Privacy policy

Last updated 27 October 2026

This policy explains what data Lightyear collects, why, where it is kept, who can see it, and how you delete it. We collect only what the app needs to work.

Draft, not in force

This text is a draft for the founder and a lawyer to check. Words in brackets, like [Company legal name], are still to be filled in.

1. Who we are

Lightyear is a Shopify app run by [Company legal name], registered under number [Company registration number], at [Registered address] (“we”, “us”). Contact: [Privacy contact email].

We decide how the data of our own customers is used: the people who sign in to Lightyear and the people who ask for access. For data about the shoppers on a store, the store owner decides, and we process it on their behalf and on their instructions. [Lawyer: confirm controller and processor roles, and whether a data processing agreement is offered to stores.]

2. Words we use

Store: a Shopify store that installs the Lightyear app.
Merchant: the owner of a Store, and the staff they invite to Lightyear.
Shopper: a person who visits a Store.
Connected account: a Meta, Google or Klaviyo account a Merchant links to Lightyear.
Site: this website and the Lightyear dashboard.

3. What we collect

From people who request access

Your email address and the store address you type. We keep no IP address, device data or cookie from this form.

From Merchants who sign in

Your name and email address, and an account ID from our sign-in provider.
The Stores you can open and your role on each.
What you approve, reject or stop in Lightyear, with the time.

From the Store, through Shopify

When a Store installs the app, Shopify lets Lightyear read the Store's products, prices, discounts, pages, theme, files and orders, and publish the page versions a Merchant approves. The app asks Shopify for these permissions: [list the final scopes, today: read_products, read_orders, read_discounts, read_themes, read_online_store_pages, read_reports, read_customer_events, write_pixels, write_app_proxy, and for publishing approved pages write_online_store_pages, write_products, write_files, write_publications].

From orders we keep the items, prices, discounts, totals, currency, the shipping city, region and country, and the Shopify customer ID. Before an order is stored we remove the buyer's name, email, phone number, street address, postcode, IP address, notes and payment details.

From Shoppers, on the Store

A small script on the Store, and Shopify's own Web Pixel, record how Shoppers use the Store's pages:

The pages they view, the page they came from, and campaign tags in the link, such as an ad ID.
How far they scroll, what they tap, and which parts of the page were on screen and for how long.
The visible text of pop-ups and drawers they open. Emails, phone numbers, card numbers and postcodes in that text are removed in the browser before it is sent.
Cart changes, checkout steps and the order, if they buy.
Page speed, images loaded and page errors.
Their browser and device type, screen size, and the country, region and city their request came from. We do not store the IP address, postcode or exact location.

We never record what a Shopper types into a form field, their keystrokes or copied text.

From Connected accounts

Meta: ad performance data. See section 6.
Google: Google Ads and Google Analytics data. See section 5.
Klaviyo: campaigns, flows, list and segment sizes, email and SMS message content, templates, forms, images, catalog items, coupon names, tags and performance reports. We never read Klaviyo profiles, subscriber lists, events, coupon codes or anything that names a person.

4. Why we use it, and for how long

Purpose	Data	Legal basis	How long we keep it
Answer a request for access	Email, store address	Legitimate interest	[12 months after the request, or until you ask us to delete it]
Run your Lightyear account	Name, email, account ID, Stores and roles	Contract	While the account is open, then [period]
Show how pages and ads perform, and why	Store data, Shopper data, Connected account data	Contract with the Merchant. For Shopper data, the Merchant's basis	While the Store has the app installed. Deleted when Shopify asks, 48 hours after uninstall
Build page versions and run the split tests a Merchant approves	Store pages and products, Shopper data, test results	Contract with the Merchant	As above
Keep the service secure and fix faults	Account data, error logs	Legitimate interest	[log retention period]
Meet legal duties	Account and billing records	Legal obligation	As long as the law requires

Klaviyo data is deleted when a Merchant disconnects Klaviyo. Meta and Google data is deleted when a Merchant disconnects that account. We do not sell data. We do not use any of it to serve ads, to build profiles of Shoppers across Stores, or to make decisions with legal effects on a person.

5. Google user data

A Merchant can connect Google accounts with Google sign-in. Lightyear then asks for these permissions, and only these:

Google Ads (https://www.googleapis.com/auth/adwords): to read the ad accounts you choose, their campaigns, ad groups, ads and landing pages, and their daily results: impressions, clicks, cost, conversions and conversion value.
Google Analytics (https://www.googleapis.com/auth/analytics.readonly): to read reports of the properties you choose, such as sessions, traffic sources and conversions by landing page.

[Before submission: list exactly the scopes the app calls. Remove any scope that is not in use.]

How we access, use, store and share it

Access: only after you grant it on Google's consent screen, and only for the accounts you choose. Lightyear never creates, edits, pauses or deletes anything in your Google Ads or Google Analytics accounts.
Use: only to show you, inside Lightyear, how your ads and pages perform, to explain the results, and to pick and judge the page tests you approve.
Store: in our database in the United States, sent only over HTTPS. Access tokens are encrypted with a key held apart from the database.
Share: only with the service providers in section 7 that host and run Lightyear for us, and only to provide the features you see. We do not sell it, and we do not transfer it to advertising platforms, data brokers or information resellers.
We do not use it to serve ads, including retargeting, personalized or interest-based ads, or to decide credit-worthiness or lending.
We do not use it to develop, improve or train generalized artificial intelligence or machine learning models.
No person at Lightyear reads it unless you ask us to, it is needed for security or to comply with the law, or it is aggregated for internal operations.

Lightyear's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can remove Lightyear's access at any time on your Google Account permissions page, or by disconnecting Google in Lightyear. We then delete the Google data we read, as section 11 says.

6. Meta ad data

A Merchant can connect Meta ad accounts with Facebook Login. Lightyear asks for the ads_read permission only. It reads the ad accounts you choose, their campaigns, ad sets, ads, creative text and images, and their results: impressions, reach, clicks, spend and conversions. We keep your app-scoped Facebook user ID and an access token, encrypted.

We use this data only to show you how your ads and the pages they send people to perform, and to pick and judge the page tests you approve. Lightyear never creates, edits or pauses ads, and never changes a budget. We do not sell it or share it with anyone but the service providers in section 7.

You can remove Lightyear at any time in your Facebook settings, under Apps and Websites, and ask there for your data to be deleted. Or follow the steps on our data deletion page.

We share data only with these service providers, only so they can run Lightyear for us, under contracts that limit their use of it:

Vercel (United States): hosting of the website, the dashboard and the data collection service, and routing of AI model requests.
Neon (United States): our database.
WorkOS (United States): sign-in for Merchants.
Anthropic (United States): AI models that read Store pages and results to explain them and to draft page versions.
TypeSafe and Google, through Vercel's AI Gateway: AI models that label what each part of a Store page says, and describe public ad videos.

[Lawyer: confirm each provider's data processing terms, including that AI providers do not train on our inputs, and keep this list in step with the app.]

We may also share data with professional advisers under a duty of confidence, with authorities when the law requires it, and with a buyer of our business, after telling you first.

Transfers outside your country

Our providers store and process data in the United States. Where the law requires it, we rely on safeguards such as the European Commission's standard contractual clauses. [Lawyer: confirm the transfer mechanism, for example the EU-US Data Privacy Framework or SCCs.]

8. Cookies and browser storage

This website sets no cookies, runs no analytics and loads no ad trackers.
The Lightyear dashboard sets a sign-in cookie and a cookie that remembers the Store you last opened. Both are needed for the dashboard to work. It also remembers light or dark mode in your browser.
On a Store, the Lightyear script keeps a random Shopper ID in the browser's local storage, and which version of a page a Shopper saw, so they see the same version again. The Shopper ID is written only when the Shopper allows analytics through the Store's cookie banner, using Shopify's Customer Privacy API. It holds no name or contact detail.

9. How we protect it

Every page and data route is closed by default. Only the routes that must be open are, and each checks a signature or token.
Each Store's data is kept apart in the database, so one Store can never read another's.
Access tokens for Shopify, Meta, Google and Klaviyo are encrypted with AES-256-GCM.
Data is encrypted in transit with HTTPS.

No system is perfectly secure. If a breach puts your data at risk, we will tell you and the authorities as the law requires.

10. Your rights

Depending on where you live, you have the right to:

Access: know whether we process your data, and get a copy.
Correct: fix data that is wrong or incomplete.
Delete: have your data erased.
Restrict: pause our use of some data.
Object: stop a use based on our legitimate interest.
Port: get your data in a format you can move to another service.
Withdraw consent: at any time, where we rely on it.

Write to [Privacy contact email]. We answer within 30 days. We may ask you to prove who you are. If you are a Shopper, you can also ask the Store, which can ask us through Shopify. You can complain to [Data protection authority].

11. Deleting your data

Uninstall the app: 48 hours later Shopify asks us to delete the Store's data, and we delete every row of that Store.
Disconnect an account in Lightyear: we delete its access token and the data we read from it.
A Shopper's data: when a Store asks through Shopify, we delete that customer's orders and the visits linked to them.
Anything else, such as an access request or your sign-in account: email [Privacy contact email].

The steps are also on our data deletion page.

12. Children

Lightyear is a business tool for Store owners. It is not meant for anyone under 18, and we do not knowingly collect data from children.

13. Changes to this policy

We will post any change here with a new date. If a change affects how we use Google or Meta data, or your rights, we will tell signed-in Merchants first, and ask for consent where the law or the platform requires it.

14. Contact us

[Company legal name]
[Registered address]
[Privacy contact email]