Privacy Policy

Overview

RetentionLab connects to your Shopify store to analyze customer retention patterns. This means we handle two types of data: information about you as our customer, and data from your Shopify store about your customers.

What We Collect

We collect information in three ways — what you give us directly, what we collect automatically, and what we access from your Shopify store.

How We Use Your Data

We use the information we collect to:

• Provide, operate, and improve the RetentionLab platform
• Generate retention analytics, cohort analysis, and at-risk customer reports
• Send you product updates, billing notifications, and support communications
• Calculate anonymized DTC industry benchmarks across our customer base
• Detect and prevent fraud, abuse, and security incidents
• Comply with legal obligations

We do not use your data to train AI models for third parties, serve advertising, or any purpose beyond what is necessary to provide the Service to you.

Shopify Store Data

When you connect your Shopify store, we access the following data through the Shopify API:

• Order records — order ID, date, amount, status
• Customer records — name, email address, order count, total spend
• Order line items — products purchased per order
• Referring sources and UTM parameters where available

We do not access or store:

• Payment card numbers or full payment details
• Product inventory, costs, or margin data
• Staff accounts or admin credentials
• Draft orders, abandoned checkouts, or unpublished content

Your Shopify store data is stored in isolated, encrypted storage. It is never commingled with data from other RetentionLab customers in a way that could identify your store or your customers.

Data Sharing

We do not sell your personal information or your store data. We share data only in the following limited circumstances:

• Service providers — we share data with third-party vendors who help us operate the Service, such as cloud hosting and payment processing. These providers are contractually bound to use your data only to provide services to us.
• Legal requirements — we may disclose information if required by law, court order, or government authority.
• Business transfers — if RetentionLab is acquired or merges with another company, your data may be transferred as part of that transaction. We will notify you in advance.
• With your consent — we may share information in other circumstances with your explicit permission.

We never share individual store data with other RetentionLab customers. Anonymized, aggregated benchmark statistics derived from across our customer base may be used to power our DTC industry benchmarks — this data cannot be used to identify your store, your customers, or your revenue.

Sub-Processors

We use the following third-party service providers to operate RetentionLab. Each is bound by data processing agreements that require them to protect your data:

We will update this list when we add new sub-processors and notify Enterprise customers in advance of any material changes.

Data Retention

We retain your data for as long as your account is active and for a reasonable period afterward to comply with legal obligations and resolve disputes.

• Active accounts — we retain your account information and store data for the duration of your subscription
• After cancellation — your store data is deleted within 30 days of account termination
• Billing records — payment records are retained for 7 years as required by financial regulations
• Immediate deletion — you may request immediate deletion of your store data by emailing insights@retentionlab.ai

Security

We implement industry-standard security measures to protect your data:

• All data is encrypted in transit using TLS 1.2 or higher
• Store data is encrypted at rest using AES-256 encryption
• Access to production systems is restricted to authorized personnel only
• We conduct regular security reviews and vulnerability assessments
• Shopify API tokens are stored encrypted and rotated regularly

No system is completely secure. If you discover a security vulnerability, please report it responsibly to security@retentionlab.ai. We will investigate and respond within 48 hours.

In the event of a data breach that affects your information, we will notify you within 72 hours as required by applicable law.

Your Rights

You have the following rights regarding your personal information. To exercise any of these rights, contact us at insights@retentionlab.ai.

We will respond to all requests within 30 days. We may need to verify your identity before fulfilling a request.

CCPA — California Residents

If you are a California resident, the California Consumer Privacy Act (CCPA) gives you specific rights regarding your personal information.

Under the CCPA you have the right to:

• Know what personal information we collect, use, disclose, and sell
• Request deletion of your personal information
• Opt out of the sale of your personal information — we do not sell personal information
• Non-discrimination for exercising your CCPA rights

To submit a CCPA request, email insights@retentionlab.ai with the subject line "CCPA Request." We will respond within 45 days.

In the past 12 months, we have not sold any personal information to third parties.

GDPR — European Users

If you are located in the European Economic Area (EEA), the UK, or Switzerland, the General Data Protection Regulation (GDPR) applies to your data.

Our legal bases for processing your personal data are:

• Contract — processing necessary to provide the Service you have subscribed to
• Legitimate interests — improving the Service, preventing fraud, and security
• Legal obligation — compliance with applicable laws
• Consent — for optional communications such as marketing emails

Data we collect may be transferred to and processed in the United States. We use Standard Contractual Clauses approved by the European Commission to ensure adequate protection for such transfers.

You have the right to lodge a complaint with your local data protection authority. To exercise your GDPR rights, contact us at insights@retentionlab.ai.

For Enterprise customers requiring a formal Data Processing Agreement (DPA) as required under GDPR Article 28, please contact us at insights@retentionlab.ai and we will provide a signed DPA.

Cookies

We use cookies and similar tracking technologies to operate the Service and improve your experience.

You can control cookies through your browser settings. Disabling essential cookies may prevent parts of the Service from functioning correctly.

Changes and Contact

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email at least 14 days before the changes take effect. The "Last updated" date at the top of this page reflects the most recent revision.

If you have questions about this Privacy Policy or how we handle your data, please contact us:

• Email: insights@retentionlab.ai
• Website: retentionlab.ai