Privacy Policy

Quinn AI Product Quiz — last updated 2026-10-10

1. Introduction

Quinn AI Product Quiz (“the App,” “we,” “us,” or “our”) is a Shopify app that lets merchants build product-recommendation quizzes shown on their storefront. Shoppers answer a short series of questions and receive personalized product recommendations drawn from the merchant’s catalog.

This Privacy Policy explains what information the App accesses from your Shopify store, what we store in our database, how we use it, who we share it with, how long we keep it, and what rights you have over it. Please read it carefully. By installing the App you agree to the practices described here.

This policy covers merchants (Shopify store owners and their staff) who install or use the App. It also describes how we handle data generated by shoppers who take quizzes on merchant storefronts — quiz sessions use a random identifier. An attributed checkout links that session to an order (Section 3.9); optional lead capture may also link it to contact details submitted by the shopper (Sections 3.3 and 3.5). It does not cover the practices of Shopify, Inc. itself — see Shopify’s Privacy Policy for that.

2. What the App Does and Why It Reads Store Data

To power product recommendations, the App reads product catalog data from your Shopify store via the Admin API. The App is designed with strict data minimization in mind: it reads catalog information to match answers to products, published storefront languages to offer relevant wording options, and limited order records to measure revenue from quiz shoppers and compare average order values. Order access requires Shopify protected customer data approval; it excludes customer names, email addresses, phone numbers and physical addresses.

Specifically, the App is granted the following Admin API access scopes:

read_products — used to fetch product titles, descriptions, tags, variants, images, and collection membership in order to build quiz recommendation logic and display product cards to shoppers.
write_app_proxy — used to serve the storefront quiz widget via Shopify’s App Proxy. The proxy routes shopper quiz requests through Shopify to our server; Shopify signs each request and we verify the signature before processing.
read_orders — reads order identifiers, timestamps, currency and totals, cancellation/test status, product and variant identifiers, and the quiz cart attribute for revenue attribution (Section 3.9).
read_locales — reads published storefront language codes and names for the per-language wording editor.

The App does not request and does not read: customer personal data (names, email addresses, phone numbers, physical addresses) from Shopify orders or customer records, draft orders, financial reports, staff account details, payout information, theme source code, metafields (beyond standard product fields), or any other store data outside the scopes listed above.

3. What We Store

3.1 Store identifier and Shopify session tokens

We store your store’s .myshopify.com domain as the primary key that associates all your data with your store. We also store Shopify OAuth session tokens for the duration of your installation, used solely to authenticate Admin API requests from your store to our server. Session tokens are purged on uninstall.

3.2 Quiz definitions (merchant content)

The App stores the quizzes you create: quiz titles, question text, answer option text, the mapping of answers to product tags or collection IDs, and your quiz configuration settings (e.g. result display options). This content belongs to you and is used solely to serve the quiz on your storefront and display it in the App’s admin interface.

3.3 Anonymous shopper quiz responses

When a shopper takes a quiz on your storefront, the App records their responses, the questions reached and answered or skipped, products recommended, and recorded cart additions. The App saves question and answer text as authored when collected so merchants can review earlier responses. These responses are keyed by a randomly generated session identifier (a UUID created at quiz-start time). Except for the optional lead-capture contact details described in Section 3.5, we do not collect, request, or store:

The shopper’s name, email address, or phone number outside the optional lead form. Contact details are collected only when the merchant enables those fields and the shopper submits them — see Section 3.5.
The shopper’s IP address (it is not persisted; it may appear transiently in server access logs which are rotated and not stored in our database).
The shopper’s Shopify customer ID or account information.
Payment card details or payment credentials.

The session identifier is generated fresh for each quiz session and is not linked to a Shopify customer account, browser cookie, or any persistent device identifier. It is used solely to associate the answers within a single quiz-taking session with the recommendations served at the end of that session, and to power the per-session analytics described in Section 3.4 below. When a quiz product is added to a cart, the identifier may also link this session to the resulting order for revenue attribution (Section 3.9). These linked records are protected customer data, even though we store no customer account ID.

3.3.1 Remembering and sharing results

When remembering results is enabled, the shopper’s browser uses local storage to save the last completed quiz’s answer and skipped-question identifiers and any selected public product and variant identifiers, and uses them to restore results for up to 30 days. Expired entries are removed when the quiz next tries to restore them. This saved state stays in that browser and does not include an email address or session identifier. Shoppers can select “Start over” or clear their browser’s site data to remove it. Merchants can disable remembering in the quiz block or popup settings.

Shoppers may choose to share a results link. The shared link contains answer and skipped-question identifiers and may include public product and variant identifiers; the shared link does not contain contact details or a session identifier. Anyone with the link can open it and see recommendations based on those answers. Preferences may be inferred from the recommendations, so shoppers should share a link only with people they want to have those results.

Opening remembered or shared results sends those saved identifiers to the App to recompute recommendations using the merchant’s current quiz mappings and the same cached catalog data as a new quiz run. Catalog data is cached for 60 seconds or 10 minutes, depending on the recommendation path. Under high request volume, budget safeguards may reuse older cached data. Saved variant choices are revalidated against the current recommendations, stock, budget and merchant exclusions. An ineligible choice is replaced by the normal selection. This uses the same recommendation processing described in Section 4, including the decision model when enabled by the merchant. Viewing these results does not create a new quiz completion or shopper response record and does not ask for or capture another lead email. If the shopper starts over and completes the quiz again, that is a new quiz response.

3.4 Aggregate event counts and analytics

The App records aggregate event counts to give merchants honest analytics about how their quizzes are performing. These events are:

Quiz view — a shopper loaded the quiz widget.
Quiz completion — a shopper reached the results screen.
Recommendation shown — a specific product was shown to a shopper as a recommendation (recorded as a count per product ID, not per individual shopper).
Add to cart — a shopper clicked “Add to cart” on a recommended product from within the quiz results (recorded as a count per product ID).

All event counts are aggregated at the quiz and product level. They do not include individual shopper identities, device fingerprints, or any information that could be used to track a specific individual across sessions.

3.5 Shopper contact details and consent (optional lead capture)

Merchants on every plan can enable lead capture per quiz. When enabled, the quiz asks the shopper for their email address right before showing their results (the merchant chooses whether the step can be skipped). If the shopper submits an email address, we store: the email address, any first name or phone number requested by the merchant and submitted by the shopper, the quiz that captured them, the random quiz session identifier, and a timestamp. A merchant may also show an optional, initially unticked email-marketing consent checkbox. When submitted, we record the yes or no choice, the server timestamp, the exact sentence shown and its language. An absent checkbox or choice remains unknown. Phone collection does not record permission for SMS marketing, and we do not write consent to Shopify customer records or subscribe shoppers to a mailing list. This is personal data, and we treat it accordingly:

It is collected directly from the shopper, voluntarily — never read from Shopify customer records. Order attribution does not request Shopify customer contact fields.
It is visible only to the merchant whose store captured it (on the App’s Leads page, with CSV export) and is used by us solely to provide that page and, if the merchant adds a webhook, to send it to the address the merchant chose (Section 3.6), or to their connected Klaviyo account (Section 3.8). We never use it for advertising, profiling, AI/ML training, or resale, and we never contact shoppers ourselves.
It is deleted when: the merchant’s customer requests deletion (Shopify’s customers/redact webhook — we delete all lead rows matching that customer’s email for that store), the store is redacted (shop/redact), the retention purge described in Section 5 runs after uninstall, or the merchant deletes the quiz that captured it.
The merchant is the data controller for captured leads; we process them on the merchant’s behalf. Merchants are responsible for using captured contact details and consent records in accordance with their own privacy policy and applicable marketing-consent laws.

3.6 Webhooks you configure (optional)

On the App’s Integrations page a merchant can add one https:// web address of their own choosing, such as an automation service or their own server. When they do, each time a shopper finishes one of their quizzes we send that address the quiz’s name, the questions and the answers that shopper chose, the random quiz session identifier, and the products we recommended. When a shopper submits an email through lead capture (Section 3.5), we also send that email address, any submitted first name and phone number, and the recorded email-consent choice and sentence with the same answers and products. If these details are known when a quiz completes, the completion event also includes them. A later lead event supplies details collected after completion.

Nothing is sent unless the merchant adds an address, and sending stops as soon as they remove it. We store the address, a signing secret the merchant uses to check that requests came from us, and the outcome of the most recent delivery (a status code or an error type, never the content sent or received).
The receiving service is chosen by the merchant and is not our sub-processor. Data delivered there is handled under the merchant’s agreement with that service; deleting data in the App (Sections 5 and 7) cannot reach copies already delivered, so the merchant is responsible for honoring deletion requests there too.
We do not send to private or internal network addresses, and we keep no copy of what we send beyond the records described in Sections 3.3 and 3.5.

3.7 Merchant customer-event pixels

The storefront widget publishes quiz interactions through Shopify Customer Events: quiz starts, answered questions, completions, product clicks, successful cart adds and acknowledged lead captures. These payloads contain the quiz name, selected answer labels and recommended product details, including public product and chosen variant identifiers. Our custom event data contains no email, shopper or session identifier, or typed lead input. Shopify supplies its own event context and identifiers. Restoring shared or remembered results does not publish a new completion.

Merchants may connect a custom pixel to forward these events to Google Analytics or Meta. Shopify applies the store’s configured consent requirements to each pixel. The receiving services may collect their own identifiers under the merchant’s pixel configuration and privacy policy. The App does not store the merchant’s analytics or pixel IDs.

3.8 Klaviyo you connect (optional, every plan)

When a merchant connects Klaviyo, we send a completed quiz to their Klaviyo account only if that shopper provided an email through lead capture. Captured first name and phone are also sent when provided. The profile receives quiz-specific properties, including the recorded email-consent choice and timestamp, and a “Completed Quinn quiz” event carries the quiz title, authored answers, recommended products (titles, catalog IDs, links, images and prices when available), match type and completion date. We do not subscribe shoppers to a list, and we do not change Klaviyo marketing subscriptions. The phone is a quiz property, not an SMS identity. Merchants must configure their Klaviyo flows to require existing email marketing consent.

The private API key is encrypted at rest. We keep delivery outcomes and a per-completion deduplication record, without an additional copy of the email or payload. Disconnecting or uninstalling deletes the connection credential and stops new sends; an already submitted request may finish. Shop and customer redaction remove associated local data. Copies already delivered to Klaviyo are handled under the merchant’s agreement with Klaviyo; the merchant is responsible for honoring deletion requests there too.

3.9 Order attribution and average order value

When a shopper adds a quiz recommendation to their cart, we write a private cart attribute containing the quiz handle and its random session identifier when Shopify permits analytics and marketing processing. If permission is denied or unavailable, we clear our cart attribute while keeping ordinary cart additions available. Shopify carries this attribute onto the order. An order is attributed to the last quiz added to its cart only when a saved completed quiz session exists and a purchased product matches its saved recommendations.

We process only the order ID, creation and update dates, currency, current order total, cancellation and test status, purchased product and variant IDs, and that quiz attribute. We retain order totals for the store comparison and the quiz/session link and matched product IDs for attributed orders. We do not retain raw webhook payloads, other cart attributes, customer IDs, names, email addresses, phone numbers, addresses, payment credentials or line-item titles from orders. These records are used solely for revenue, order counts and average order value in the merchant dashboard and Analytics, on every plan.

Tracking begins when access is granted; earlier orders are not imported. Revenue uses the whole order total including tax and shipping, adjusted for refunds; cancelled orders and test orders are excluded from normal reports. Currency groups are reported separately. Order records older than 90 days are excluded and removed on subsequent order processing or when a merchant opens Dashboard or Analytics. Customer deletion removes the requested order records and linked attribution sessions; shop deletion removes all order records. These records are not sent to AI providers or to the merchant’s quiz integrations.

4. How We Use the Data

We use the data described above solely to:

Serve the quiz widget to shoppers on your storefront and compute personalized product recommendations based on their answers.
Display quiz management, configuration, and performance analytics to you (the merchant) within the App’s Shopify Admin interface.
Respond to Shopify’s mandatory GDPR compliance webhooks (see Section 7).
Diagnose errors in our application. Error monitoring captures stack traces and request context; it does not include shopper quiz responses or merchant catalog content beyond what appears in a stack trace.

We do not use your store data or shopper quiz data for advertising, for training any AI or machine-learning model, for any form of individual profiling, or for sale or transfer to third parties. The one exception to transfer is a webhook address you add yourself (Section 3.6): we send quiz results there because you asked us to.

Quiz recommendations are matched by Jev, a decision model from TypeSafe AI, Inc. When a shopper finishes a quiz, we send TypeSafe the quiz’s title, its questions and the answers that shopper chose, together with text about the products they can buy in your store: titles, product types, vendors, tags, collection names and a short excerpt of each description, product option names and values, and variant titles and options. Jev returns how well each product and selected variant fits those answers. Our servers apply budget answers and stock availability themselves, then choose what to show. We never send TypeSafe the shopper’s name, email address, IP address, Shopify customer ID or session identifier, so the answers it receives are not linked to any person. If Jev is unavailable, our servers choose recommendations with deterministic rules built from your quiz’s answer settings.

Quiz generation is different, and we want to be explicit about it. When you ask the App to draft a quiz or suggest an idea, we send a sample of your product catalog — titles, product types, vendors, tags and descriptions for up to 50 active products — together with any description you type, to OpenRouter, which passes the request to the model provider you select in the App. This happens only when you ask for it, never in the background. We do not send shopper quiz responses, shopper email addresses, or any customer personal data to OpenRouter or to any model provider it routes to.

5. Data Retention

Your store’s data — quiz definitions, shopper responses, aggregate event counts, and session tokens — is retained for as long as the App is installed on your store. Order attribution records follow the shorter 90-day period described in Section 3.9.

When you uninstall the App, we receive a Shopify app/uninstalled webhook. We mark your store as inactive and stop processing new requests. Your data is then permanently deleted at whichever of these comes first: (a) receipt of Shopify’s shop/redact GDPR webhook, which Shopify typically sends about 48 hours after uninstall — all data for your store is deleted immediately upon receipt; or (b) an automated retention purge that permanently deletes all data belonging to stores uninstalled more than 30 days ago.

If you reinstall the App before deletion has occurred, your quiz definitions and analytics history are preserved. Because Shopify usually sends shop/redact about 48 hours after uninstall, in practice data from an uninstalled store is deleted within a few days, and never later than 31 days after uninstall (the 30-day retention window plus, at most, the purge job’s six-hour sweep interval).

Anonymous shopper session records (answer sets keyed by a random UUID) are deleted together with all other store data on uninstall or shop/redact. Shopper emails captured by the optional lead-capture feature (Section 3.5) follow the same store-level deletion schedule, and are additionally deleted per-customer upon a customers/redact request at any time.

6. Sub-Processors and Hosting

We rely on the following third-party sub-processors to operate the App:

Shopify, Inc. — Platform operator and provider of the Admin API through which we read your catalog, and the App Proxy through which shopper quiz requests are routed. Shopify processes data under its own DPA and privacy policy. See Shopify Privacy Policy.
Railway, Inc. — Cloud hosting provider for our application server and PostgreSQL database. Your store’s quiz data and shopper response data reside in a PostgreSQL database on Railway infrastructure. Railway’s data centers are located in the United States. See Railway Privacy Policy.
OpenRouter, Inc. — AI gateway, used only when you ask the App to draft a quiz or suggest an idea. It receives the catalog sample and the description you type, and routes them to the model provider you pick in the App. It does not receive shopper quiz responses, shopper email addresses, or customer personal data. See OpenRouter Privacy Policy.
TypeSafe AI, Inc. — the Jev decision model that matches products to a shopper’s quiz answers. It receives the quiz’s questions, the chosen answers and product text, as described in section 4, and no shopper identity, email address or customer personal data. TypeSafe states that it does not train models on this data. See TypeSafe Privacy Policy.

We do not use any other sub-processors. Merchant-configured pixels may receive the customer events described in Section 3.7, and a Klaviyo account a merchant connects receives the data described in Section 3.8. We do not sell your store or shopper quiz data to data brokers. AI processing is limited to what section 4 describes: quiz generation through OpenRouter, which receives catalog content only when you ask for it, and product matching through TypeSafe, which receives quiz answers with no shopper identity attached, plus product text. Neither receives shopper email addresses or customer personal data. A webhook address a merchant adds (Section 3.6) is not one of our sub-processors: it is a destination the merchant chooses, and it receives only what Section 3.6 describes. Klaviyo is also a destination the merchant connects, and receives only what Section 3.8 describes.

7. GDPR, CCPA, and Mandatory Compliance Webhooks

7.1 GDPR compliance webhooks

Shopify requires all apps to honor three mandatory compliance webhooks. We implement all three:

customers/data_request — A merchant’s customer may request a copy of their personal data held by apps installed on that store. Quinn AI Product Quiz can hold lead contact details and consent records, linked quiz responses and activity (Section 3.5), and minimal order attribution records (Section 3.9). On receipt we identify matching lead records for that store. The merchant can use “Export customer data” on the App’s Leads page to export the email and its linked quiz records on every plan to fulfill the request. Sessions without a captured email can be linked through an attributed order ID. Order records requested by Shopify are identified by the supplied order IDs. The merchant can use “Fulfill a customer data request” in Analytics to export order records and linked quiz activity on every plan.
customers/redact — A merchant’s customer may request deletion of their personal data held by apps. Our handler permanently deletes every lead-capture record matching the customer’s email address for that store, together with quiz responses, saved answers and events for those linked sessions, immediately upon receipt. It also deletes records for the order IDs Shopify supplies in orders_to_redact, even when no email was captured, together with their linked attribution sessions. Copies the merchant’s own webhook already received (Section 3.6) are outside the App and must be deleted by the merchant.
shop/redact — Sent by Shopify after a store uninstalls and requests data deletion. Upon receipt, we permanently and immediately delete all data associated with the .myshopify.com domain identified in the webhook payload: the store record, all quiz definitions, all shopper response records, all captured lead contact details and consent records, all aggregate event counts, and all session tokens.

7.2 Your rights as a merchant (GDPR / CCPA)

If you are located in the European Economic Area, the United Kingdom, or California, you may have additional rights regarding your data, including:

Right of access — You may request a copy of the data we hold about your store (quiz definitions, aggregate event counts).
Right to erasure — You may request deletion of your store’s data. The most direct way is to uninstall the App (Shopify will subsequently send us the shop/redact webhook, which triggers immediate deletion). You may also contact us directly.
Right to rectification — If any quiz definition data we hold is inaccurate, you may update it directly within the App or contact us.
Right to portability — You may request a machine-readable export of your quiz definitions and aggregate analytics data.
Right to object — You may object to our processing of your data. The primary mechanism is uninstalling the App, which terminates processing.

To exercise any of these rights, contact us at info+support@legitimateapps.com. We will respond within 30 days.

8. International Data Transfers

Our application servers and database are hosted on Railway’s infrastructure, which is located in the United States. If you are based outside the United States, your store’s quiz data, shopper response data, and any captured lead contact details and consent records are transferred to and processed in the United States when you use the App. We rely on Shopify’s standard data-processing agreements and Railway’s data-processing terms to provide appropriate safeguards for such transfers where applicable under GDPR.

9. Security

We implement the following security measures to protect the data we store:

All communication between your Shopify store, shoppers’ browsers (via Shopify’s App Proxy), and our servers takes place over HTTPS/TLS.
All webhook payloads from Shopify are verified using HMAC-SHA256 before processing.
App Proxy requests from shoppers are verified using Shopify’s signed-proxy signature before any shopper data is processed.
App Bridge session tokens are verified cryptographically on every authenticated Admin request.
Access to our production database is restricted to our application server; it is not publicly accessible.
We do not log the content of webhook payloads that contain merchant or customer information beyond the store domain identifier.

No method of electronic storage or transmission is 100% secure. While we strive to protect your information using commercially reasonable means, we cannot guarantee absolute security.

10. Children’s Privacy

The App’s merchant-facing interface is a business-to-business service intended for Shopify merchants (businesses and business operators). The storefront quiz widget may be viewed by shoppers of any age depending on the nature of the merchant’s store. Quiz answers use random session identifiers, which can be linked to attributed orders as described in Section 3.9. If a merchant enables lead capture, the email step accepts whatever address the shopper voluntarily submits; we do not knowingly collect emails from children, and merchants are responsible for ensuring their storefront, quiz content, and lead-capture usage are appropriate for their audience and jurisdiction.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the “last updated” date at the top of this page. For material changes, we will notify merchants via the App’s in-app interface or by email to the store contact address. Continued use of the App after a policy change constitutes acceptance of the updated policy.

12. Contact Us

For any questions about this Privacy Policy, to exercise your data rights, or to report a privacy concern, please contact us at:

info+support@legitimateapps.com

We aim to respond to all privacy-related inquiries within 30 calendar days.