Privacy Policy

Last updated: February 22, 2026

CopyLab ("we," "our," or "us") provides an AI-powered A/B testing application for Shopify merchants ("you" or "your"). This Privacy Policy explains how we collect, use, disclose, and protect information when you use our application.

1. Information We Collect

1.1 Store Information

When you install CopyLab, we access the following through Shopify's API with your authorization:

Store information: your store domain name, store name, and Shopify plan.
Product data: product titles, descriptions, bullet points, meta titles, meta descriptions, images, handles, and tags, used to generate and test copy variants.
Order data: order IDs, line item product IDs, line item prices, and quantities, used solely to track conversion metrics for A/B experiments. We do not store customer names, addresses, emails, or any personally identifiable customer information from orders.

1.2 Usage Data

We collect anonymized analytics about how you interact with the app, including pages visited, features used, and experiment configurations. This data does not identify individual storefront visitors.

1.3 Storefront Visitor Data

Our storefront script collects:

Anonymous session identifiers: randomly generated IDs stored in browser cookies to track which copy variant a visitor sees. These are not linked to any personal information.
Page view and interaction events: which product pages are viewed and which variant is displayed, used to calculate experiment statistics.

We do not collect visitor names, email addresses, IP addresses, device fingerprints, or any other personally identifiable information from your storefront visitors.

2. How We Use Your Information

A/B Testing: to generate AI copy variants and measure their performance against your original product copy.
Conversion Tracking: to calculate statistical significance and determine winning variants using order data.
AI Generation: product data is sent to OpenAI and/or Google AI to generate copy variants. These providers process data per their own privacy policies and do not retain your data for model training.
Email Notifications: to send weekly experiment reports and winner notifications if you opt in, via Resend.
App Improvement: aggregated, anonymized usage data helps us improve the application.

3. Data Storage and Security

Application data is stored in a PostgreSQL database hosted on Supabase (AWS us-east-1).
Caching and rate limiting use Upstash Redis with encryption in transit.
All data transmission uses TLS/HTTPS encryption.
We use Shopify's OAuth 2.0 for authentication. We never store your Shopify password.
Access tokens are stored encrypted and are only used to communicate with Shopify's API on your behalf.

4. Data Sharing

We do not sell, rent, or trade your data. We share data only with:

OpenAI / Google AI: product data sent for copy generation (processed per their privacy policies, not used for training).
Resend: your email address for transactional emails (weekly reports, notifications).
Supabase: database hosting provider.
Upstash: Redis caching provider.
Vercel: application hosting provider.

We may disclose information if required by law, regulation, or legal process.

5. Data Retention

Your data is retained for as long as CopyLab is installed on your store.
Upon uninstalling, all your data (store info, products, experiments, variants, events, notifications, and sessions) is permanently deleted within 48 hours, in compliance with Shopify's requirements.
You may request deletion of your data at any time by contacting us or uninstalling the application.

6. GDPR and Data Protection Rights

If you are in the European Economic Area, you have the right to:

Access the personal data we hold about you.
Rectify inaccurate data.
Erase your data (right to be forgotten).
Restrict processing of your data.
Port your data to another service.
Object to processing of your data.

We respond to all GDPR requests within 30 days. Contact us using the information below.

7. CCPA (California)

California residents may request disclosure of the categories and specific pieces of personal information collected, and may request deletion. We do not sell personal information. Contact us to exercise these rights.

8. Cookies

CopyLab's storefront script uses a single first-party cookie per active experiment to assign visitors to a copy variant. This cookie:

Contains only a randomly generated variant identifier.
Does not track visitors across sites.
Is not used for advertising or profiling.
Expires when the experiment concludes.

9. Children's Privacy

CopyLab is a business tool for Shopify merchants. We do not knowingly collect information from children under 13 (or 16 in the EEA). If we learn we have collected such data, we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Continued use of the application after changes constitutes acceptance of the revised policy.

11. Contact Us

If you have questions about this Privacy Policy, your data, or want to exercise your rights:

Email: info@518studio.com
App: Use the Help section within CopyLab