Privacy Policy

GemBoss builds, hosts and optimizes storefronts and funnels for Shopify merchants. This policy explains what we collect, why, how long we keep it, who processes it for us, and how to have it deleted.

For the personal data of a merchant's shoppers, the merchant decides why it is collected and GemBoss processes it on the merchant's behalf, under our Data Processing Addendum.

Who this covers

• Merchants: the people who sign up for GemBoss or install it on a Shopify store, and the team members they invite.
• Shoppers: the people who visit a storefront, funnel or page that GemBoss serves for a merchant.
• Website visitors: the people who read gemboss.ai.

What we collect from merchants

• Account details: name, work email, and a password (stored only as a hash) or your Google sign-in; the team members you invite and their roles.
• Store data Shopify lets us read through the permissions you grant: store name and domain, products, collections, inventory, themes and content, discounts and files.
• What you make in GemBoss: pages, funnels, tests, offers, settings, and your conversations with the assistant.
• Keys for the services you connect, such as Klaviyo, Meta or Google, stored encrypted.
• How signed-in users use the GemBoss admin: the screens they see and where they click, to make the admin easier to use. What they type, and screens that show shoppers' details or credentials, are hidden from these recordings; only GemBoss staff can watch them, and they are kept for 30 days.

What we collect about shoppers

• Storefront analytics. Page and section views, clicks, scroll depth, searches on the store, browser and operating system family, traffic source and campaign parameters, and add to cart, checkout and purchase events with their value. Each visit gets a random session id and visitor id, kept in the shopper's browser only once their privacy choice allows analytics. They are not linked to a name or email.
• Click and scroll maps. Where shoppers click and how far they scroll, recorded as counts per grid cell on a page, not as a trace of any one person. No IP address, no device fingerprint, no user agent.
• Session recordings of some visits. What the shopper saw on the store's pages, kept only when a visit shows a click that did nothing, repeated clicks, or a checkout starting. They run only when the shopper's privacy choice allows analytics, everything the shopper types is hidden, and cart, checkout, account and order pages are never recorded. The store's own team can watch them in GemBoss.
• Orders. To tell which page or test led to a sale, we read from Shopify: order id and token, totals and currency, time, line items, cart attributes, and Shopify's numeric customer id. We do not read the buyer's name, email, address or phone number from orders.
• Details a shopper chooses to give. When a shopper fills in a popup, quiz or form that a merchant built with GemBoss, we keep what they entered (email, phone number, first name, answers) and the consent they gave. The merchant sees these in GemBoss. If the merchant sets a popup up to do so, the signup is also added to the store's Shopify customers.
• IP addresses are used briefly to stop abuse of signup forms and are not stored.

What we do not collect

• Payment details. Checkout is Shopify's, and GemBoss never sees card data.
• Shoppers' postal addresses.
• Passwords for a merchant's other services.

How we use it

• To build, run, test and report on a merchant's storefront and funnels.
• To tell which pages, tests and offers led to sales.
• To choose which page or offer a shopper sees, from their visit and, when the merchant connects Klaviyo, from the Klaviyo profile signals the merchant already holds. These choices change what is shown, never prices owed, eligibility or anything with a legal effect.
• To provide support, keep the service secure, bill for it, and improve it.

We do not sell personal data, and we never share one merchant's data with another merchant.

AI assistants connected to GemBoss

• A merchant can connect an AI assistant, such as Claude or ChatGPT, to GemBoss through MCP. To connect, they sign in to GemBoss, or create an account, and choose which stores the assistant may reach; what it may do there follows their role in the store. The assistant receives a token for this, never the merchant's password.
• When the assistant uses a GemBoss tool, it sends the tool's name and its inputs, such as a page brief or a page id. GemBoss answers with what the tool returns, such as page content, products, analytics figures or a screenshot. The assistant's provider receives that answer under its own terms, and GemBoss does not control how the provider handles it.
• GemBoss does not read the merchant's conversation with the assistant. It sees only what the assistant sends in a tool call.
• Each call is recorded in the store's assistant history: the tool, its inputs and its answer, shortened to a few kilobytes each and without images, with the connection that made it and the name of the assistant's app.
• What an assistant changes is saved as a draft. Nothing goes live on the store until a person publishes it in GemBoss.
• A merchant can disconnect an assistant at any time in GemBoss Settings, under AI tools connected to this store. Its token then stops working.

Consent

• Storefront analytics and session recordings run only when the shopper's privacy choice, read through Shopify's Customer Privacy API or the store's consent banner, allows analytics.
• Marketing integrations wait for the shopper's marketing or ads choice: nothing is sent to Klaviyo, Meta or Google when the shopper has refused it.
• Popups and forms record the consent a shopper gives, such as a marketing checkbox.

Cookies and tracking

This part covers gemboss.ai itself, not the storefronts and pages GemBoss serves for merchants.

• Your choice. We keep your cookie choice and the date you made it in your browser's local storage, under the name gb-consent, for 12 months. It holds nothing else, and the site needs it to respect your choice.
• Analytics. Google Analytics 4, loaded through Google Tag Manager, counts visits, the pages people read and the buttons they click, so we can see what helps.
• Advertising and measurement. Google Ads, the Meta Pixel, the X (Twitter) Pixel and the LinkedIn Insight Tag measure our ads and let us show them to people who have visited. Where consent is required, they load only after you agree.

We use Google Consent Mode v2. In the European Economic Area, the United Kingdom and Switzerland, analytics and advertising start switched off and stay off until you turn them on. Everywhere else they start switched on, and you can turn them off.

You can change your choice at any time with Cookie settings at the bottom of every page.

What these tags collect is handled by each company under its own policy: Google, Meta, X and LinkedIn.

If you apply for a job at GemBoss

• What we keep. What you send through the form on gemboss.ai/careers: your name, email, the role, the links and answers you write, and your CV and portfolio as PDF files.
• Who can see it. Only the people hiring for GemBoss. Your CV is kept in private storage that only GemBoss can read, only the hiring team can open it, and it is never published.
• How long. Your application and its files are deleted 13 months after you send them.
• Your requests. Email admin@gemboss.ai to get a copy of your application, correct it, or have it deleted sooner. We act within 30 days.

Services that process data for us

Each processes data only to provide the service described here:

• Shopify: the commerce platform the app runs on.
• Railway: application hosting and databases.
• Vercel: storefront and page hosting.
• Cloudflare: content delivery, backup storage, and two kinds of files kept in private storage that only GemBoss can read: the session recordings described above, and the CVs of job applicants.
• Anthropic, OpenAI and Google: AI models that write and edit store content. We send them store content such as product titles, descriptions, images and brand copy, not shoppers' personal data. They do not use it to train their models.

When a merchant connects their own accounts, GemBoss sends data to them for that merchant: Meta receives the ad click id, event value and currency; Google Ads receives conversion value and click details, no user data; Klaviyo receives add to cart events tied to Klaviyo's own visitor id. No names, emails or phone numbers are sent to Meta or Google.

Application data is stored in the United States and Singapore. Storefronts are served from a global network.

How long we keep it

• Calls an AI assistant makes through a GemBoss connection: kept with the store's assistant history, and erased with it when the store is erased.
• Raw analytics events: 90 days. Daily rollups, which hold no session detail: up to 2 years.
• Click and scroll maps: 14 or 30 days, depending on the plan.
• Session recordings, on the storefront and in the admin: 30 days.
• Details shoppers give through popups, quizzes and forms: while the merchant uses GemBoss. The merchant can delete them at any time, and they are erased on a customer redaction request or when the store is erased.
• Usage records: 400 days, for billing.
• Job applications, with their CVs: 13 months after they are sent.
• Database backups: 14 days.
• Store content and designs: while the app is installed.

Deletion and requests

• Uninstalling takes the GemBoss storefront offline and revokes our access to the store. 48 hours later Shopify asks us to erase the store, and we erase its data: the access token, the store record, accounts, assistant conversations, pages and sections, workflows, usage records, analytics and shopper details.
• A shopper's data request, sent to us by Shopify on the merchant's behalf: we gather what we hold about that shopper into a file the store owner can download from their GemBoss inbox for 30 days.
• A shopper's erasure request: we delete the details they gave through popups, quizzes and forms, and any data request file we still hold for them. Analytics events tied to their Shopify customer id are kept in our analytics database without their name or contact details, and are deleted when they expire, within 90 days.
• Merchants can ask for an export, correction or erasure at any time by emailing support@gemboss.ai. We act within 30 days.

Two records are kept after an erasure, and neither identifies a shopper: billing history, which tax law requires, and the record that the erasure happened, which is the evidence that we honored it.

Security

• Data is encrypted in transit: HTTPS for every connection, and an encrypted private network between our services.
• Shopify access tokens, keys for connected services, and sign-in secrets are encrypted with AES-256-GCM in our database.
• Every store's data is kept separate, and team roles control who can see and change what.

Children

GemBoss is a business service and is not directed at children.

Changes

When this policy changes, we update the date at the top. We tell merchants about material changes before they take effect.

Contact

Questions, or a request about your data? Email support@gemboss.ai.