NaviluData processing agreement
Last updated 22 October 2026
This agreement applies when a merchant ("controller") installs Navilu ("processor") and Navilu processes personal data of the merchant's store visitors and customers on the merchant's behalf. It forms part of the terms of service.
Subject matter and purpose
Running the merchant's A/B tests and reporting their results. Navilu processes the data only on the merchant's documented instructions, which are the experiments the merchant configures, and for no other purpose.
Categories of data and data subjects
- Store visitors: a random visitor identifier held in the visitor's browser, the experiment variant shown, page paths, page-view and add-to-cart events; and, where the merchant turns on the one question to leaving shoppers, the chosen answer as a code (one of five), kept as daily totals, with a keyed one-way hash of the visitor identifier kept 30 days so each visitor counts once.
- Customers: order identifiers, order subtotals and cost of goods for orders placed by visitors in an experiment.
- For merchants who connect Google Search Console: the words people searched in Google before seeing the store, with Google's totals (clicks, times shown, average place) over 28 days. Google aggregates these over many searchers and omits rare searches; Navilu keeps only those totals, from its last daily read, and deletes them with the merchant's key on Disconnect or uninstall. Google is the merchant's own service here, read with the merchant's permission, not a sub-processor.
No names, email addresses, phone numbers or postal addresses are processed.
Consent
Where the store records visitor consent through Shopify, Navilu does not assign, store an identifier for, or track a visitor who has not allowed analytics. The merchant remains responsible for the consent notice shown to its visitors.
Sub-processors
- Shopify (the merchant's platform, source of orders)
- Cloudflare (edge delivery of configuration and event intake)
- Fly.io (application hosting and database)
- Anthropic (writing help, for stores that turn it on: only the text the merchant selects in the visual editor, a product's title, first line and button text, with its description, product type and tags or facts the merchant types, as the merchant chooses, when they ask for written versions, and the merchant's sentence, answers and follow-up words with an outline of one page, the public page or the page open in the visual editor, when they ask Navilu to change a page; and in Navilu chat, the merchant's messages, the chat so far and their tests' names, pages and counted results, with the outline of the page open in the visual editor when they chat there, never any one visitor, customer or order)
Navilu will give notice on this page before adding a sub-processor.
Security
All transport is encrypted; data at rest is encrypted by the hosting providers; edge-to-application traffic is signed; access to production systems is restricted to the operator.
Data subject requests and deletion
Navilu honours Shopify's customer and shop redaction requests automatically. Uninstalling the app removes the store's access token immediately, and a shop redaction request from Shopify deletes all of the store's data.
Breach notification
Navilu will notify the merchant without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting the merchant's data.
International transfers
Data may be processed in the United States and wherever the sub-processors operate. Where required, transfers rely on the sub-processors' standard contractual clauses.