Privacy Policy

Quinn AI Product Quiz — last updated 2026-10-05

1. Introduction

Quinn AI Product Quiz (“the App,” “we,” “us,” or “our”) is a Shopify app that lets merchants build product-recommendation quizzes shown on their storefront. Shoppers answer a short series of questions and receive personalized product recommendations drawn from the merchant’s catalog.

This Privacy Policy explains what information the App accesses from your Shopify store, what we store in our database, how we use it, who we share it with, how long we keep it, and what rights you have over it. Please read it carefully. By installing the App you agree to the practices described here.

This policy covers merchants (Shopify store owners and their staff) who install or use the App. It also describes how we handle data generated by shoppers who take quizzes on merchant storefronts — such data is anonymous unless the merchant enables the optional lead-capture feature, in which case a shopper may voluntarily submit their email address (see Sections 3.3 and 3.5). It does not cover the practices of Shopify, Inc. itself — see Shopify’s Privacy Policy for that.

2. What the App Does and Why It Reads Store Data

To power product recommendations, the App reads product catalog data from your Shopify store via the Admin API. The App is designed with strict data minimization in mind: it reads only the catalog information required to match quiz answers to relevant products, and it deliberately does not request access to customer personal data, order data, financial data, or any other information beyond the catalog and app-proxy scopes listed below.

Specifically, the App is granted the following Admin API access scopes:

read_products — used to fetch product titles, descriptions, tags, variants, images, and collection membership in order to build quiz recommendation logic and display product cards to shoppers.
write_app_proxy — used to serve the storefront quiz widget via Shopify’s App Proxy. The proxy routes shopper quiz requests through Shopify to our server; Shopify signs each request and we verify the signature before processing.

The App does not request and does not read: customer personal data (names, email addresses, phone numbers, physical addresses), order data, draft orders, financial reports, staff account details, payout information, theme source code, metafields (beyond standard product fields), or any other store data outside the scopes listed above.

3. What We Store

3.1 Store identifier and Shopify session tokens

We store your store’s .myshopify.com domain as the primary key that associates all your data with your store. We also store Shopify OAuth session tokens for the duration of your installation, used solely to authenticate Admin API requests from your store to our server. Session tokens are purged on uninstall.

3.2 Quiz definitions (merchant content)

The App stores the quizzes you create: quiz titles, question text, answer option text, the mapping of answers to product tags or collection IDs, and your quiz configuration settings (e.g. result display options). This content belongs to you and is used solely to serve the quiz on your storefront and display it in the App’s admin interface.

3.3 Anonymous shopper quiz responses

When a shopper takes a quiz on your storefront, the App records their responses, the questions reached and answered or skipped, products recommended, and recorded cart additions. The App saves question and answer text as authored when collected so merchants can review earlier responses. These responses are keyed by a randomly generated session identifier (a UUID created at quiz-start time). Except for the optional lead-capture email described in Section 3.5, we do not collect, request, or store:

The shopper’s name, email address, or phone number (email is collected ONLY when the merchant has enabled lead capture and the shopper voluntarily submits it — see Section 3.5).
The shopper’s IP address (it is not persisted; it may appear transiently in server access logs which are rotated and not stored in our database).
The shopper’s Shopify customer ID or account information.
Any payment or order information.
Any information that, by itself or in combination with other data we hold, would identify a specific individual.

The session identifier is generated fresh for each quiz session and is not linked to a Shopify customer account, browser cookie, or any persistent device identifier. It is used solely to associate the answers within a single quiz-taking session with the recommendations served at the end of that session, and to power the per-session analytics described in Section 3.4 below.

3.3.1 Remembering and sharing results

When remembering results is enabled, the shopper’s browser uses local storage to save the last completed quiz’s answer and skipped-question identifiers and uses them to restore results for up to 30 days. Expired entries are removed when the quiz next tries to restore them. This saved state stays in that browser and does not include an email address or session identifier. Shoppers can select “Start over” or clear their browser’s site data to remove it. Merchants can disable remembering in the quiz block or popup settings.

Shoppers may choose to share a results link. The shared link contains only answer and skipped-question identifiers; the shared link does not contain contact details or a session identifier. Anyone with the link can open it and see recommendations based on those answers. Preferences may be inferred from the recommendations, so shoppers should share a link only with people they want to have those results.

Opening remembered or shared results sends the saved answer identifiers to the App to recompute recommendations using the merchant’s current quiz mappings and the same cached catalog data as a new quiz run. Catalog data is cached for 60 seconds or 10 minutes, depending on the recommendation path. Under high request volume, budget safeguards may reuse older cached data. This uses the same recommendation processing described in Section 4, including the decision model when enabled by the merchant. Viewing these results does not create a new quiz completion or shopper response record and does not ask for or capture another lead email. If the shopper starts over and completes the quiz again, that is a new quiz response.

3.4 Aggregate event counts and analytics

The App records aggregate event counts to give merchants honest analytics about how their quizzes are performing. These events are:

Quiz view — a shopper loaded the quiz widget.
Quiz completion — a shopper reached the results screen.
Recommendation shown — a specific product was shown to a shopper as a recommendation (recorded as a count per product ID, not per individual shopper).
Add to cart — a shopper clicked “Add to cart” on a recommended product from within the quiz results (recorded as a count per product ID).

All event counts are aggregated at the quiz and product level. They do not include individual shopper identities, device fingerprints, or any information that could be used to track a specific individual across sessions.

3.5 Shopper emails (optional lead capture)

Merchants on the Pro plan can enable lead capture per quiz. When enabled, the quiz asks the shopper for their email address right before showing their results (the merchant chooses whether the step can be skipped). If the shopper submits an email address, we store: the email address, the quiz that captured it, the anonymous session identifier, and a timestamp. This IS personal data, and we treat it accordingly:

It is collected directly from the shopper, voluntarily — never read from Shopify customer records (the App has no customer data scopes).
It is visible only to the merchant whose store captured it (on the App’s Leads page, with CSV export) and is used by us solely to provide that page and, if the merchant adds a webhook, to send it to the address the merchant chose (Section 3.6). We never use it for advertising, profiling, AI/ML training, or resale, and we never contact shoppers ourselves.
It is deleted when: the merchant’s customer requests deletion (Shopify’s customers/redact webhook — we delete all lead rows matching that customer’s email for that store), the store is redacted (shop/redact), the retention purge described in Section 5 runs after uninstall, or the merchant deletes the quiz that captured it.
The merchant is the data controller for captured leads; we process them on the merchant’s behalf. Merchants are responsible for using captured emails in accordance with their own privacy policy and applicable marketing-consent laws.

3.6 Webhooks you configure (optional)

On the App’s Integrations page a merchant can add one https:// web address of their own choosing, such as an automation service or their own server. When they do, each time a shopper finishes one of their quizzes we send that address the quiz’s name, the questions and the answers that shopper chose, the anonymous session identifier, and the products we recommended. When a shopper submits an email through lead capture (Section 3.5), we also send that email address with the same answers and products.

Nothing is sent unless the merchant adds an address, and sending stops as soon as they remove it. We store the address, a signing secret the merchant uses to check that requests came from us, and the outcome of the most recent delivery (a status code or an error type, never the content sent or received).
The receiving service is chosen by the merchant and is not our sub-processor. Data delivered there is handled under the merchant’s agreement with that service; deleting data in the App (Sections 5 and 7) cannot reach copies already delivered, so the merchant is responsible for honoring deletion requests there too.
We do not send to private or internal network addresses, and we keep no copy of what we send beyond the records described in Sections 3.3 and 3.5.

3.7 Merchant customer-event pixels

The storefront widget publishes quiz interactions through Shopify Customer Events: quiz starts, answered questions, completions, product clicks, successful cart adds and acknowledged lead captures. These payloads contain the quiz name, selected answer labels and recommended product details. Our custom event data contains no email, shopper or session identifier, or typed lead input. Shopify supplies its own event context and identifiers. Restoring shared or remembered results does not publish a new completion.

Merchants may connect a custom pixel to forward these events to Google Analytics or Meta. Shopify applies the store’s configured consent requirements to each pixel. The receiving services may collect their own identifiers under the merchant’s pixel configuration and privacy policy. The App does not store the merchant’s analytics or pixel IDs.

4. How We Use the Data

We use the data described above solely to:

Serve the quiz widget to shoppers on your storefront and compute personalized product recommendations based on their answers.
Display quiz management, configuration, and performance analytics to you (the merchant) within the App’s Shopify Admin interface.
Respond to Shopify’s mandatory GDPR compliance webhooks (see Section 7).
Diagnose errors in our application. Error monitoring captures stack traces and request context; it does not include shopper quiz responses or merchant catalog content beyond what appears in a stack trace.

We do not use your store data or shopper quiz data for advertising, for training any AI or machine-learning model, for any form of individual profiling, or for sale or transfer to third parties. The one exception to transfer is a webhook address you add yourself (Section 3.6): we send quiz results there because you asked us to.

Quiz recommendations are matched by Jev, a decision model from TypeSafe AI, Inc. When a shopper finishes a quiz, we send TypeSafe the quiz’s title, its questions and the answers that shopper chose, together with text about the products they can buy in your store: titles, product types, vendors, tags, collection names and a short excerpt of each description. Jev returns how well each product fits those answers. Our servers apply budget answers and stock availability themselves, then choose what to show. We never send TypeSafe the shopper’s name, email address, IP address, Shopify customer ID or session identifier, so the answers it receives are not linked to any person. If Jev is unavailable, our servers choose recommendations with deterministic rules built from your quiz’s answer settings.

Quiz generation is different, and we want to be explicit about it. When you ask the App to draft a quiz or suggest an idea, we send a sample of your product catalog — titles, product types, vendors, tags and descriptions for up to 50 active products — together with any description you type, to OpenRouter, which passes the request to the model provider you select in the App. This happens only when you ask for it, never in the background. We do not send shopper quiz responses, shopper email addresses, or any customer personal data to OpenRouter or to any model provider it routes to.

5. Data Retention

Your store’s data — quiz definitions, anonymous shopper responses, aggregate event counts, and session tokens — is retained for as long as the App is installed on your store.

When you uninstall the App, we receive a Shopify app/uninstalled webhook. We mark your store as inactive and stop processing new requests. Your data is then permanently deleted at whichever of these comes first: (a) receipt of Shopify’s shop/redact GDPR webhook, which Shopify typically sends about 48 hours after uninstall — all data for your store is deleted immediately upon receipt; or (b) an automated retention purge that permanently deletes all data belonging to stores uninstalled more than 30 days ago.

If you reinstall the App before deletion has occurred, your quiz definitions and analytics history are preserved. Because Shopify usually sends shop/redact about 48 hours after uninstall, in practice data from an uninstalled store is deleted within a few days, and never later than 31 days after uninstall (the 30-day retention window plus, at most, the purge job’s six-hour sweep interval).

Anonymous shopper session records (answer sets keyed by a random UUID) are deleted together with all other store data on uninstall or shop/redact. Shopper emails captured by the optional lead-capture feature (Section 3.5) follow the same store-level deletion schedule, and are additionally deleted per-customer upon a customers/redact request at any time.

6. Sub-Processors and Hosting

We rely on the following third-party sub-processors to operate the App:

Shopify, Inc. — Platform operator and provider of the Admin API through which we read your catalog, and the App Proxy through which shopper quiz requests are routed. Shopify processes data under its own DPA and privacy policy. See Shopify Privacy Policy.
Railway, Inc. — Cloud hosting provider for our application server and PostgreSQL database. Your store’s quiz data and shopper response data reside in a PostgreSQL database on Railway infrastructure. Railway’s data centers are located in the United States. See Railway Privacy Policy.
OpenRouter, Inc. — AI gateway, used only when you ask the App to draft a quiz or suggest an idea. It receives the catalog sample and the description you type, and routes them to the model provider you pick in the App. It does not receive shopper quiz responses, shopper email addresses, or customer personal data. See OpenRouter Privacy Policy.
TypeSafe AI, Inc. — the Jev decision model that matches products to a shopper’s quiz answers. It receives the quiz’s questions, the chosen answers and product text, as described in section 4, and no shopper identity, email address or customer personal data. TypeSafe states that it does not train models on this data. See TypeSafe Privacy Policy.

We do not use any other sub-processors. Merchant-configured pixels may receive the customer events described in Section 3.7. We do not sell your store or shopper quiz data to data brokers. AI processing is limited to what section 4 describes: quiz generation through OpenRouter, which receives catalog content only when you ask for it, and product matching through TypeSafe, which receives quiz answers with no shopper identity attached, plus product text. Neither receives shopper email addresses or customer personal data. A webhook address a merchant adds (Section 3.6) is not one of our sub-processors: it is a destination the merchant chooses, and it receives only what Section 3.6 describes.

7. GDPR, CCPA, and Mandatory Compliance Webhooks

7.1 GDPR compliance webhooks

Shopify requires all apps to honor three mandatory compliance webhooks. We implement all three:

customers/data_request — A merchant’s customer may request a copy of their personal data held by apps installed on that store. The only customer personal data Quinn AI Product Quiz can hold is a lead-capture email and the quiz responses and activity linked to that email (Section 3.5). On receipt we identify matching lead records for that store. The merchant can use “Export customer data” on the App’s Leads page to export the email and its linked quiz records on every plan to fulfill the request. Sessions without a captured email are not associated with a named customer by the App.
customers/redact — A merchant’s customer may request deletion of their personal data held by apps. Our handler permanently deletes every lead-capture record matching the customer’s email address for that store, together with quiz responses, saved answers and events for those linked sessions, immediately upon receipt. Copies the merchant’s own webhook already received (Section 3.6) are outside the App and must be deleted by the merchant.
shop/redact — Sent by Shopify after a store uninstalls and requests data deletion. Upon receipt, we permanently and immediately delete all data associated with the .myshopify.com domain identified in the webhook payload: the store record, all quiz definitions, all anonymous shopper response records, all captured lead emails, all aggregate event counts, and all session tokens.

7.2 Your rights as a merchant (GDPR / CCPA)

If you are located in the European Economic Area, the United Kingdom, or California, you may have additional rights regarding your data, including:

Right of access — You may request a copy of the data we hold about your store (quiz definitions, aggregate event counts).
Right to erasure — You may request deletion of your store’s data. The most direct way is to uninstall the App (Shopify will subsequently send us the shop/redact webhook, which triggers immediate deletion). You may also contact us directly.
Right to rectification — If any quiz definition data we hold is inaccurate, you may update it directly within the App or contact us.
Right to portability — You may request a machine-readable export of your quiz definitions and aggregate analytics data.
Right to object — You may object to our processing of your data. The primary mechanism is uninstalling the App, which terminates processing.

To exercise any of these rights, contact us at info+support@legitimateapps.com. We will respond within 30 days.

8. International Data Transfers

Our application servers and database are hosted on Railway’s infrastructure, which is located in the United States. If you are based outside the United States, your store’s quiz data, anonymous shopper response data, and any captured lead emails are transferred to and processed in the United States when you use the App. We rely on Shopify’s standard data-processing agreements and Railway’s data-processing terms to provide appropriate safeguards for such transfers where applicable under GDPR.

9. Security

We implement the following security measures to protect the data we store:

All communication between your Shopify store, shoppers’ browsers (via Shopify’s App Proxy), and our servers takes place over HTTPS/TLS.
All webhook payloads from Shopify are verified using HMAC-SHA256 before processing.
App Proxy requests from shoppers are verified using Shopify’s signed-proxy signature before any shopper data is processed.
App Bridge session tokens are verified cryptographically on every authenticated Admin request.
Access to our production database is restricted to our application server; it is not publicly accessible.
We do not log the content of webhook payloads that contain merchant or customer information beyond the store domain identifier.

No method of electronic storage or transmission is 100% secure. While we strive to protect your information using commercially reasonable means, we cannot guarantee absolute security.

10. Children’s Privacy

The App’s merchant-facing interface is a business-to-business service intended for Shopify merchants (businesses and business operators). The storefront quiz widget may be viewed by shoppers of any age depending on the nature of the merchant’s store. Quiz answers are anonymous session records only. If a merchant enables lead capture, the email step accepts whatever address the shopper voluntarily submits; we do not knowingly collect emails from children, and merchants are responsible for ensuring their storefront, quiz content, and lead-capture usage are appropriate for their audience and jurisdiction.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the “last updated” date at the top of this page. For material changes, we will notify merchants via the App’s in-app interface or by email to the store contact address. Continued use of the App after a policy change constitutes acceptance of the updated policy.

12. Contact Us

For any questions about this Privacy Policy, to exercise your data rights, or to report a privacy concern, please contact us at:

info+support@legitimateapps.com

We aim to respond to all privacy-related inquiries within 30 calendar days.