraw your contact agreement by writing to us. Applying does not install the app or start a subscription. Store addresses and feedback agreement receipts stay out of advertising and analytics events.

How the site is used. Our own measurement records the pages you view, the links and buttons you click, how far you scroll, time on the page, when a form is started or sent (never what you type in it), errors, page speed, and what brought you here: the referring site, campaign tags (UTM) and ad click IDs in the link. Our first-party measurement keeps a random visit ID in the page’s memory only, and a new visit starts fresh. Advertising cookies and attribution are described separately below. These events go to our own server, which passes them on as described on this page. We do not keep these default measurement events in our own database; optional recordings are described below.

Basic technical logs that any web server keeps (IP address, browser type, the page requested, time). Our hosting provider uses them to run the site and protect it from abuse.

Optional visit analytics and masked recordings. If you allow analytics, we save page visits, clicks, scroll and section timing, campaign source parameters, and a masked reconstruction of your visit to this website or the merchant workspace. Form inputs are hidden. Merchant workspace text and shopper recording regions are also hidden. These records are kept for 30 days in our private database and reviewed by authorized staff to improve Shopsicle.

A signed first-party cookie keeps an allowed visit together for up to four hours on each site. Your choice is saved in your browser. You can change it using the Privacy button. Capture stops if you decline, and Global Privacy Control disables it. Existing recordings expire after 30 days. Recordings are not shared with advertising platforms. Separate advertising measurement is described below. Our fonts are served from our own site.

03Advertising measurement and your choices

We advertise on Facebook. Where advertising measurement is permitted and configured, Meta Pixel in your browser and Meta Conversions API on our server receive page views, landing content views and store-link submissions. Both use the same event identifier so Meta can deduplicate them. Verified installation, an accepted trial and the first actual paid subscription charge are sent from our server. A trial ending or an active plan alone is not proof of payment.

Only visitors reliably located in the United States, Canada, Australia or New Zealand are eligible. We block advertising measurement for the EEA, UK, Switzerland, other or unknown locations, Global Privacy Control and opt-outs. We look up the request IP locally using a licensed country database. Your IP is not sent to a geolocation service. IP location is approximate. IP Geolocation by DB-IP, Country Lite October 2026, licensed under CC BY 4.0.

Meta receives the event name, time, Shopsicle page address, event identifier, available browser IP and user agent, country, actual Meta click/browser cookies (_fbc and _fbp) and campaign tags. After installation, available Shopify owner email and canonical store identity are normalized and SHA-256 hashed before sending. Hashes remain personal data, not anonymous data. Subscription events may include the actual plan or charge amount and currency. We never send payment card details or shopper recordings to Meta.

We match a resolved store to its acquisition visit for up to 30 days. Raw input, store matching domains, click/browser identifiers, IP, user agent and matching email are removed after at most 90 days, sooner after opt-out or deletion. Private store-linked conversion and deduplication records are retained for at most 13 months; non-identifying campaign/angle/day aggregates also expire at 13 months. Meta handles received data under Meta's Privacy Policy.

Your privacy choices. Use Do Not Sell or Share My Personal Information to opt out in one step without signing in. A first-party preference cookie remembers this browser for one year; an opaque, HttpOnly acquisition cookie lasts up to 90 days and connects this browser's choice to its saved attribution. Advertising cookies are cleared and known pending conversion matching is suppressed. GPC also opts you out. A browser choice cannot identify every device: contact hi@shopsicle.co for cross-device requests or deletion of store-linked acquisition data.

These acquisition records concern merchants considering Shopsicle. They are separate from shopper data processed for merchant stores, which is never used for our advertising. Development stores and private previews are excluded from production advertising optimization; explicit test events use Meta's testing tools only.

04When Shopsicle runs in your store

When a store installs Shopsicle, the merchant is the controller of their shoppers’ data and Shopsicle acts as their processor (a “service provider” under US state laws). We process that data only to provide Shopsicle to that store, following the merchant’s instructions and the store’s consent settings.

To find what helps or blocks shoppers, Shopsicle processes the following data where authorized and available:

• How shoppers use the store: pages viewed, clicks, scrolls, cart and checkout steps, time on page.
• Session recordings of those visits, with text typed into fields masked before it leaves the browser.
• Technical details: device type, browser, screen size, referring site or campaign tags, whether the visit came from an ad click (never the click ID itself), approximate location (country or region).
• Store data from Shopify, such as products, pages and orders, to connect behavior with outcomes.
• Visit summaries and daily counts with no shopper identity, recordings or page text (for example, how many visits reached the cart), so a store can be compared with its own normal over time.

No consent, no recording. Shopsicle follows the store’s consent settings through Shopify’s customer privacy tools. We don’t collect payment card details, we don’t sell personal data, we don’t build profiles of shoppers across different stores, and we don’t use store data for advertising.

Shoppers who want to access or delete their data should contact the store they shopped at. We support Shopify’s privacy requests (customer data requests, customer deletion and shop deletion) and help merchants respond to them.

05How we use data, and why we’re allowed to

• To run early access and email you about it: based on your consent. You can withdraw it any time by replying to any email or writing to us.
• To review design-partner requests and arrange feedback check-ins: based on your agreement to be contacted. You can withdraw it by writing to us.
• To run, secure and improve the website and app: based on our legitimate interest in a working, safe service.
• To measure and improve our advertising: based on our legitimate interest in knowing which ads work. We don’t do this for visitors from the EEA, the UK or Switzerland. You can object any time, including with Global Privacy Control (see Advertising on Meta).
• To provide Shopsicle to a store: under our agreement with the merchant, on their instructions.
• To meet legal obligations, such as keeping records or answering lawful requests.

We don’t make decisions about you that have legal or similarly significant effects based only on automated processing.

06Who we share it with

We use providers to run Shopsicle, including Railway for hosting, Supabase for database services, and OpenAI for AI analysis. They may only use the data to provide their service to us, under written contracts with confidentiality and security obligations. The current list is available on request at hi@shopsicle.co.

Meta (Facebook) receives the advertising records described in Advertising on Meta. Some US state laws call this “sharing” or “targeted advertising”. Global Privacy Control opts you out.

We may also share data if the law requires it, to protect our rights or users’ safety, or as part of a merger or acquisition (with notice to you). We never sell personal data.

07International transfers

Our providers may process data outside your country, including outside the European Economic Area and the UK. When they do, we use recognized safeguards such as the European Commission’s Standard Contractual Clauses, or rely on countries recognized as providing adequate protection.

08How long we keep it

• Early-access emails: until you ask us to remove you, or early access ends and you don’t become a customer.
• Design-partner request details and contact agreement receipts: until you ask us to remove you, or the partner program ends and you don’t become a customer. App data follows the separate retention terms below.
• Server logs: for a short period needed for security, usually no longer than 30 days.
• Optional masked recordings and first-party visit analytics: 30 days. You can stop new capture with the Privacy button.
• Default advertising measurement events: we pass them on and do not store them ourselves, beyond the server logs above. Acquisition handoffs and hashed matching keys expire after 90 days. Detailed conversion evidence and aggregate campaign counts expire after 13 months. A minimal store/event-only deduplication marker remains while the store exists. Meta keeps received advertising records under its own policy.
• Visit summaries and daily counts with no shopper identity: up to 13 months, deleted when a store uninstalls Shopsicle or when Shopify sends a shop deletion request.
• Store data in the app: for the period set by the store’s plan, and never more than 12 months, and deleted when a store uninstalls Shopsicle, once Shopify sends the shop deletion request.

09Your rights

Depending on where you live (for example under the GDPR, the UK GDPR, US state privacy laws or Israel’s Protection of Privacy Law), you can ask to access, correct, delete or receive a copy of your personal data, object to or restrict some processing, and withdraw consent. We won’t treat you differently for using these rights.

Write to hi@shopsicle.co. We may need to confirm it’s you. We answer within the time the law sets, usually within 30 days. You can also complain to your local data protection authority, for example the Privacy Protection Authority in Israel or your EU/UK supervisory authority.

10Security

We protect data with measures that fit the risk, including encryption in transit, access limited to people who need it, and providers with strong security practices. No system is perfectly secure; if a breach affects you, we will tell you and the authorities as the law requires.

11Children

This website and the Shopsicle app are for businesses. They are not meant for children, and we don’t knowingly collect children’s data.

12Changes to this policy

We will update this page when our practices change and change the date at the top. If a change is significant, we will tell you by email or in the app before it takes effect.

13Contact

Questions or requests: hi@shopsicle.co, or Magou Investments LLC, 2222 W. Grand River Ave, Ste A, Okemos, MI 48864, United States.