The policies that govern the Humotron recommendation engine, our API, our commerce integrations, and our Consultants and Benefits products. Written for the people who have to review them — plain language first, detail underneath, and no attempt to hide the parts that matter.
The app holds no customer scopes at all. It reads your products, writes recommendation detail back to them, and serves a prompt on your storefront. Your customers’ names, emails and orders stay with you and never reach Humotron.
| Permission | What it is for |
|---|---|
| read_products | Reads your product titles, descriptions, images, types and variants so the engine knows what each product can be matched on. |
| write_products | Writes the ingredients, dose, form, use and cautions back to your own product as a metafield, so the work stays yours and travels with your catalogue if you leave. |
| write_app_proxy | Lets us serve the Humotron prompt and recommendations at /apps/humotron on your domain. It gives no access to your theme or your pages. |
There are no customer permissions in that list, and that is deliberate rather than incidental. The app cannot read your customers even if someone asks it to.
| What | Why, and for how long |
|---|---|
| Your shop domain | Identifies the store. Kept for as long as the app is installed. |
| Store owner contact details | Shopify provides the store owner’s name, email address, phone number and business address to every app at install. We use them only for billing, service notices and support. |
| Your product catalogue | Titles, descriptions, ingredients and specifications. It should contain no personal data. |
| Counts of what happened | How many shoppers were shown the prompt, connected a wearable, saw a recommendation and added one to a basket. |
A first-party cookie set on your own domain when a shopper opens the Humotron prompt. It carries a random identifier for that shopper’s session with us and nothing else — no name, no email, no reading.
humotron_s — Expires after 30 days, or immediately when the shopper disconnects.
| Request | What we do |
|---|---|
| customers/data_request | A shopper asks what you hold about them. We answer what we hold linked to that shop and shopper identifier, which is normally nothing, because no customer identity reaches us. |
| customers/redact | A shopper asks to be erased. We delete any session identifier and connection linked to that shopper. |
| shop/redact | Sent 48 hours after a merchant uninstalls. We delete the shop record, its catalogue and every shopper link belonging to it. |
| What | How long |
|---|---|
| Shop record and settings | Deleted when Shopify confirms the uninstall, 48 hours after you remove the app. |
| Product data we read | Replaced on each sync; deleted with the shop record. |
| Shopper session identifiers | 30 days after the last recommendation, or immediately on disconnect or redaction. |
| Counts of what happened | Kept for 24 months in aggregate, with no shopper identifier attached. |
| Service logs | 90 days. |
This annex covers only what the Shopify app does. Who controls what, what crosses the boundary, our sub-processors and transfers, and what you may and may not do with the output are all in the Data & Privacy policy, which governs this annex wherever the two meet.
Questions, and procurement documents on request: privacy@humotron.com. Humotron Ltd, registered in England & Wales, company no. 17494452.