Privacy Policy

1. Scope and our role

This policy covers Ecom Elixir LLC, a Wyoming limited liability company (Elixir, we, us), the marketing site at ecomelixir.com, the application at app.ecomelixir.com, the Elixir Shopify app and theme, pages we host, our APIs and MCP server, and our support and community channels.

We play two different roles:

• For merchants and site visitors, meaning the people who use Elixir or visit our site, we decide how personal data is used and are its controller. Sections 2 to 5 and 7 to 16 cover this data.
• For shoppers, meaning the people who visit a merchant's store or a page a merchant publishes with Elixir, we process personal data on the merchant's behalf as their processor or service provider. The merchant's own privacy policy governs that data, and shoppers should send requests to the merchant. Section 6 describes what we process for merchants.

2. Information you give us

• Waitlist and early access. Your email address, and depending on the form, your Discord username and the monthly revenue range you select, plus which page you signed up from.
• Account details. Your email address, your name if you provide one, and sign-in data handled by our authentication provider. If you sign in with a third party account such as Discord, we receive your account ID and basic profile from it. We do not see your password.
• Workspace content. Products, offers, brand assets, customer profiles, angles, research notes, knowledge base entries, swipe files, images, uploaded files, prompts, chats with our AI agents, and the pages and stores you create.
• Team details. Email addresses of people you invite to a workspace, and their roles.
• Billing details. Subscriptions and usage charges are billed through Shopify. We receive your plan, charge amounts, and subscription status from Shopify. We never receive your card details.
• Support, feedback, and community. What you send us by email, chat, bug reports, feedback forms, store change requests, or in our Discord server and forum, including attachments.
• Resource claims. Your email address when you claim a free resource, such as a code snippet, from our site.

3. Information from your connected accounts

• Shopify. When you connect a store, we receive an access token, which we encrypt at rest, and the store data your granted permissions expose: store and theme details, products, collections, files, pages, discounts, reports, and orders. We also receive Shopify notifications when orders are created or updated and when themes change. Order notifications include information about your customers, as described in section 6.
• Meta Ads. With read-only access, we receive your ad account details and your campaigns, ad sets, ads, creatives, and performance metrics.
• Discord. If you link Discord, we receive your Discord account ID and check and assign community roles linked to your licence.

You can disconnect an integration at any time, which stops further access.

4. Information we collect automatically

• Product analytics. Pages viewed, features used, clicks, errors, performance metrics, and timestamps, linked to your account and workspace.
• Session recordings. On our site and in the application we record how pages are used, such as mouse movement, clicks, scrolling, and what appears on screen, to find bugs and improve the product. Text you type into form fields is masked and is not recorded.
• Device and log data. IP address, browser and device type, operating system, referring page, and server and error logs.
• Cookies and similar technologies. See section 10.

5. Information from public and third party sources

Our research features collect information from publicly available sources, including websites, online stores, ad libraries, marketplaces, review sites, forums, and search and traffic data providers. This is mostly business information, but it can include personal data that people have made public, such as the names of advertisers or page owners, reviewer names, and public comments. We use it to provide research, competitor analysis, and customer insight features. If you are featured in this data and want it removed, contact us.

6. Information we process about shoppers for merchants

When a merchant installs the Elixir pixel, runs a test, or publishes pages, bundles, or other features with Elixir, we process the following on the merchant's behalf:

• Identifiers. A random visitor ID and session ID stored in first party cookies on the merchant's site. They are not derived from your name, email, or device.
• Browsing activity. Pages viewed, including the full page address (which can contain campaign and ad click parameters), the referring page, add to cart and checkout events, the products and quantities in the cart, and engagement on pre-landing pages such as scrolling, clicks, and the buttons or links clicked.
• Device and location. Device type (desktop, mobile, or tablet) worked out from the browser's user agent, and country worked out from the network. The pixel does not store IP addresses with these events.
• Tests. Which version of a page you were shown in an A/B or split test, stored in a cookie so you see the same version again, and any quiz answers used to route you through a funnel, which are kept in a cookie in your browser.
• Orders. From the merchant's Shopify order notifications we keep the order ID, totals, currency, the landing and referring pages, the Shopify customer ID, and a one-way hash of the email address, so that orders can be matched to visits. We do not keep names, addresses, or phone numbers in our database. The original notifications, which do contain those details, are kept in an encrypted archive for up to 30 days for reliability and then deleted.
• Bundle and offer views. When a bundle or offer is shown, we record the cart token, the browser user agent, and a key derived from a one-way hash of the IP address and user agent, to count unique views.

Merchants use this to measure and improve their store, attribute orders to traffic sources and pages, and run tests. We do not use it to build profiles across different merchants, and we do not sell it or use it for advertising. Merchants are responsible for telling shoppers about this processing and for obtaining any consent the law requires. If you are a shopper and want to access or delete this data, contact the merchant whose store you visited. We will help them respond.

7. How we use information

• To provide, operate, host, and maintain the Service.
• To generate the pages, copy, research, images, and recommendations you ask for, and to publish them to your store when you ask.
• To provide analytics, attribution, and testing to merchants.
• To review waitlist applications, grant early access, and manage invites.
• To manage subscriptions, credits, licences, and usage.
• To send service messages such as access invitations, receipts, usage and billing alerts, security notices, and product updates.
• To provide support, run our community, debug problems, and improve reliability, quality, cost, and performance, including by reviewing AI requests and responses.
• To prevent abuse and fraud, enforce our terms, and comply with legal obligations.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We do not use your workspace content or shopper data to train AI models. We may use de-identified and aggregated information, such as how features are used and how page variants perform, to improve the Service.

8. AI providers

To generate Output, we send the relevant parts of your prompts, workspace content, uploaded images, and research material to third party AI providers: OpenAI, Anthropic, Google (Gemini), and TypeSafe, which may route requests through OpenRouter. They process it to return a result. We use their business or API offerings, under which content sent to them is not used to train their models by default.

We record metadata about AI requests, such as the model used, token counts, cost, latency, and errors, in our product analytics provider, PostHog, to monitor reliability and cost. We do not send the content of your prompts or the AI's responses to PostHog. Please do not put sensitive personal data, payment details, or health records into prompts or uploads.

9. Who we share information with

We share information with service providers who process it for us under contract and only for the purposes we specify. These are our current subprocessors:

• Hosting, compute, and domains: Vercel, Google Cloud, Cloudflare (pixel delivery, event collection, and storage), and our managed database and queue hosts.
• File storage and delivery: UploadThing, Vercel Blob, Google Cloud Storage, DigitalOcean Spaces, and Cloudflare R2.
• Search and embeddings: Pinecone.
• AI models: OpenAI, Anthropic, Google, TypeSafe, and OpenRouter.
• Authentication: Hexclave.
• Billing: Shopify.
• Email: Resend.
• Analytics, session recording, logs, and error monitoring: PostHog.
• Research and page capture: Firecrawl, Apify, SearchAPI, Brandsearch, and ScreenshotOne. We send them the addresses and search terms of the pages and brands being researched, not your personal data.
• Design assets: Icons8 and Streamline receive icon search terms.
• Internal operations: Slack and Discord, which our team uses to receive waitlist applications, bug reports, and store change requests, including the name, email address, and details you submit.

We also disclose information:

• To the platforms you connect, such as Shopify, when we publish to your store or act through the integration.
• To members of your workspace, according to their roles, and to any AI agent or tool you connect through our API or MCP server.
• If required by law or valid legal process, or to protect the rights, safety, or property of our users, the public, or Elixir.
• In connection with a merger, acquisition, financing, or sale of assets, in which case we will tell you before your information becomes subject to a different policy.
• With your consent or at your direction.

10. Cookies and similar technologies

On our site and in the application we use:

• Strictly necessary: sign-in session cookies set by our authentication provider, and short-lived security cookies used when you connect Shopify or Meta.
• Preferences: your selected workspace, and browser storage for settings such as sidebar state, tours you have seen, and unfinished drafts.
• Analytics: PostHog cookies and storage used for product analytics and session recordings.

We do not use advertising cookies or ad pixels on our own site. You can block or delete cookies in your browser, and blocking analytics cookies will not stop the Service from working. The Service will not work correctly without strictly necessary cookies.

On merchants' stores and pages, the Elixir pixel sets the _elx_visitor cookie (30 days) and the _elx_session cookie (30 minutes of inactivity), plus cookies beginning _elx_ab_, _elx_funnel, and _elx_quiz_ for tests and funnels, and uses browser storage to queue events that have not yet been sent. On Shopify stores, the pixel only sets these cookies and records activity if the store's cookie banner, through Shopify's Customer Privacy API, reports that you allow analytics. If your browser sends a Global Privacy Control or Do Not Track signal, the pixel does not track you unless you have accepted analytics in that banner. If you withdraw consent, the pixel stops and deletes its cookies and any unsent events. Visitors who are not tracked see the store's standard pages and are not included in tests. Merchants are responsible for the consent banner on their store.

11. Legal bases (for people in the EEA, UK, and Switzerland)

We process personal data where it is necessary to perform our contract with you; where we have a legitimate interest in operating, securing, and improving the Service, understanding how it is used, and providing research features, balanced against your rights; where you have given consent, which you may withdraw at any time; and where we must comply with a legal obligation. For shopper data, the merchant determines the legal basis.

12. How long we keep information

• Account and workspace data: while your account or workspace is active. When you delete a workspace or your account, we delete it from our live systems straight away, or within 30 days if you ask us by email, and it may remain in backups for a limited time after that. Some files you uploaded may take longer to remove from storage. Where legacy payment records still reference your account, we keep those records for tax purposes and clear your name and email from your account.
• Waitlist submissions: until the waitlist closes or you ask us to remove them.
• Raw pixel events: 14 days, after which we keep only aggregated counts and the test and order attribution records described below.
• Original Shopify order notifications: up to 30 days.
• Order attribution, test exposures, and bundle views: 13 months, or sooner if the merchant uninstalls our Shopify app or asks us to delete them. When Shopify tells us a shopper has asked the merchant to erase their data, we remove that shopper's identifiers and events and keep only order totals the merchant needs for reporting. When a merchant uninstalls the app, Shopify sends a store erasure request 48 hours later and we delete all shopper data for that store.
• Aggregated analytics without personal data: while the merchant's account is active.
• Billing, tax, and legal records: as long as the law requires.

13. International transfers

We and our service providers operate in several countries, including the United States, so information may be transferred to and processed in countries other than where you live, which may have different data protection laws. Where required, we rely on safeguards such as the European Commission's standard contractual clauses and the UK addendum to them.

14. Security

We use encryption in transit, encryption at rest for Shopify and Meta access tokens and app secrets, hashed API keys, access controls, and separation between workspaces to protect information. No system is completely secure, so we cannot guarantee absolute security. If we become aware of a breach affecting your personal data, we will notify you, and regulators, where the law requires.

15. Your rights and choices

Depending on where you live, you may have the right to know what personal data we hold about you and how we use it, to get a copy of it, and to correct it, delete it, restrict or object to its use, or move it to another service; to withdraw consent; and to opt out of the sale or sharing of personal data, targeted advertising, and profiling. We do not sell or share personal data or use it for targeted advertising, so there is nothing to opt out of there. People in the EEA and UK may also complain to their local data protection authority.

You can delete your account yourself under Settings, then Profile, then Delete Account. Workspaces you own alone are deleted with it, and you are removed from shared ones. Any paid plan must be cancelled first. For any other request, email info@ecomelixir.com from the address on your account. We may need to verify your identity before acting, and we will respond within the time the law allows. You may use an authorised agent where the law permits, and we may ask for proof of their authority. If we decline your request, you may appeal by replying to our decision, and we will tell you the outcome of the appeal. We will not discriminate against you for exercising these rights.

You can manage email preferences in your account settings. Service messages about your account, billing, and security will still be sent.

Shoppers should send requests about data collected on a merchant's store to that merchant, as described in section 6.

16. Notice for California residents

In the past 12 months we have collected these categories of personal information about merchants and site visitors: identifiers (such as name, email address, account IDs, and IP address); commercial information (such as plans, charges, and licences); internet and network activity (such as product usage and session recordings); approximate location derived from IP address; professional information (such as your business, store, and revenue range); and any other information you choose to include in workspace content or messages. The sources, purposes, and recipients of this information are described in sections 2 to 9, and how long we keep it in section 12. We disclose each category to service providers for business purposes only. We do not sell or share personal information, we do not knowingly sell or share the personal information of anyone under 16, and we do not use or disclose sensitive personal information for purposes that require offering a right to limit.

17. Children

The Service is for business use and is not directed to anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us information, contact us and we will delete it.

18. Changes to this policy

We may update this policy as the product and our providers change. We will update the date at the top, and if a change is material we will give reasonable notice by email or in the product before it takes effect.

19. Contact

For privacy questions or requests, email info@ecomelixir.com or write to Ecom Elixir LLC, 1021 E Lincolnway, #9117, Cheyenne, WY 82001, United States. Pages we host on elixir.page and on merchants' own domains are operated by those merchants, so questions about them should go to the merchant first.