Privacy Policy

Churnmiser LLC ("ChurnMiser," "we," "our," "us") provides an AI-powered customer retention and churn-prevention platform for Shopify stores. This Privacy Policy explains what data we collect, how we use it, who we share it with, and how merchants and end-customers can exercise their rights. It applies to the ChurnMiser Shopify App, the ChurnMiser marketing site at churnmiser.com, and any related services.

Our role under GDPR and CCPA

For data about end-customers of a Shopify store, the merchant is the data controller and ChurnMiser is the data processor. We process customer data only on the merchant's instructions, as set out in our Terms of Service. For merchant account data (the people operating the store) and for visitors to churnmiser.com, ChurnMiser is the data controller.

What we collect

When a merchant installs ChurnMiser, we request access to the following Shopify scopes and receive the corresponding data:

• Orders and order history (read_orders, read_analytics) — order ID, value, line items, status, fulfillment, returns, refunds. Used to score churn risk and identify recoverable revenue.
• Customer records (read_customers, write_customers) — name, email address, phone number, saved addresses, email and SMS marketing consent, tags, and order history. Used to score churn risk, to address retention messages, and to check consent before anything is sent. The write access is used to add churn-risk tags to customer records in Shopify.
• Product and inventory (read_products, read_inventory) — used for personalization and margin-aware discount calculations.
• Fulfillments and returns (read_fulfillments, read_returns) — used as behavioral churn signals.
• Customer events and pixels (read_customer_events, read_pixels, write_pixels) — we install a Shopify web pixel on the merchant's storefront. It records page, product and collection views, search terms, cart changes, each checkout step, and how shoppers interact with pages (clicks, mouse movement, scrolling, and which form fields they use — never what they type). Events are linked to the shopper's customer record once they sign in or check out. Used to detect cart abandonment, engagement decay and checkout drop-off, and to draw click and scroll heatmaps for the merchant.
• Marketing events (read_marketing_events, write_marketing_events) — used to publish campaign sends back to Shopify so they appear in the merchant's Marketing dashboard.
• Discounts (read_discounts, write_discounts) — used to create margin-aware discount codes for retention campaigns.
• Metaobjects (read_metaobjects, write_metaobjects, read_metaobject_definitions, write_metaobject_definitions) — used to store churn predictions inside the merchant's Shopify store.
• Checkouts and draft orders (read_checkouts, write_orders) — abandoned checkouts, including the cart contents and the shopper's email, are used to detect cart abandonment. Draft orders are created so a retention offer can be sent to the customer through Shopify's own email.

Name, email address, phone number and address are what Shopify calls protected customer data. We use them only for the purposes above. We never receive card numbers or other payment credentials, and we do not request access to the merchant's apps, themes, or storefront code.

Retention messages go only to customers who subscribed to marketing on that channel (email or SMS), as recorded in Shopify or, for Mailchimp sends, in the merchant's Mailchimp audience. A shopper who replies STOP to a text is taken off the list for that store.

On churnmiser.com, when you take our free store assessment we collect your email address, your store's web address and your answers, and we read your store's public pages to write the report. When you request a demo we collect your email address. When you apply to our agency partner program we collect your contact and business details, and approved partners receive commission payouts through Stripe.

Separately, our public website at churnmiser.com uses PostHog to measure page views, clicks, scroll depth, and referring source, and to record sessions and heatmaps of how visitors move through the marketing pages, so we can see which pages are useful and where people lose interest. PostHog receives each visitor’s IP address and derives an approximate location (city, region, and country) from it; we do not attach names or email addresses to this website analytics. This runs on the marketing pages only — it is not loaded inside the Shopify admin app, so it never sees end-customer data. It sets a first-party cookie to recognize a returning visit. Anything typed into a form is masked in recordings, and the parts of our free audit report that describe your store are hidden from them. Our servers also send PostHog a short list of business events — a store installing or uninstalling the app, starting a trial, subscribing or cancelling, a report being requested, a partner application — tagged with an internal ID only, never a name, email address, store address or store contents.

Our public website also uses the Meta Pixel, a tool from Meta Platforms, Inc. (the company behind Facebook and Instagram), to measure how well our ads work and to show our ads to people who have visited the site. When it loads, your browser sends Meta the pages you view, the fact that you clicked to install ChurnMiser or booked a call with our founder (not the details of the booking), your IP address, browser and device information, a Meta cookie identifier (_fbp), and, if you arrived by clicking one of our ads, an ad-click identifier (_fbc). Our own site script sets these two cookies as well, so ad measurement still works when Meta’s script is blocked; like the pixel, it does so only when you allow tracking. Meta may combine this with information it already holds about you, under Meta’s own privacy policy. Like PostHog, the Meta Pixel runs on the marketing pages only and is never loaded inside the Shopify admin app.

For the same purposes, our public website uses Google Tag Manager and Google Ads, from Google LLC. When they load, your browser sends Google the pages you view, the fact that you requested a report, clicked to install ChurnMiser or booked a call with our founder (not what you entered), your IP address, browser and device information, and Google’s own cookie identifiers, including an ad-click identifier if you arrived from one of our Google ads. Google’s use of this is governed by Google’s privacy policy. These, too, run on the marketing pages only.

Our public website also uses Apollo.io’s website visitor tool, loaded through Google Tag Manager under the same choice. When it loads, your browser sends Apollo your IP address, the pages you view, and browser and device information. Apollo matches this against its own business data to tell us which company visited and, where it can, which person at that company, so that we can follow up with businesses that showed interest. Apollo’s use of this is governed by Apollo’s privacy policy. Like the tools above, it runs on the marketing pages only and is never loaded inside the Shopify admin app.

When you allow tracking, our servers also tell Meta when you request a report from our website, apply to our partner program, and, if you took our assessment first, when you install ChurnMiser, start a trial or subscribe. These server-side events let us measure which of our ads work. They carry a scrambled (hashed) copy of your email address, your IP address, your browser type and Meta’s cookie IDs. We keep this attribution data for up to 180 days. Information already sent to Meta can’t be recalled by us, and Meta’s own privacy policy applies to it. If you decline tracking, or never answer the consent banner, none of this is sent.

Cookies and your choices

If you visit churnmiser.com from the European Union, the European Economic Area, the United Kingdom, or Switzerland, we ask before loading PostHog, the Meta Pixel, Google’s tags or Apollo; none of them runs unless you press “Accept.” We work out which visitors to ask from your browser’s time zone setting. Visitors elsewhere get them by default and can turn them off at any time. Your choice is saved in your browser, and changing it to “Decline” removes the cookies these tools set on our site. You can also limit ad tracking in your Meta and Google accounts’ ad settings.

How we use this data

• Compute a churn-risk score for each customer based on order history and behavioral signals.
• Generate personalized retention email and SMS copy and churn explanations using AI models on AWS Bedrock (from Anthropic, Amazon and Mistral AI).
• Recommend retention campaigns, discount strategies, and segments to re-engage at-risk customers.
• Send retention messages on the merchant's behalf, through Shopify's email or the email and SMS accounts the merchant connects.
• Display analytics and dashboards in the ChurnMiser admin interface.
• Sync a segment of consenting customers to the merchant's own Google Ads or Meta ad account, if the merchant connects one (see below).
• Bill the merchant through Shopify's app billing, based on their plan and usage (such as the number of customers in their retention window).

Third-party services and subprocessors

ChurnMiser uses the following services to operate the platform. Each receives only the data necessary to perform its function.

AWS services run under AWS's standard data-protection terms. We do not sell personal information. We share data for our own advertising with Meta and Google only, as described above: the Meta Pixel and Google’s tags on our public website and, with consent, Meta conversion events about your own sign-up. That never includes your store’s data or data about your customers. The only way customer data reaches Meta or Google is the ad-audience sync, and only when the merchant connects their own ad account and chooses a segment to sync. Separately, Apollo.io receives website visitors’ IP addresses and page views, as described above, so it can tell us which companies visited.

Where the data lives and how long we keep it

All merchant and customer data is stored in AWS us-east-1, encrypted at rest using AWS-managed KMS keys and in transit using TLS 1.2 or higher. Requests to AI models may be processed in other AWS regions inside the United States. Services the merchant connects (such as Twilio or Klaviyo) handle data under their own terms and locations.

We keep store data while the app is installed. When a merchant uninstalls ChurnMiser, Shopify sends us a shop/redact request 48 hours later, and we then delete that store's data. When an end-customer asks the merchant to erase their data, Shopify sends us a customers/redact request and we delete that customer's data, including their storefront activity. Both are completed within 30 days, as Shopify requires.

A few records are kept after that, because we have to: billing and payment records, which we keep for accounting and tax purposes; records of the emails ChurnMiser itself sent (to merchants and prospects, never to a store's customers) and the list of people who unsubscribed from them, so we keep honoring it; and a log showing each deletion request was received and completed (the store and Shopify's customer ID, no contact details), which we keep for three years as proof. Information you give us on churnmiser.com is kept until you ask us to delete it, except ad-measurement data, which is deleted after 180 days.

Rights of end-customers (GDPR, CCPA, and similar)

End-customers of a Shopify store may exercise the following rights by contacting the merchant they purchased from. Requests for a copy of your data or for deletion reach us automatically through Shopify's data-request and redaction webhooks; the merchant can send us any other request at support@churnmiser.com. Merchants and visitors to churnmiser.com can contact us directly at the same address.

• Request a copy of personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Object to processing or request restriction
• Lodge a complaint with your local data protection authority

AI and automated decision-making

ChurnMiser uses AWS Bedrock to run AI models from Anthropic, Amazon and Mistral AI. Customer data we send to Bedrock is processed under AWS's standard terms, is not shared with the model providers, and is not used to train their models. Churn-risk scores are advisory: they rank customers and suggest actions, and ChurnMiser sends messages only through campaigns and automations the merchant turns on. Merchants can also require that every message be approved before it is sent, in Settings.

Security

We use HMAC-SHA256 to verify every Shopify webhook, OAuth Token Exchange for embedded-app session authentication, row-level security in Aurora to isolate merchant data, and short-lived IAM credentials for all AWS service calls. Secrets are encrypted with KMS and never written to logs. We follow Shopify's Built for Shopify security requirements.

Children

ChurnMiser is not directed at children under 16 and we do not knowingly collect personal data from them. If you believe we have collected such data, contact us and we will delete it.

Changes to this policy

We update this policy when our practices change, and the date at the top shows the latest version. When we make material changes we notify merchants by email at least 30 days before the changes take effect.

Contact

For privacy questions, data requests, or to report a concern, reach out through the app's support channel in your Shopify admin, or contact us directly: