Ariven App Privacy Policy

Effective Date: March 27, 2026
Last Updated: April 1, 2026

Ariven, Inc. ("Ariven," "we," "us," or "our") operates the Ariven: Onsite Personalization application (the "App"), a Shopify application that enables merchants to deliver personalized storefront experiences to their customers. This Privacy Policy explains how we collect, use, store, and protect information when you use our App or when your customers interact with storefronts powered by our App.

Contact Information:
Ariven, Inc.
1030 Jessica Dr, Wauconda, IL 60084
Chris Weiland — chris@ariven.ai

1. Scope of This Policy

This Privacy Policy applies to:

• Merchants who install and use the Ariven App on their Shopify stores.
• End-Customers (store visitors and buyers) whose data is processed through the App on behalf of merchants.

Ariven acts as a data processor on behalf of the merchant (the data controller). The merchant determines what data is collected and how personalization features are configured. Ariven processes that data according to the merchant's instructions and this policy.

2. Information We Collect

2.1 Merchant Data

When a merchant installs and uses the App, we collect:

• Account information: Name, email address, and authentication credentials (stored securely via Firebase Authentication).
• Store information: Shopify store name, domain, currency, timezone, and Shopify plan type, accessed via the Shopify Admin API.
• Billing information: Subscription status and usage data managed through Shopify's built-in billing system. We do not directly collect or store payment card details.
• Third-party integration credentials: If a merchant connects third-party services (e.g., Klaviyo), API keys are encrypted and stored securely in Google Cloud Secret Manager.

2.2 End-Customer Data

When a store visitor interacts with a merchant's storefront that uses the Ariven App, the following data may be collected on the merchant's behalf, subject to the visitor's consent preferences:

Identifiers

• A pseudonymous persistent identifier (Ariven person ID) assigned to the visitor for session continuity.
• Shopify's anonymous client identifier.

Browsing and Interaction Behavior

• Pages visited, page types, and navigation paths.
• Scroll activity, including scroll depth and scroll velocity.
• Click activity, including element type and position on the page.
• Form interactions, including field names, field types, time spent in fields, and interaction patterns (e.g., hesitation, corrections). Form values (what the visitor types) are not collected.
• Search queries entered on the merchant's storefront and filter interactions.
• Exit intent signals (e.g., cursor moving toward the browser's close/back area).
• Attention signals, including idle time, repeated clicks on non-interactive elements, and reading patterns.
• Tab visibility changes and time spent on page.

E-Commerce Activity

• Products viewed, added to cart, or removed from cart.
• Cart value changes.
• Checkout initiation, payment information submission, and purchase completion.
• Order details: order ID, total price, subtotal, tax, currency, and line items (product ID, variant ID, title, quantity, price).

Traffic and Attribution Data

• Referrer URL and referring domain.
• UTM parameters (source, medium, campaign, term, content).
• Landing page URL.
• Advertising click identifiers (gclid, fbclid, ttclid) if present in the URL.

Device and Technical Data

• Device type (desktop, mobile, tablet).
• Browser and operating system.
• User agent string (used for bot detection, not stored long-term).

Segmentation Data

• Funnel stage classification (e.g., new visitor, returning browser, cart builder, customer, repeat customer) based on observed behavior.
• Merchant-defined segment membership based on rules the merchant configures in the App.

2.3 Google Analytics Data

When a merchant chooses to connect their Google Analytics 4 (GA4) account, Ariven accesses read-only analytics data through the Google Analytics Data API. This includes aggregate metrics such as session counts, page views, traffic sources, bounce rates, e-commerce revenue, and conversion events. Ariven does not access personally identifiable information from Google Analytics. This data is accessed on-demand at the merchant's request and is not continuously synced, stored, or cached beyond the duration of the request. Connection to Google Analytics is entirely optional and merchant-initiated.

3. How We Use Information

3.1 Merchant Data

• Account management: Authentication, login, password reset, and account administration.
• Service delivery: Connecting to the merchant's Shopify store, syncing configuration, and delivering personalization features.
• Billing: Managing subscriptions and usage tracking through Shopify's billing system.
• Communications: Sending product updates, feature announcements, and service-related notifications to the merchant's email address.

3.2 End-Customer Data

All end-customer data is processed on behalf of the merchant for the following purposes:

• Personalization: Delivering targeted storefront experiences (redirects, page variants, discount offers) based on merchant-configured audience segments and visual workflows.
• Analytics: Providing the merchant with insights into visitor behavior, conversion funnels, and campaign attribution.
• Identity stitching: Linking anonymous browsing sessions to known customers when they complete a purchase, enabling the merchant to understand the full customer journey.
• A/B testing: Randomly assigning visitors to experience variants configured by the merchant, and measuring relative performance.
• Segment evaluation: Classifying visitors into behavioral segments defined by the merchant to determine which personalization experiences to deliver.

We do not:

• Contact end-customers directly (no emails, SMS, or push notifications are sent by Ariven to store visitors).
• Sell, rent, or trade end-customer data to any third party.
• Use end-customer data for our own advertising or marketing purposes.
• Track end-customers across different merchant stores. All data is fully siloed per merchant.

3.3 Google Analytics Data

Google Analytics data is used solely to provide merchants with analytics insights and conversion rate optimization recommendations within the Ariven dashboard and AI-powered analysis tools. Google Analytics data is not used for advertising, is not sold or shared with third parties, and is not combined with data from other merchants or external sources.

4. Cookies and Tracking Technologies

The App uses cookies, localStorage, and sessionStorage on merchant storefronts. These are classified into two categories:

4.1 Strictly Necessary (Functional) Cookies

These cookies are set regardless of consent status because they are required for the App's core functionality to prevent broken user experiences. They do not track or identify visitors.

4.2 Analytics Cookies (Require Consent)

These cookies are only set when the visitor consents to analytics tracking via the merchant's cookie consent banner. If consent is denied, these cookies are blocked or deleted.

4.3 Local and Session Storage

• _p_id_client (localStorage): Backup of the persistent visitor ID.
• _s_tok (sessionStorage): Session token.
• _ariven_profile (sessionStorage): Cached visitor profile for performance (30-minute TTL).
• _ariven_discovery_session (sessionStorage): Discovery session identifier.

4.4 Consent Handling

The App integrates with Shopify's Customer Privacy API to respect visitor consent preferences. When a visitor declines analytics tracking:

• All analytics cookies are blocked from being set or are immediately deleted.
• The server-side session cookie is revoked.
• localStorage and sessionStorage entries related to analytics are cleared.
• Only strictly necessary functional cookies (listed above) remain active.

Cookies are set only on the merchant's storefront domain. No cookies are set on checkout.shopify.com or any third-party domain.

5. Third-Party Services and Data Sharing

We use the following third-party services to operate the App. We do not sell, rent, or share end-customer data with advertisers, data brokers, or any other third parties.

5.1 Google Cloud Platform (Infrastructure Processor)

All data is stored and processed within Google Cloud Platform (GCP), hosted in United States regions.

Google acts as a sub-processor under their Data Processing Terms, which include Standard Contractual Clauses (SCCs) for international data transfers.

5.2 Shopify

The App accesses merchant store data through the Shopify Admin API under the following scopes, each required for core functionality:

• Store information: Store name, domain, currency, timezone, plan.
• Products and content: Product catalog for segmentation filtering.
• Orders: Historical order data for conversion analytics and customer journey attribution.
• Themes: Theme detection and script installation for storefront personalization.
• Web Pixels and Customer Events: Real-time behavioral event tracking on the storefront and checkout.
• Discounts: Dynamic discount code creation for merchant-configured promotions.

Data written back to Shopify includes metafields (flow configuration), discount codes, and web pixel registrations.

5.3 Klaviyo (Merchant-Initiated Integration)

If a merchant connects their Klaviyo account, Ariven reads segment and list membership data from the merchant's Klaviyo account using the merchant's own API key. This data is used to enrich visitor profiles with the merchant's existing email marketing segments. Ariven does not maintain its own Klaviyo account and does not push data to Klaviyo.

5.4 Railway (Hosting)

The App's backend is hosted on Railway, a cloud hosting platform. Railway provides compute infrastructure only and does not access application data.

5.5 Google Analytics Integration

Ariven connects to merchants' Google Analytics 4 accounts using Google OAuth 2.0 with the analytics.readonly scope. This grants Ariven read-only access to the merchant's GA4 property data. Ariven does not modify, write to, or delete any data in the merchant's Google Analytics account. OAuth refresh tokens are encrypted at rest using AES-256 encryption, stored within our Google Cloud Platform infrastructure, and are never exposed to third parties. Merchants may disconnect their Google Analytics account at any time through the Ariven settings page, which immediately revokes the OAuth tokens with Google and deletes all stored credentials from our systems.

5.6 Google API Services User Data Policy

Ariven's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• Ariven only uses access to Google data to provide and improve the analytics features requested by the merchant.
• Ariven does not transfer Google data to third parties except as necessary to provide or improve the App, to comply with applicable laws, or as part of a merger/acquisition with equivalent privacy protections.
• Ariven does not use Google data for serving advertisements.
• Ariven does not allow humans to read Google data unless the merchant has provided affirmative consent, it is necessary for security purposes, to comply with applicable law, or the data is aggregated and anonymized for internal operations.

6. Data Retention

When a merchant uninstalls the App:

• The Shopify access token is immediately revoked.
• All Google OAuth tokens are revoked and deleted immediately.
• The store enters a 30-day soft-deletion period during which the merchant can reinstall and reactivate.
• After 30 days, all store data (Firestore documents and BigQuery rows) is permanently deleted.

When a merchant deletes their account:

• A 5-day grace period allows cancellation.
• After the grace period, all stores, customer data, Shopify subscriptions, integration credentials, and the account itself are permanently deleted.

Google Cloud Platform automated backups may retain encrypted copies of data for a limited period beyond deletion, subject to Google's data processing terms.

Google Analytics report data is not persistently stored; it is fetched on-demand and returned directly to the merchant.

7. Data Security

We implement industry-standard security measures to protect your data, including:

• Encryption of data in transit using HTTPS/TLS on all connections.
• Encryption of sensitive data at rest, including Shopify access tokens and third-party API keys.
• Secure credential storage using Google Cloud Secret Manager.
• Webhook signature verification using HMAC-SHA256 with timing-safe comparison and replay protection.
• Rate limiting on authentication endpoints and API routes.
• Security headers including Content-Security-Policy, HSTS, X-Frame-Options, and Permissions-Policy.
• Access controls enforced at the application and database layers, ensuring merchants can only access their own store data.
• Log sanitization to prevent PII from appearing in application logs.

Google OAuth tokens are encrypted at rest using AES-256-CBC encryption with keys managed through Google Cloud Secret Manager. Access tokens and refresh tokens are never stored in plaintext, logged, or transmitted to any party other than Google's OAuth endpoints.

8. Data Breach Notification

In the event of a data breach that affects your personal data, we will notify affected merchants within 72 hours of becoming aware of the breach, in accordance with GDPR requirements. Notification will include the nature of the breach, the data affected, and the steps we are taking to address it.

9. Profiling and Automated Processing

The App classifies store visitors into behavioral segments based on their browsing activity (e.g., new visitor, returning browser, cart builder, customer). This classification is:

• Configured by the merchant, who defines audience rules and determines what experiences each segment receives.
• Used solely for personalization, such as showing different landing pages, offers, or discounts to different segments.
• Not used for automated decisions with legal or similarly significant effects. No visitor is denied access to products, charged different prices, or subjected to any consequential automated decision.

Merchants may also configure A/B tests that randomly assign visitors to different experience variants. The variant assignment is random and is used to measure the relative effectiveness of different storefront experiences.

10. Your Rights

10.1 Merchant Rights

As a merchant, you may:

• Access your account and store data at any time through the App.
• Update your account information through the App settings.
• Delete your account and all associated data through the App's account deletion feature.
• Uninstall the App at any time through Shopify, which initiates the data deletion process described in Section 6.
• Revoke Google Analytics access at any time by disconnecting the integration within the Ariven settings page or by revoking access through your Google Account permissions at https://myaccount.google.com/permissions.

10.2 End-Customer Rights

End-customers have rights under applicable data protection laws, including the right to access, correct, delete, or port their personal data. Because Ariven acts as a data processor on behalf of the merchant:

• End-customers should direct data requests to the merchant (the store they visited).
• The merchant may submit requests to Shopify, which will forward them to Ariven via Shopify's mandatory compliance webhooks.
• Upon receiving a data deletion request, Ariven anonymizes the end-customer's data across all storage systems (Firestore and BigQuery), replacing personal identifiers with random anonymized values. Anonymized, non-identifiable behavioral data may be retained for aggregate analytics purposes.
• Upon receiving a data access/portability request, Ariven gathers all stored data associated with the end-customer and provides it to the merchant.

11. International Data Transfers

All data is stored and processed in the United States using Google Cloud Platform infrastructure. If you or your customers are located outside the United States (including in the European Economic Area), your data will be transferred to and processed in the United States.

For transfers from the EEA, we rely on Google Cloud's Standard Contractual Clauses (SCCs) included in their Data Processing Terms as the legal mechanism for cross-border data transfers.

12. Legal Basis for Processing (EEA Visitors)

For end-customers located in the European Economic Area, the legal basis for processing personal data is consent, obtained through the merchant's cookie consent mechanism integrated with Shopify's Customer Privacy API. If a visitor does not consent to analytics tracking, no personal data is collected beyond what is strictly necessary for functional cookies (see Section 4.1).

For merchants, the legal basis is contract performance (processing necessary to deliver the App's services) and legitimate interest (product updates and communications).

13. California Privacy Rights (CCPA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA):

• Right to Know: You may request information about the categories and specific pieces of personal information we have collected about you.
• Right to Delete: You may request that we delete your personal information.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

We do not sell personal information. We do not share personal information with third parties for their own marketing purposes. We do not use personal information for cross-context behavioral advertising.

To exercise your CCPA rights, contact us at chris@ariven.ai.

14. Children's Privacy

The App is a business-to-business tool designed for Shopify merchants. It is not directed at children under the age of 13 (or 16 in the EEA). We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected data from a child, we will take steps to delete it promptly.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make changes, we will update the "Last Updated" date at the top of this page. We encourage you to review this policy periodically.

16. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us at:

Ariven, Inc.
1030 Jessica Dr, Wauconda, IL 60084
Email: chris@ariven.ai

This Privacy Policy is hosted at https://ariven.ai/privacy.