Privacy Policy

This policy explains what personal information Zyro collects, why we collect it, who we share it with, and the choices you have. Zyro runs the website zyro.world, the Zyro app for Shopify, and a tracking script that businesses can add to their own websites. In this policy, Zyro, we and us mean Zyro AI, ABN 66 670 726 691, Suite 1208/530 Little Collins Street, Melbourne VIC 3000.

Questions or requests: email hello@zyro.world.

1. Summary

• We collect account details from our customers, information about visitors to zyro.world, and, on behalf of our customers, information about the shoppers who visit their stores.
• For a store's shoppers, the store is in charge of that data. We handle it on the store's instructions.
• We do not sell personal information.
• On zyro.world, visitors in the EU, EEA, UK and Switzerland get analytics and marketing tools only if they agree. Elsewhere they are on until you turn them off, and marketing stays off if your browser sends Global Privacy Control. Change it any time with "Cookie settings" at the bottom of every page.
• Other companies help us run Zyro, such as Amazon Web Services for hosting. They are listed on our Sub-processors page.
• Our servers are in the United States.
• You can ask to see, correct or delete your information by emailing hello@zyro.world.

2. Who we are and our two roles

Zyro handles personal information in two different roles.

• Zyro as a controller. We decide how and why we use information about our customers (the businesses that sign up for Zyro), the people who use their accounts, visitors to zyro.world, people who contact us, and business contacts we research for sales. Section 3 covers this.
• Zyro as a processor (service provider). When a business (a "merchant") adds the Zyro tracker to its website or installs the Zyro app on its Shopify store, we collect information about its shoppers for that merchant. The merchant is the controller. The merchant's own privacy policy applies to its shoppers, and our Data Processing Addendum sets out how we handle that data. Section 4 explains what we collect in this role so that merchants and shoppers can see it.

If you are a shopper and want to use your privacy rights, please contact the store first. If you contact us, we will pass your request to the store or help the store answer it.

3. Information we collect for ourselves

3.1 Your account

• Your name and email address.
• Your password. We store only a salted one-way hash of it, never the password itself.
• If you sign in with Google, Google gives us your name and verified email address. If you sign in with Microsoft, where that option is shown, Microsoft gives us your name, email address and an account identifier.
• Your business and website details, such as the business name, website address and the platform it runs on.
• What you set up and create in Zyro: tests, offers and pop-ups, goals, product costs, notes and settings.
• Contact details you add for store alerts, such as an alert email address or phone number.
• Security records, such as failed sign-in attempts and account lockouts.

3.2 Billing

• If you pay us directly, you pay on Stripe's checkout and billing pages. You type your card details into Stripe. They never reach our servers. We give Stripe your name and email address, and Stripe tells us your customer ID, plan and subscription status.
• If you use Zyro through Shopify, Shopify bills you. Shopify tells us your plan and subscription status.

3.3 Accounts you connect

When you connect another service to Zyro, you let us access data from it. We store the access tokens and API keys encrypted. Depending on what you connect, we receive:

• Shopify: store and order data, described in section 4.2.
• Shopify reports: If you allow it, Zyro reads totals from Shopify's reports once a day (sales, cost of goods, profit at delivery, shipping and duties per order) to show them beside Zyro's numbers. These are store totals. Nothing about any shopper is read or kept. Shopify requires Protected Customer Data approval to open these reports to an app.
• Pop-up sign-ups in Shopify Customers: If you turn it on, when a shopper ticks yes on a Zyro pop-up we send their email address and that consent to your Shopify store. We keep the link between the sign-up and the Shopify customer id for 180 days, with no email, and it is erased with the sign-up.
• Chargebacks and Shopify Protect: for each order, whether it has a dispute, the dispute's type and status, and its Shopify Protect status. If you allow it, also the amount, reason and deadline. We read no evidence, and keep no shopper name, email, phone or address with any of this.
• Shopify Payments payouts: If you allow it, Zyro reads the totals of your Shopify Payments payouts (amounts, fees and dates) to check them against your sales. It does not read bank account details.
• What you add to your ledger: past costs, late bills, and charges you dispute, with any note you type. These are your own business records. They are deleted with your store's data.
• Shopify notes, report fields and Sidekick: If you turn them on, Zyro writes short notes (no shopper details) onto your Shopify Analytics charts and three band words (no numbers) onto your products in Shopify. If you ask Shopify Sidekick about Zyro, Zyro sends Shopify that answer: store totals, alerts, test results and the order numbers of late parcels, never shopper names, emails, phones or addresses.
• Meta (Facebook and Instagram): your Facebook user ID and name, the IDs of your ad accounts, your ad text and images, and your ad spend. We use these to compare your ads with your landing pages and report ad spend. Zyro asks Meta only for your public profile and read access to your ads.
• Google: your email address and the sites and accounts you give us access to in Search Console, Google Ads and Google Analytics. From Search Console we read daily search clicks, impressions and positions for your store's site (up to 16 months). From Google Analytics 4, only if you turn it on, we read daily totals for the property you pick (sessions, users, engaged sessions, key events, purchases and purchase revenue, by channel and by AI assistant source). We read no data about individual visitors.
• Microsoft Clarity: the API token you give us. We read counts per page of rage clicks, dead clicks, quick backs and script errors for the last 3 days. Clarity sends us no data about individual shoppers.
• TikTok, Microsoft Advertising, Pinterest, Snapchat, Reddit, AppLovin Axon and Taboola (ad spend): the IDs and names of your ad accounts and their daily spend, read only, so Profit can take your real ad spend off. For Axon and Taboola we keep the key or credentials you give us, stored encrypted.
• MNTN and Vibe (ad spend): the API key you give us (stored encrypted). We read your daily ad spend, ad account name, ID and currency, read only. No shopper data goes to or comes from them.
• QuickBooks Online and Xero: your company name, your chart of accounts and your profit and loss report, read only, so Profit can use the fees and costs in your books. Disconnecting deletes everything we read from them.
• Gorgias and Zendesk: for each support ticket, its ID, when it was opened and closed, the channel, its tags or contact reason, and the order number it names, read only, so the Shipping tab can show where-is-my-order tickets next to late parcels. Your helpdesk also sends the shopper's name and email with each ticket; we do not store them, and we never store the ticket's subject or messages. When a ticket has no tag or reason, we read its subject to sort it and keep only the category. Disconnecting deletes everything we read from them.
• Fairing and KnoCommerce: the API key or API client you give us. We read the answers to your "how did you hear about us" question and the order number each one belongs to, read only. We never keep the shopper's name, email, phone, customer ID or any words they typed. Disconnecting deletes the key and every answer we read.
• Slack and Microsoft Teams: the channel you pick (and, for the Zyro Slack app, your workspace's name). We post your alerts there (and your Morning Brief, for the Zyro Slack app) and read nothing from your workspace.
• ShipStation, Shippo, EasyPost, ShipHero, Easyship, ShippingEasy, Starshipit and Zonos: the API key you give us. We read your labels' cost, tracking number, order number, delivery status and destination country, read only, so Profit can use your real shipping costs. From Easyship we also read the import duty, import tax and insurance charged on a shipment. We never read the address on a label.
• AfterShip, 17TRACK and Ship24 (tracking apps): the API key you give us (stored encrypted). We read the tracking number, carrier, the parcel's status in the tool's own words, the status date and the destination country of parcels you already track there, read only, so Shipping, Customs and Watchdog can show parcels held at customs, refused or sent back. We keep only parcels that match one of your orders. We never read a shopper's name, address, email or phone, and never add or change a tracking. Disconnecting deletes everything we read from that tool.
• Public tariff sources (USITC, US Federal Register, US CBP): we read public US government tariff and customs notices once a day for Zyro as a whole. No store or shopper data is sent to them.
• Loop, AfterShip Returns, Redo and ReturnGO: the API key you give us (and your Redo store ID). We read each return's order number, products and quantities, the reason from your own list of return reasons, whether it ended as a refund, an exchange or store credit, what the return label cost and who paid for it, its carrier and tracking number, its dates and the shopper's country, read only, so Profit and Shipping can show why things come back and what returns cost. We never read the shopper's name, email address, phone number, address or the comments they type. Disconnecting deletes everything we read from them.
• UpPromote, Impact.com, Awin, Refersion and GoAffPro (affiliate apps): the API key, token or OAuth client you give us (stored encrypted), and the account, advertiser or program ID the app needs. We read each commission's order number, the app's ID for the affiliate, the discount code, the status, the amounts and currency, its dates and, from Awin, the shopper's country, read only, so Profit can take off what you pay affiliates and show what each affiliate's orders kept. We never read an affiliate's or a shopper's name, email address, phone number, address or IP address. Disconnecting deletes the key and every commission we read from that app; commissions are kept 400 days.
• CJ Affiliate, Partnerize, Ascend, Everflow and GRIN (affiliate apps): the API key or token you give us (stored encrypted), and the company, application or campaign ID the app needs. We read each commission's order reference, the app's ID for the affiliate, the discount code, the status, the amounts and currency, its dates and, where the app gives it, the shopper's country, read only. We never read affiliate or shopper names or emails.
• LoyaltyLion: the API key you give us (stored encrypted). We read which rewards were claimed, their type, their value and the date, and keep only a total per day. We do not keep the shopper, their email or any code.
• Aspire: the API key and client ID you give us (stored encrypted). We read what you paid creators and keep only a total per month. We never read creator names, handles or emails.
• Judge.me, Loox, Okendo and Yotpo (reviews apps): the API key, token or secret you give us (stored encrypted) and the store or user ID the app needs. Once a day we read each review's star rating, date, product, published state and, when the app gives it, its order. We read the review text once to set three yes or no flags (mentions of late delivery, damage or customs), then discard it. From Judge.me we also read the reviewer's Shopify customer ID to find their order, then discard it. We never store a reviewer's name, email address, phone number, address, IP address or the review text. Disconnecting deletes the key and every review we read from that app; reviews are otherwise kept 400 days.
• Skio, Loop Subscriptions, Appstle, Smartrr and Stay.ai (subscription apps): the API key you give us (stored encrypted). We read each subscription's status, amount, currency, billing interval and dates, the Shopify ID of the order that started it, and whether a renewal failed, read only, so you can see MRR, churn, failed renewals and what subscribers keep you. We turn the shopper's Shopify customer ID into a one-way code the moment we read it, so we can tie a subscription to orders we already hold. Cancel reasons and payment errors are sorted into one word from a fixed list as they are read, and the original text is not kept. We never keep a subscriber's name, email address, phone number, address or payment details. Disconnecting deletes the key and everything we read from that app; cancelled subscriptions and failed renewals are kept 400 days.
• ShipBob and 3PL invoices: your ShipBob sign-in (stored encrypted), or the invoice file you import. We read your fulfilment fees (postage, pick and pack, packaging, storage, receiving and returns), order numbers, ShipBob shipment numbers, tracking numbers, parcel status and the destination country, read only, so Profit and Shipping can use what each order really cost. We never read a shopper's name, email, phone or address. Disconnecting ShipBob deletes everything we read from it; an imported invoice stays until you undo it.
• Cin7 Core, Katana, Inventory Planner, Printful and Printify (inventory apps): the API key and account ID you give us (stored encrypted). We read each product's SKU and cost, read only, so Profit uses your real product cost. We read nothing about your shoppers. Disconnecting deletes the key and every cost we read from the app. From Printful and Printify we read the SKU, quantity and price of the items in your orders, never the shopper's name or address.
• Amazon settlement files: the file you bring in. We keep totals per day and SKU (sales, refunds, fees and units) and the settlement ID and dates. We do not keep order numbers, and the file holds no buyer names or addresses. You can undo a settlement at any time, and we delete these rows after 400 days.
• TikTok Shop, Walmart and eBay files: the file you bring in. We keep totals per day and SKU and the file's dates. We do not keep order numbers or buyer details. You can undo a file at any time, and we delete these rows after 400 days.
• Afterpay, Klarna, Zip and PayPal fee files: the file you bring in. We read the order number, the transaction ID, the fee, the date and the currency, so Profit can use the real fee on each order. We never read a shopper's name, email or address; a PayPal activity file has them, and we skip those columns. An imported file stays until you undo it, and fee lines are kept 400 days.
• Your own Stripe account: your charges, so we can show which channels brought in revenue. We use the buyer's email address on a charge to match it to a visit. We do not store that email with the charge.
• Google Sheets, BigQuery and Snowflake: the access you give us (stored encrypted). We send store totals by day, and for Google Sheets we read the costs you type. We send no shopper data. For Google Sheets we can only reach the sheet Zyro made. Disconnecting deletes the key and the costs we read.
• BigCommerce: the token you give us (stored encrypted). We read your orders as we do for WooCommerce. We keep only a hash of the buyer, and no name, address or phone.
• Sendlane and HubSpot: the keys you give us (stored encrypted). When a shopper ticks yes on a pop-up, we pass their email to the tool you picked. We do not keep it for this.
• Email and SMS marketing tools (such as Klaviyo, Mailchimp or Omnisend): the API key you give us, or your Klaviyo sign-in, stored encrypted (for pop-up sign-ups into an ActiveCampaign list, also its API address and API key). From Klaviyo and Omnisend, if you use them with Zyro, we read the revenue each says your emails and texts brought in (by email and SMS, and by campaigns and flows) for the last 7, 30 and 90 days, and what your texts cost, read only. From Klaviyo we also read, once a month, the size of your most recently changed lists and how many people received, opened or clicked an email each month. These are counts. We read no contacts. If you type your Klaviyo plan into Zyro, we keep it to work out your bill figure. We read no data about individual shoppers. Section 4.3 explains what we send to them.

Disconnecting a service deletes the stored access token and stops new data. Data we already imported stays until you ask us to delete it.

When a shopper signs up on a Zyro pop-up, Zyro notes how long the form was open, whether a real tap or key was used, and whether the browser says it is automated, to spot bots. These notes stay with the sign-up and are not sent to any other tool.

3.4 Google user data

Zyro's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We do not request restricted scopes such as Gmail.
• We use Google Analytics data (scope analytics.readonly, read only) only to show your GA4 history and to compare GA4 with your orders. We request it only when you turn on GA4 in Zyro, and we never ask for edit access.
• We use data from Google APIs only to provide the features you see in Zyro.
• We do not use Google user data to develop, improve or train general AI or machine learning models.
• We do not sell Google user data, and we do not use it for advertising.

3.5 When you contact us

Our contact form asks for your name, email address, website, monthly ad spend range and a message. We also record your IP address. The form is sent to our inbox by email. If you email us, we keep the email and your contact details so we can reply.

3.6 Visitors to zyro.world

• Server logs. Like most websites, our servers record your IP address, browser, the page you asked for and the time. We use this to keep the site secure and to fix errors.
• Essential cookies. These keep you signed in, protect forms and remember your cookie choice. See section 11.
• Analytics, only if you agree.
  • Google Analytics shows us which pages people visit. If you are signed in, it receives a hashed version of your user ID and your plan type, never your name or email address.
  • Contentsquare records how visitors move, click and scroll on our public pages, so we can see where pages confuse people. It does not run on signed-in app pages.
  • Our own Zyro tracker, the same script our customers use (section 4.1). Like on their sites, it can record an email address you type into an email field on our site, such as the sign-up form, and link it to your visits.
• Marketing, only if you agree.
  • The Meta Pixel and the Google Ads tag measure how our ads perform. If you are signed in, the Meta Pixel receives your email address, which the pixel hashes in your browser before sending, and your Zyro user ID.
  • For sign-ups and some account events, our server can send the same event to Meta (the Conversions API) with a hash of your email address, a hash of your user ID, your IP address, browser details, Meta's cookie IDs and the page address.
  • The Trustpilot widget shows our reviews. It loads from Trustpilot, which receives your IP address and browser details.
• Fonts and icons. Our pages load fonts and icons from Google Fonts, cdnjs (Cloudflare) and jsDelivr. These services receive your IP address and browser details, as happens with any request to a website.
• Sign in with Google. Our login page loads Google's sign-in script so you can choose to sign in with Google.

3.7 Business contacts for sales

To find businesses that may want Zyro, we may collect business information that is published on the internet: the business name, website, city, the technology the website uses, and published contact details such as email addresses, phone numbers and the names shown on the website. Our sources are public websites and Google search and Google Maps results. To check whether an email address is likely to be in use, we may send a one-way hash of it to Gravatar. We may email these contacts about Zyro. Every marketing email from us has an unsubscribe link.

4. Information we process for merchants

This section describes the data Zyro collects about shoppers when a merchant uses Zyro on its store or website. We collect it for that merchant and use it to provide Zyro to that merchant.

4.1 The Zyro tracker

The tracker is a script the merchant adds to its website, or turns on as the Zyro app embed in a Shopify theme. It collects:

• A visitor ID. A random ID stored in a first-party cookie called _zyro_vid on the merchant's website, kept for 1 year. The tracker also stores small values in the browser, with names starting zyro_, such as which test version a visitor sees and when a pop-up was last shown. We do not use device fingerprinting.
• Page views. The full page address (including any campaign tags and ad click IDs in it, such as UTM tags), the page title, the referring page, the browser's user agent, mobile or desktop, and the time.
• IP address. We store the full IP address with page views. We use it to work out the visitor's country with a MaxMind database that runs on our own servers. We do not send IP addresses to MaxMind. We remove the full IP address after 90 days; the country stays.
• Clicks, scrolling and movement. Where people click (position, element type, ID and class), how far they scroll, samples of mouse movement on desktop, and how long parts of the page are in view. These power heatmaps. We do not record sessions as video.
• Signs of frustration. Repeated clicks on the same spot and clicks that do nothing, with up to 50 characters of the clicked element's text.
• Form and search signals. Which form fields were used or left unfinished (field name and type), terms typed into the site's search box, text a visitor copies (up to 100 characters), error messages shown on the page and JavaScript errors.
• Email addresses. When a visitor types into a field that looks like an email field, the tracker sends that email address to us when the visitor leaves the field. This lets the merchant connect visits to a known customer.
• Pop-up forms. If a merchant runs a Zyro pop-up that asks for an email address or phone number, we store what the visitor enters and whether they ticked any marketing consent box.
• Shopping activity. Product views, add to cart, cart opens, checkout clicks and purchase amounts.
• Ad browser IDs. Where the shopper allowed ad tools, the store's Meta (_fbp) and TikTok (_ttp) browser IDs, used only for that platform's server-side events.
• Events from the store's other tags. When the store's other tags (for example Google, Meta, TikTok or Klaviyo) record an event on the page, the tracker keeps a copy of that event. The copy contains whatever the store put in the event.
• Page content. About once a day per page, the tracker saves the page's headings, text, links, images and metadata. We use this to understand the site and to suggest tests. If a page shows personal details, that text can be included.
• Tests and offers. Which test version or offer a visitor saw, and whether they went on to convert.

From this activity we work out an intent score: how likely a visitor seems to buy. Merchants can use it to target offers and, if they choose, send it to their own marketing tools.

Consent. On Shopify stores, the tracker reads the shopper's choice from Shopify's Customer Privacy API and stops sending activity events if the shopper declines analytics. On other websites, the merchant decides when the tracker loads and is responsible for getting any consent the law requires.

4.2 The Zyro app for Shopify

• Permissions. At install the app asks for read_orders, read_all_orders, read_customer_events and write_pixels. It asks for read_products, read_inventory, read_discounts, write_discounts, read_shipping, read_markets, read_themes, write_products, write_inventory, read_returns, read_shopify_payments_disputes, read_shopify_payments_payouts, read_shopify_payments_accounts, read_reports, write_customers or write_analytics_annotations only when the merchant turns on a feature that needs them. The app does not request access to Shopify customer records, unless the merchant turns on pop-up sign-ups in Shopify Customers. Then it asks for write_customers, adds or updates only the people who ticked yes on a Zyro pop-up, and reads only each customer's id and email marketing status. It also then reads the customer id on orders, to tell repeat orders apart. It never reads a customer's name, email, phone or address from Shopify.
• Changes in the store. We change the store only for features the merchant turns on: the version of a product the merchant keeps after a test, a customs code or country of origin the merchant saves to a product, Zyro's margin, returns and AI-ready labels on products (no margin numbers), Zyro's notes on Shopify's charts, and pop-up sign-ups added to Shopify Customers with their marketing consent, when the merchant turns that on.
• Orders. When the app is installed we copy orders from the last 60 days. We then copy older orders, up to the limit of the merchant's plan (at most 24 months), and keep copying new and updated orders about every 15 minutes. We store order numbers and dates, totals, taxes, discounts, currency, the order's language setting, sales channel, payment and fulfilment status, line items (product, variant, SKU, quantity and price), refunds and shipping carriers. We do not request customer names, email addresses, phone numbers or addresses from Shopify. For profit by sales channel and real payment fees we also store the app that created each order, the payment providers it used, each successful payment and refund (provider, amount, date and the fee Shopify records), the PayPal transaction ID for PayPal payments only, and the store's Shopify plan. We read order tags only to spot a sales channel such as Buy with Prime, and never store them. These are kept 400 days.
• Repeat buyers. We store a one-way hashed key made from Shopify's customer ID so we can count repeat purchases.
• Paid orders. Shopify tells us when an order is paid. We store the order ID and total.
• The Zyro Web Pixel. Shopify runs this pixel in its own sandbox, and only under the store's customer privacy settings. It sends us Shopify's anonymous client ID, product and checkout events, order values, checkout tokens and search terms, and links them to the visitor ID from section 4.1.
• Store details. The shop name, shop email address, time zone, country and domains.
• Discount codes. If the merchant turns on smart coupons, we create one-time discount codes in the store.
• Theme and script changes. If the merchant allows it, we read the live theme once a day: its ID and name, when it was last saved, a checksum of its main layout and settings files, and which app embeds are on. Script tags come from a check we already make once a week. We keep these as a dated list for 90 days, with the number of checkouts started and paid each day. None of this holds shopper data.
• Returns. If the merchant allows it, we read the store's returns from the last 60 days: the order, the products and quantities returned, Shopify's return reason, the outcome, return fees and the return parcel's carrier and tracking number. We never read the notes a shopper types on a return.
• Zyro's Thank you page question. If the merchant adds it, we keep the answer the shopper picked and, only when the shopper allowed analytics, the order number. No name, email or typed text.

4.3 Sending data to the merchant's own tools

A merchant can connect its own marketing tools. When it does, Zyro sends shopper activity to those accounts on the merchant's instructions:

• Email and SMS tools (Klaviyo, Omnisend, Postscript, Attentive, Customer.io, Braze, Brevo, Drip, ActiveCampaign, Iterable, Mailchimp and Sendlane): the shopper's email address with the event name and details, such as the page, product, intent score, coupon code or offer.
• Pop-up sign-ups into the merchant's list (Klaviyo, Mailchimp, Omnisend, Brevo, Iterable, Braze, Customer.io, Drip, ActiveCampaign, Sendlane and HubSpot), only when the merchant picks a list and only for a shopper who ticked yes to marketing on a Zyro pop-up: the shopper's email address and that they agreed to marketing, so the tool adds them to that list. A list that asks people to confirm sends its own confirmation email. Zyro keeps the result and a one-way code of the email address, never a second copy of the address, and deletes them after 90 days, or within a day when the sign-up is erased.
• Meta Conversions API on the merchant's own Meta Pixel: a hash of the shopper's email address and of the visitor ID, the shopper's IP address and browser details, Meta's browser ID (the _fbp cookie) and Meta's click ID when the visit came from a Meta ad, with the event details, including the page address, and the store's domain. Where the store's banner asks, only for shoppers who said yes to marketing.
• Meta Custom Audiences, only when the merchant turns a group on: the hashed email addresses of shoppers in its "Ready to buy" or "Slipping away" group who allowed marketing, sent to the merchant's own Meta ad account. Each sync replaces the whole list, so a shopper who says no, buys or is erased leaves it at the next sync. Zyro keeps no copy of the list.
• TikTok Events API on the merchant's own TikTok pixel: a hash of the shopper's email address and of the visitor ID, the shopper's IP address and browser details, and TikTok's browser ID (the _ttp cookie) and click ID when present, with the event details and the page address. The same consent rules as Meta.
• Pinterest, Snapchat and Reddit Conversions APIs on the merchant's own accounts: a hash of the shopper's email address and of the visitor ID, the shopper's IP address (hashed for Reddit) and browser details, and that platform's own click ID when the visit came from its ad, with the event details and the page address (or the store's address when the page isn't known). The same consent rules as Meta.
• ChatGPT Ads Conversions API (OpenAI, labelled Beta) on the merchant's own ChatGPT Ads pixel: a hash of the shopper's email address and of the visitor ID, the shopper's IP address and browser details, and ChatGPT's ad click reference when the visit came from a ChatGPT ad, with the event details and the page address. The same consent rules as Meta.
• Segment, and Zapier or Make webhooks: the event details, a one-way ID made from the visitor ID, and the shopper's email address when Zyro has it. The same consent rules as Meta, because these tools can pass data on.
• Google Analytics 4 (Measurement Protocol), only when the merchant adds its own Measurement ID: pop-up sign-ups and, if the merchant chooses, sales with the order number and value, sent from Zyro's server under a one-way ID made from the store and the visitor. No email address, name, phone number or Zyro visitor ID is in these events, and none are sent for a shopper who said no to analytics or marketing.
• Tags already on the store: the tracker can pass Zyro events and intent groups to the store's own Google, Meta, TikTok, Klaviyo, HubSpot and Google Tag Manager tags in the browser.
• Test tools already on the store (Hotjar, Microsoft Clarity, Heatmap.com, Amplitude, Heap, Mixpanel and Klaviyo), only for the tools the merchant turns on: the tracker tells the tool on the page which test and version the shopper saw, in the shopper's browser. It sends the test name and version name only, never a visitor ID or email address, and nothing when the shopper has refused analytics. Klaviyo gets this as a property on the profile of a shopper it already knows, and only when the shopper allowed marketing. Each tool links this to its own visitor ID under the merchant's account with that tool.

These are the merchant's accounts, and the merchant decides what to connect. Their own terms and privacy policies apply.

4.4 AI features

To write test copy and suggest tests, we send page text from section 4.1, page addresses, element text with click counts, and ad text from a connected Meta account to Anthropic. We do not deliberately send shopper names, email addresses or visitor IDs to AI providers. We do not use merchant or shopper data to train AI models.

4.5 What merchants are responsible for

The merchant decides to use Zyro on its store. It must tell its shoppers about Zyro in its own privacy policy, get any consent the law requires, and handle its shoppers' requests. Our Data Processing Addendum covers our duties as the merchant's processor.

5. How we use information and our legal bases

Where the GDPR or UK GDPR applies, we need a legal basis for each use. This list shows each use and the basis we rely on.

• Providing Zyro: running your account, the dashboards, tests, offers, reports, alerts and support. Basis: performance of our contract with you.
• Billing: processing payments and managing your plan. Basis: contract, and legal obligations such as tax records.
• Account and service emails: security notices, billing notices, test results and store alerts. Basis: contract.
• Marketing emails: product news, tips and summaries. Basis: our legitimate interest in telling customers and business contacts about Zyro, or your consent where the law requires it. You can unsubscribe at any time.
• Keeping Zyro secure: server logs, rate limits, bot filtering and sign-in protection. Basis: legitimate interests in protecting our service and our customers.
• Improving Zyro: understanding how the product is used. Basis: legitimate interests.
• Website analytics and ad measurement on zyro.world: Basis: your consent, given in our cookie banner, in the EU, the EEA, the UK and Switzerland; elsewhere, our legitimate interest in understanding and promoting our service, which you can switch off in the banner at any time.
• Sales research (section 3.7): Basis: legitimate interests in finding businesses that may benefit from Zyro.
• Legal duties: responding to lawful requests and keeping required records. Basis: legal obligation.
• Shopper data we process for merchants: we act on the merchant's instructions. The merchant chooses the legal basis.

6. Who we share information with

• Sub-processors. Companies that help us run Zyro, such as hosting, email delivery, payments and AI. Our Sub-processors page lists each one, what it does, what data it handles and where.
• Services you connect. When you connect a service, we exchange data with it as described in sections 3.3 and 4.3.
• The merchant. Shopper data collected on a merchant's store is shown to that merchant in Zyro, and the merchant can export it.
• Professional advisers, such as lawyers and accountants, when we need their advice.
• Authorities, when the law requires it or to protect people's safety or our rights.
• A buyer of our business, if Zyro is sold or merged. This policy would continue to protect your information.

We do not sell personal information. We do not give one merchant's data to another merchant.

7. Where your information goes

Zyro is based in Australia, but our servers run on Amazon Web Services in the United States (US East). Information you give us, and information the tracker collects, is stored there. Some of our providers process information in other countries, mainly the United States and the European Union. The Sub-processors page shows the location of each one.

When we transfer personal information out of the EEA, the UK or Switzerland, we rely on the safeguards in our providers' data processing terms, such as the Standard Contractual Clauses. When we send personal information outside Australia, we take reasonable steps to make sure the recipient protects it in line with the Australian Privacy Principles.

8. How long we keep information

• Accounts: we keep your account information while your account is open. When you ask us to close your account, we delete or de-identify your information, except records we must keep by law, such as billing records for tax. If an email to you bounced or you reported it as spam, we keep your address on a do-not-email list, even after your account closes.
• Tracker and store data: we keep the detail of each visit (page views, clicks, scrolling, mouse movement and time on page) for 90 days. For shoppers who bought or converted in the last 180 days, we keep their page views, clicks and visits for 180 days, so the merchant can see which channel brought each sale. After that we keep only daily totals per store, page, source, country and device, with no visitor IDs or IP addresses. Orders, sales and test results are kept until the merchant deletes them, an erasure request removes them, or the merchant leaves. We remove the full IP address after 90 days; the country stays. Some plans show a data history window. That window is not a deletion schedule.
• One shopper: in the Zyro app for Shopify, and on the Visitors page for other sites (where the merchant can also erase by the shopper's email address), a merchant can use "Erase this shopper" on a shopper's page. This deletes the shopper's activity history, email and pop-up records, and removes the link between the shopper and their orders and test results. The order totals stay so the store's reports do not change. Information already sent to the merchant's own tools, such as Klaviyo or Meta, is not affected.
• Shopify privacy requests: when Shopify sends us a request to erase a shopper's data, we delete that shopper's activity history for that store (including IP addresses), their pop-up entries and email records, and remove the link between the shopper and their orders and test results. The order totals stay so the store's reports do not change. When Shopify sends us a customer data request, the store's account owner at Zyro is told the same day and we provide the data we hold about that shopper to the merchant within 30 days.
• When a merchant uninstalls the Shopify app: we stop processing for that store straight away. Shopify then sends us a request to erase the store's data, and we delete the store's tracking, test, offer, lead and attribution data.
• Emails and contact form messages: we keep these as long as we need them to help you and to keep a record of what was agreed.
• Sales research: we keep business contact details until they are no longer useful or the person asks us to stop contacting them.

9. Security

• Information travels between your browser and Zyro over HTTPS.
• Passwords are stored as salted one-way hashes (PBKDF2).
• Access tokens and API keys for connected services are encrypted at rest.
• Card details are handled by Stripe and never reach our servers.
• We use rate limits, bot filtering and sign-in lockouts to block abuse.

No system is completely secure. If a data breach is likely to cause serious harm, we will tell the people affected and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires, and we will tell any affected merchants without undue delay.

10. Your rights and choices

Depending on where you live, you can ask us to:

• give you a copy of the personal information we hold about you;
• correct information that is wrong or out of date;
• delete your information;
• limit how we use it, or object to how we use it, including for marketing;
• give you your information in a format you can take elsewhere; and
• withdraw your consent, where we rely on consent.

Email hello@zyro.world. We may need to confirm who you are before we act. We aim to reply within 30 days. There is no charge for a reasonable request.

Ask for my data Delete my data Data and privacy help

• Marketing emails: use the unsubscribe link in any marketing email. You will still get account and security emails while you have an account.
• Cookies on zyro.world: use "Cookie settings" at the bottom of any page.
• Shoppers: contact the store you shopped with. We will help the store answer your request.

If you are in the EEA or the UK, you can also complain to your local data protection authority.

11. Cookies and similar technologies

Cookies are small files a website stores in your browser. When you first visit zyro.world, a banner explains the cookies we use. In the EU, the EEA, the UK and Switzerland, analytics and marketing tools do not load until you say yes. Everywhere else they are on until you turn them off, and if your browser sends a Global Privacy Control signal, marketing cookies stay off. You can change your choice at any time.

Change cookie settings

Cookies on zyro.world

Swipe sideways to see every column.

When you withdraw consent for a category, we delete the cookies from that category that our own domain can reach and reload the page so those tools stop. You can also block or delete cookies in your browser settings. If you block essential cookies, you will not be able to sign in.

Cookies on merchants' websites

The Zyro tracker sets one cookie, _zyro_vid, on the merchant's own website and keeps it for 1 year. It also stores values starting zyro_ in the browser for tests and pop-ups (section 4.1). The merchant is responsible for asking its visitors for consent where the law requires it.

12. Australian privacy law

We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

• Anonymity: you can browse zyro.world without telling us who you are. To use the Zyro app, we need your name and email address.
• Overseas disclosure: we send personal information to providers located overseas, mainly in the United States and the European Union (section 7).
• Access and correction: you can ask to see and correct the personal information we hold about you (section 10).
• Complaints: please email hello@zyro.world first. We will look into it and reply within 30 days. If you are not happy with our answer, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

13. Children

Zyro is a service for businesses. It is not meant for children under 16, and we do not knowingly collect personal information from them for our own purposes. If you think a child has given us personal information, email us and we will delete it.

14. Changes to this policy

When we change this policy, we update the "Last updated" date at the top. If a change is significant, we will also tell customers by email or in the app before it takes effect.

15. Contact us

Email hello@zyro.world or use our contact page. Zyro is based in Melbourne, Victoria, Australia.