At CignifyAI, Inc. (the "Company," "CignifyAI," "we," "us," or "our"), we have built an omnichannel analytics, attribution, and optimization platform purpose-built for direct-to-consumer merchants. This Privacy Policy ("Privacy Policy") is designed to help you understand how we collect, use, and safeguard the information you provide to us.
This policy describes the data we process when you use the cignify.ai website (the "Site") and our analytics and attribution platform (the "Services"), including data collected via our Spark Pixel℠ server-side tracking infrastructure.
CignifyAI is the "data controller" as defined by the EU General Data Protection Regulation (GDPR) for Personal Data collected via the CignifyAI Site and Services. When processing data on behalf of merchants through the Spark Pixel℠ or Shopify's APIs, CignifyAI acts as a "data processor" operating under the merchant's instructions. See Section E for more detail on this distinction.
By accessing our Site or Services, you accept this Privacy Policy and our Terms of Use. If you have a disability that prevents you from accessing this policy electronically, contact us at [email protected] for an alternative format.
We collect certain identifying information from visitors to our Site who wish to obtain information, support, or purchase our Services ("Personal Data"). This includes first name, last name, business email address, job title, organization name, country, business phone number, and payment information, collected via browser forms, online order forms, or email.
To better understand how our Site and Services are used, we may analyze information in aggregate form to operate, maintain, and improve them. This aggregate data does not identify you personally. CignifyAI and its sub-processors may also automatically collect certain information when you access or use the Site or Services ("Usage Information"), including:
Usage Information is collected via log files and tracking technologies including cookies, web beacons (tracking pixels), embedded scripts, and device recognition technologies. Some of this information may be used to associate devices you use and deliver relevant content. We do not recognize browser "Do Not Track" signals.
As a Shopify app, CignifyAI accesses certain data via Shopify's APIs on behalf of merchants who install the app. This may include:
This data is accessed solely to provide attribution, analytics, and reporting Services to the installing merchant. Merchants are responsible for ensuring that their customers have received appropriate notice of this processing under applicable law.
Our Services help DTC merchants run and measure multi-channel campaigns across search, display, and social platforms. To provide these Services, we deploy our Spark Pixel℠ and similar server-side tracking technologies on behalf of our merchant customers. The following categories of data may be collected when these technologies are active:
We use the information we collect for the following purposes:
Consent for attribution and marketing analytics. Because CignifyAI provides attribution and marketing analytics services, we may process data about merchant customers' interactions with ads, content, and purchase flows. Where required by applicable law, merchants are responsible for obtaining appropriate consent from their customers before deploying the Spark Pixel℠ or sharing customer data with CignifyAI through Shopify's APIs. Merchants should review their own privacy policies and consent mechanisms to ensure compliance with applicable marketing and privacy laws.
We use your Merchant Data — including order history, pixel events, click IDs, and UTM parameters — to train models and generate analytics outputs returned exclusively to your account. This includes attribution models, customer lifetime value curves, RFM segments, and predictive insights. This processing is fundamental to how the Services work.
We use anonymized, aggregated data derived from across our merchant base to train and improve shared foundational models — for example, to improve general attribution accuracy, anomaly detection, and AI-generated insights. Before any data is used for this purpose, we apply an anonymization process that removes all direct and indirect identifiers at both the merchant and end-consumer level, such that the resulting dataset cannot reasonably be used to identify any individual merchant or their customers.
This anonymized data is retained indefinitely for model improvement purposes as described in Section N. No individual merchant's identifiable data is exposed to other customers or third parties as a result of this process.
We collect and use operational metadata generated by your use of the platform — such as feature usage patterns, dashboard interactions, and API call volumes — to improve the performance and reliability of our Services and to guide product development. This metadata does not include the underlying content of your Merchant Data.
Certain features, including AI-generated executive summaries and natural language insights, may be powered by third-party large language model providers such as Anthropic, Google, or OpenAI. Data sent to such providers is processed under their applicable data processing agreements. CignifyAI does not permit these providers to train their foundation models on your identifiable Merchant Data.
We may disclose Personal Data to third-party companies that perform services on our behalf, but only to the extent needed for them to provide those services. These include data storage and hosting providers, CRM services, cloud application providers, and disaster recovery services. All such providers are required to maintain at least the same level of privacy protection as described in this policy. We transfer Google user data to third parties only for the purpose of providing or improving our application's functionality.
When processing data on behalf of merchants — including data collected via the Spark Pixel℠ or Shopify's APIs — CignifyAI acts as a data processor operating under the merchant's instructions. Merchants, as data controllers, are responsible for ensuring that their end-consumers have received appropriate notice and, where required, have provided consent for such processing. CignifyAI maintains a Data Processing Agreement (DPA) available upon request for merchants with applicable compliance requirements. To request a DPA, contact us at [email protected].
We may disclose Personal Data to our affiliates to support the marketing, sale, and delivery of our Services, including between affiliate, subsidiary, and parent organizations of CignifyAI.
CignifyAI may share your Personal Data in connection with a financing, merger, acquisition, joint venture, or sale of all or a portion of our assets or business. We do not sell Google user data to third parties.
We may share your Personal Data to comply with applicable law, law enforcement requests, court orders, or subpoenas, or where otherwise required or permitted by law.
Our Site may include links to websites, platforms, or services operated by third parties ("Third-Party Services"). These services may collect information about you independently using their own cookies and tracking technologies.
Certain features on the Site may allow interactions between the Site and Third-Party Services such as social networks. If you post content referencing CignifyAI on a third-party platform, that content may be used by CignifyAI in connection with the Site or Services.
We may use Google Analytics or similar sub-processors for analytics. These services may collect your IP address and other Usage Information. CignifyAI is not responsible for the privacy practices of any third-party services. We encourage you to review their privacy policies independently.
Depending on your jurisdiction, you may have certain rights regarding your Personal Data. Subject to applicable exceptions, you may ask us to:
To submit a request, email us at [email protected]. We may ask you to verify your identity before processing your request. If we decline your request, we will explain why, subject to legal restrictions. You may also submit a complaint to the data protection regulator in your jurisdiction.
For data processed in connection with our Shopify integration, we honor customer data access requests, customer data deletion requests, and shop redaction requests received via Shopify's mandatory privacy webhooks. We process these requests within 30 days of receipt. Merchants whose customers submit such requests via Shopify's platform do not need to contact us separately — these are handled automatically through our webhook integration.
Our processing of your Personal Data is carried out under the following legal bases:
Neither the Site nor the Services are directed to anyone under the age of 13. We do not knowingly collect Personal Data from anyone under 13. If you are under 13, please do not provide us with any Personal Data. If we learn that we have collected Personal Data from a child under 13 without parental consent, we will delete it promptly. If you believe we have collected such information, please contact us at [email protected].
We take the security of Personal Data seriously. We implement reasonable and appropriate technical and organizational security measures to protect Personal Data from loss, misuse, unauthorized access, disclosure, alteration, and destruction. These measures are designed to be appropriate to the risks involved in processing and the nature of the data, and to comply with applicable laws and regulations.
While we work hard to protect your data, no security measures are perfect. We encourage you to use strong passwords and to be cautious about the information you share online.
You may opt out of marketing emails at any time by following the unsubscribe instructions in each promotional email, or by updating your preferences in your account settings. Please note that even after opting out of marketing communications, we may continue to send you administrative emails related to your account and the Services.
Under California's Shine the Light law (California Civil Code Section 1798.83), California residents may request information about the types of Personal Data we have shared with third parties for direct marketing purposes during the preceding calendar year, including the names and addresses of those third parties and examples of the types of services or products marketed by them.
We are required to respond to one such request per individual per calendar year. To submit a request, contact us at [email protected].
If you are a California resident, you may also have rights under the California Consumer Privacy Act (CCPA), including the right to know, the right to delete, and the right to opt out of the sale of your Personal Data. We do not sell Personal Data. To exercise your rights, contact us at [email protected].
If you are located outside of the United States, please be aware that information you provide to us — including Personal Data — will be transferred to and processed in the United States, where our primary servers are located. These jurisdictions may not offer the same level of data protection as your country of residence. Our collection, storage, and use of your Personal Data will continue to be governed by this Privacy Policy regardless of where it is processed.
Where required by applicable law, such as the GDPR, we ensure that international transfers of Personal Data are made with appropriate safeguards in place, such as standard contractual clauses. For more information about our transfer mechanisms, or to request a copy of applicable safeguards, contact us at [email protected].
We retain different categories of data for different periods depending on the nature of the data and the purposes for which it is processed.
| Data Category | Retention Period |
|---|---|
| Merchant account and contact data | Duration of active subscription + 36 months, then deleted or anonymized |
| Pixel event and Shopify API data (raw, identifiable) | Rolling 24-month window; deleted or anonymized within 90 days of account termination or deletion request |
| Attribution reports and analytics outputs | Duration of active subscription + 12 months |
| Anonymized and aggregated ML training data | Indefinite — no longer personal data once anonymized |
| Trained model artifacts (weights, embeddings) | Indefinite — not personal data |
| Backup copies | Up to 90 days after deletion of primary copy |
To enable continuous improvement of our attribution models and AI features, we derive anonymized, aggregated datasets from merchant data. This process removes all direct and indirect identifiers at both the merchant and end-consumer level — including shop domain, merchant ID, customer email, and pseudonymous identifiers such as sp_id. The resulting data is aggregated across multiple merchants such that no individual merchant's data is distinguishable.
Once anonymized in accordance with applicable law, this data is no longer considered personal data under GDPR, CCPA, or similar frameworks, and is retained indefinitely to improve the accuracy and performance of our platform. Trained model weights and mathematical artifacts derived from this anonymized data are similarly retained indefinitely, as they do not constitute personal data.
Merchants may request deletion of their raw data at any time by contacting us at [email protected] or by uninstalling the app (which triggers our Shopify redaction webhook). Deletion of raw identifiable data will be completed within 90 days of receipt of a valid request. Anonymized derivatives that have already been incorporated into aggregated training datasets cannot be selectively reversed, as they no longer contain identifiable information.
This Privacy Policy is effective as of the date stated at the top of this page. We may update it from time to time and will post any changes on our Site as soon as they go into effect. By continuing to use our Site or Services after changes are posted, you are deemed to have accepted the updated policy. We encourage you to review this page periodically.
We're a founder-led tech company and we're happy to answer any questions about this Privacy Policy or how we handle your data. Just reach out — we respond within a couple of business days.
CignifyAI, Inc.
[email protected]
Sammamish, WA, USA