Navilu

Privacy policy

Last updated 22 October 2026

Navilu is an A/B testing app for Shopify stores. This policy describes what the app collects from a store that installs it, what it collects from that store's visitors, and how it is handled.

What we collect from merchants

  • The store's domain and the access token Shopify issues when the app is installed, used only to read orders and products for the store's own experiments, and for its Store pulse: the time and total of each order from the last 60 days, read when the merchant opens that page and not stored.
  • The experiments a merchant creates: names, page patterns, and the content of each variant.
  • If a merchant connects an AI assistant through Navilu's MCP endpoint: a token the merchant creates in Settings, stored only as a hash, and when it was last used. That assistant reads the merchant's tests, results and forecasts with the token; Navilu sends nothing to the assistant's provider, and the merchant can revoke the token at any time.
  • If a merchant connects an AI assistant by signing in with Shopify: the assistant's name and the web address it returns to, the store it is connected to, when it was connected and last used, and the codes and keys it uses, stored only as one-way hashes. Its keys last one hour and are renewed for up to 60 days; the merchant can remove the assistant in Settings at any time, and it stops at once. A connected assistant can read the store's tests, results once Navilu shows them, forecasts and ideas, and the public pages of the store it asks to read (the words, sizes and colours shoppers see; Navilu keeps a page's outline for one hour so the assistant can refer to its parts). It can make draft tests; it cannot start one unless the merchant allows it, and it never sees customer, order or shopper data. Navilu sends nothing to the assistant's provider beyond these answers.
  • If a merchant connects Google Search Console: a key Google gives (a refresh token) to read that one Search Console account, stored encrypted and never shown, and the site the merchant picks. Once a day Navilu reads the words people searched in Google before they saw the store, with Google's totals for them (clicks, times shown and average place) for the store and its product pages over 28 days. Google adds these up over many people and leaves out rare searches, so they describe no single person; Navilu keeps only these totals, from its last read. To find words a product page does not say, Navilu reads the product's title, description and search listing from Shopify when the merchant opens that page, and does not store them. Navilu never changes anything in Google. When the merchant disconnects or removes Navilu, the key and every word kept are deleted, and on Disconnect Google is asked to forget the key.
  • If a merchant connects Slack: the Slack address they paste, stored encrypted and never shown again. Navilu posts alerts about their own tests to it: the test's and versions' names, a short message and a link to the test. No shopper, customer or order data is sent. The address is deleted when they remove it or remove Navilu.

Learning from other stores

Only for stores that turn on "Learn from other stores": the outcome of each finished test that came from Navilu's catalogue of ideas (gain, loss or no clear difference, and the measured change in orders per visitor) is counted, together with other such stores, into summaries those stores see. Summaries are computed when shown, appear only when at least 10 stores have finished a test of that idea, never name a store, and contain no visitor or customer data. Turning it off removes the store's tests from every summary at once.

Checking a test result

The numbers entered on the "Check a test result" page, the app's Second opinion page or through the assistant's second_opinion tool are used to answer that one request and are not stored or logged. That page sets no cookie.

What we collect from store visitors

  • A random visitor identifier stored in the visitor's browser, used to keep them in the same variant. It is not linked to any account, email, name, or device identifier.
  • Which variant of which experiment the visitor saw, and page-view and add-to-cart events, each carrying only that random identifier and the page path.
  • For the merchant's Store pulse, once per visit: that a visit happened, that it opened a product page, and that it added to cart. Each of these carries only the store and the step: no identifier, no page path. They are kept only as totals per 15 minutes, for 60 days. When such a visitor adds to cart, the random identifier is written onto the cart, so the order shows it came from a visitor who allowed analytics.
  • At most once a day, after the visitor allows analytics, a signal that the script is running on the store, so the merchant can see the app is connected. It carries no identifier, experiment or page.
  • A short segment code (desktop, mobile or tablet; new or returning visitor; and where the visit came from: search, social, email, paid ads, direct, or another site or link), so results can be broken down by these groups. Where the visit came from is worked out in the visitor's browser from the address of the page they landed on and the name of the site they came from; that address and site name stay in the browser for the visit and are never sent to Navilu, only the one-letter kind.
  • When a merchant limits a test to an audience (for example a UTM campaign, a market country or a customer tag), that rule is checked in the visitor's browser. The campaign, country and tags themselves are never sent to Navilu; customer tags appear in the page only as salted one-way hashes.
  • Shopper groups are checked the same way, in the visitor's browser, and never sent to Navilu. For a logged-in customer the store's page says only which of these fit: no orders yet, one order or more, exactly one order, last order in the last 30 days; never the number of orders, their dates or what was bought. Nothing about orders is known for a visitor who is not logged in. The page also says whether the cart has items, and whether the store is shown in one of its other languages. When a test is shown to shoppers who looked at a product before, the visitor's browser keeps the numbers of the last 20 products they looked at, only while such a test runs and only with their consent; the list is never sent and is deleted when the visitor refuses or withdraws consent. When a test is shown to shoppers who looked at 3 or more products in this visit, or who scrolled down a page earlier in this visit, the browser keeps, for that visit only, the numbers of the last 3 products looked at, or a mark that the visitor scrolled down past the first screen; only while such a test runs and only with their consent. Neither is ever sent, and both are dropped when a new visit starts (after 30 minutes without a page) or when the visitor refuses or withdraws consent.
  • If the merchant turns on Google Analytics 4 forwarding and their store has no Google tag on the page, the visitor's Google Analytics client id (from Google's own _ga cookie) is sent with the test exposure, and Navilu's server passes the experiment and variant to the merchant's GA4 property. The merchant's GA4 API secret is stored encrypted.
  • If the merchant turns on Klaviyo, Klaviyo's own script in the visitor's browser adds the test group to the visitor's Klaviyo profile, only for visitors who allow marketing. Nothing about this passes through Navilu.
  • When a merchant asks Navilu to change a page for them, Navilu's own page checker opens that public page as a new visitor would, with no login, to read it and to try the change. It keeps pictures of the page for 7 days, then deletes them. It counts nothing and sends nothing to the store.
  • When a merchant compares their product page with a page of another store, Navilu's page checker opens both pages as a new visitor on a phone would, with no login. The other store's page is opened only when its rules for robots allow it. Navilu keeps only which parts each page has (yes or no, and counts such as the number of pictures) and the address the merchant pasted, for 30 days; no words, pictures or prices of either page.
  • If the merchant turns on Microsoft Clarity or Hotjar labels, Navilu's script tells the tool already on the store's page which version of each test the visitor saw (the test's id and the version's key), only for visitors who allow analytics. No visitor id is given to the tool, and Navilu never adds the tool to a store.
  • If the merchant turns on "Ask leaving shoppers one question", a visitor who allows analytics and is about to leave may be asked once in 30 days "What stopped you today?" with five answers to tap. Only the answer's one-letter code is sent, with the tests the visitor was counted in on that page; no text the visitor types, and not the page address. To count each visitor once, Navilu keeps a keyed one-way hash of the random visitor identifier for 30 days, apart from the answers; the answers are kept only as totals per day for up to 13 months.
  • If a test counts other things (clicks on an element the merchant picked, or visits to a page), Navilu's script sends which of them a visitor did, once per version, with the same details as its other events. No text the visitor typed and no click position is sent.
  • When a merchant describes in words which shoppers should see a test and Navilu cannot read all of the words itself, those words are sent to Anthropic to turn them into Navilu's shopper groups. Nothing about any visitor is sent.
  • If a merchant turns on writing help (“Let Navilu write for me” in Settings), the text they select in the visual editor is sent to Anthropic to suggest other wordings. When they ask Navilu to write versions of a product page, that product's title, the first line of its description and its button text are sent the same way, with, as the merchant chooses in Settings, its whole description, product type and tags, or facts the merchant types. When they ask Navilu to change a page for them, their sentence, their answers to Navilu's quick questions, what they ask to change after that, and an outline of that public page (its words and text sizes, as any visitor sees them) are sent the same way; when they ask from the visual editor, the outline is of the page they are editing, with the part they picked marked. In Navilu chat, the merchant's messages, the chat so far and their tests' names, pages and results (visitors and orders counted for each version) are sent the same way; from the visual editor, also the outline of the page they are editing. Nothing about any one visitor, customer or order is sent. The notes a merchant writes under "Your store's rules for Navilu" in Settings (how the store speaks, words to use or avoid, things that are true, things never to say or change, and its languages) are sent with each of these requests, and when they ask Navilu to compare a product's price with other stores.
  • If a merchant saves their storefront password in Settings, it is stored encrypted and used only by Navilu's page checker to open their own store's pages. It is never shown again, sent to the AI provider or shared, and it is deleted when they forget it or remove Navilu.
  • When a visitor places an order, the order id, its subtotal, and cost of goods where the merchant has entered it, so results can be reported as revenue and profit per visitor. Navilu does not store customer names, emails, phone numbers, or addresses.
  • For the Store pulse, every order of the store (test orders aside): its subtotal, discounts, cost of goods and shipping discount, added into totals per 15 minutes and kept 60 days, and its order id, kept 60 days so each order is counted once and a cancelled one is taken off.

Where it lives

Events are received by an edge service on Cloudflare and stored by the app on Fly.io. Experiment configuration is cached at the edge so it can be served to the storefront quickly.

How long we keep it

Experiment data is kept while the app is installed. Uninstalling the app immediately removes the store's access token, any open visual-editor sessions and the merchant's Google Analytics API secret, and ends every connected AI assistant and assistant token; it also deletes the Google Search Console key and the search words kept. When Shopify sends a shop redaction request (48 hours after uninstalling), all data for that store is deleted, including the configuration cached at the edge; when it sends a customer redaction request, the attributed order rows and the Store pulse order ids for that customer's orders are deleted.

Sharing

We do not sell merchant or visitor data, and we do not share it with third parties except on the merchant's instruction: when a merchant turns on Google Analytics 4 forwarding, the data described above goes to that merchant's own GA4 property, and when a merchant connects Slack, alerts go to the Slack channel they chose. When a merchant connects Google Search Console, Navilu only reads from their own Google account and sends Google nothing about their store, visitors or customers. Infrastructure providers (Shopify, Cloudflare, Fly.io, and Anthropic for writing help) process data only to run the service.

Visitor consent

The Navilu script acts only for visitors whose analytics consent Shopify's Customer Privacy API confirms. Until it does, on a visitor's first page and whenever consent is refused, not yet given or cannot be confirmed, the visitor sees the store as it is: the script stores nothing about them on their device, sends nothing and writes nothing to their cart. Consent given later takes effect from the next page they view. If a visitor refuses or withdraws consent, what the script stored on their device is deleted.

Contact

Questions about this policy: support@navilulabs.com. Terms of service: /terms. Data processing agreement: /dpa.