GiftX ("GiftX", "we", "our", "us") provides an AI shopping assistant for e-commerce stores. This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and the choices and rights available to you.
This Policy applies to merchants who install the GiftX application on their Shopify store, and to shoppers who interact with the GiftX widget, hosted page, or quiz on a merchant's storefront.
When a merchant installs GiftX on their Shopify store, the merchant is the controller of personal data collected from their shoppers, and GiftX acts as the processor on the merchant's behalf. For our own administrative interactions with the merchant (account, billing, support), GiftX acts as a controller.
When a merchant installs the app on Shopify, we receive the following information from Shopify through OAuth and Shopify APIs:
read_products and
read_product_listings scopes
read_themes scope, used to
help the merchant install the storefront widget
GiftX does not request or store payment card details, order line-item PII, customer PII from the Shopify Customers resource, checkout data, or shipping addresses.
When a shopper interacts with the GiftX widget, hosted page, or in-theme block on a merchant's storefront, we may collect:
We do not knowingly collect personal information from children under the age of 16. If you believe a minor has provided us with personal information, contact us using the address below and we will delete it.
The information described above is used to:
GiftX uses third-party large language model providers (such as OpenAI and Anthropic) to generate quiz questions, match shopper answers to products in the merchant's catalog, and produce AI Visibility audits. Quiz answers and product metadata may be sent to these providers as part of model prompts. We use providers that offer a no-training-on-customer-data commitment for API traffic and we do not enable optional model-training features.
We share personal information only with the following categories of recipients:
| Recipient | Purpose |
|---|---|
| Shopify | Authentication, billing, product and theme APIs, and transmission of data between the merchant's store and the app |
| Cloud hosting and database providers | Hosting the GiftX application, database, logs, and content delivery |
| AI model providers (e.g. OpenAI, Anthropic) | Generation of quiz questions, recommendation matching, and AI Visibility audits |
| Klaviyo (optional, merchant-controlled) | Forwarding leads captured by the email gate to the merchant's connected Klaviyo account, only when the merchant explicitly connects Klaviyo and the shopper has opted in |
| Error and product-analytics tooling | Logging exceptions and aggregate usage metrics for reliability and product improvement |
| Legal and regulatory authorities | Where disclosure is required by valid legal process |
We do not sell personal information, and we do not share personal information with advertisers.
Personal information may be processed in countries other than the country in which it was collected, including the United States and the European Economic Area. Where required by applicable law, we rely on Standard Contractual Clauses or equivalent transfer mechanisms with our sub-processors.
We honour the GDPR webhooks defined by Shopify. When Shopify sends any of the following to GiftX, we respond as described:
customers/data_request - within 30 days, we provide
to the merchant the personal data we hold about the identified
shopper, so the merchant can fulfil the data-access request
customers/redact - we delete or anonymise all
personal data we hold about the identified shopper within 30
days
shop/redact - 48 hours after the merchant uninstalls
the app and Shopify confirms the redact event, we delete or
anonymise all personal data associated with that shop
app/uninstalled - we mark the shop as uninstalled
and pause all processing for that shop
Subject to applicable law (including GDPR, UK GDPR, and CCPA / CPRA), you may have the right to:
Shoppers should contact the merchant whose store they used first, because the merchant is the controller of that data. We will assist the merchant in responding. You may also contact us directly using the address in section 13.
We protect data in transit using TLS, restrict access on a need-to-know basis, store credentials in encrypted form, and review our security practices regularly. No system is fully secure; in the event of a personal-data breach we will notify affected merchants and, where required, supervisory authorities without undue delay.
The GiftX storefront widget uses local browser storage to keep an anonymous session identifier so that quiz progress survives a page reload, and to remember the shopper's selected language. The widget does not set tracking cookies for advertising and does not share a shopper identifier across merchants.
For privacy questions, data-subject requests, or to reach our Data Protection point of contact, write to:
We may update this Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify merchants through the GiftX admin or by email. Continued use of the service after a change takes effect constitutes acceptance of the updated Policy.