Privacy Policy

ConversionWax

Last Updated: October 13, 2026

ConversionWax ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform, website, and related services (collectively, the "Services"). Please read this policy carefully. By using our Services, you agree to the practices described here.

1. Information We Collect

1.1 Information You Provide Directly

We collect information you give us when you:

• Create an account or register for the Services (name, email address, company name, job title)
• Subscribe to a paid plan (billing address, payment card details processed by our payment processor)
• Contact our support team or submit a form
• Respond to surveys, promotions, or communications

1.2 Information Collected Automatically

When you access or use our Services, we automatically collect certain technical data, including:

• Log data: IP address, browser type, operating system, referring URLs, pages visited, and timestamps
• Usage data: features accessed, click-stream data, session duration, and actions taken within the platform
• Device information: hardware model, unique device identifiers, and mobile network information
• Cookies and tracking technologies (see Section 5 for details)

1.3 Information from Third Parties

We may receive information about you from third-party sources, such as:

• OAuth providers (e.g., Google, LinkedIn) if you choose to sign in via a third-party account
• Analytics partners and advertising networks
• Publicly available data sources

1.4 Shopify Merchants and Their Customers

This section applies when a merchant installs the ConversionWax app from the Shopify App Store ("the Shopify app"). It covers information we handle about the merchant and about the merchant's customers and storefront visitors.

Our role. For data about a merchant's customers and visitors, ConversionWax acts as a processor (service provider) on behalf of the merchant. The merchant is the controller (business) and decides why the data is collected. We process it only to provide the service to that merchant. For data about the merchant itself (account, billing and support contact), we act as controller as described in the rest of this policy.

Information we receive from Shopify about merchants. Store domain, store settings needed to run the app, the plan the merchant selected, and billing status from Shopify.

Information we receive about a merchant's customers and visitors.

• From Shopify order and customer notifications: Shopify customer ID, a SHA-256 hash of the customer's email address (we do not keep the plain email address in these reports), order ID, order totals (gross, subtotal, net sales), tax, shipping, discount, currency, financial status (for example paid or refunded), refund amounts, cancellation time, the customer's order count, the checkout token, and the landing page and referring site recorded on the order.
• From our storefront pixel and theme extension, after the visitor gives consent: page views, product views, add to cart and checkout events (started and completed), the page address and referrer, and visit and session identifiers.
• First-party cookies on the merchant's storefront: _cwid (visitor identifier), _cws (session state) and _cwvs (visit summary), which last up to about 400 days, and short-lived hand-off cookies (up to one day) that connect a completed checkout to the next page view. The pixel also keeps session state in the browser's local storage.
• IP address: our servers receive the visitor's IP address with each request. We use it only to work out a coarse location (country and region) for personalization and reporting. We do not store or log the IP address itself.

Why we use it. To show the right content to the right visitor (personalization by location, audience, URL and schedule), to measure how content performs, and to give the merchant reports that connect visits, channels and orders (attribution). We do not use this data to advertise to the shopper.

Consent. Last Mile storefront tracking starts only after the shopper allows analytics (and, for the identity cookies, preferences) in Shopify's Customer Privacy settings. If the shopper declines or later withdraws consent, we stop collecting and delete the related cookies. Merchants are responsible for showing a consent banner where the law requires one.

Sale of data. ConversionWax never sells Shopify merchant or shopper data and never shares it for advertising.

Retention. We keep Shopify data while the app is installed. When the merchant uninstalls the app, Shopify sends a shop/redact request 48 hours later and we delete the store's Last Mile data then. A customers/redact request deletes one shopper's data.

Sub-processors and recipients. Google Cloud (hosting, data storage and analytics processing) and Shopify (platform and billing). We do not share this data with other third parties except as the merchant instructs or the law requires.

Requests from merchants and shoppers. Shopify sends us privacy requests on behalf of merchants and shoppers:

• customers/data_request: we record the request, export the data to the merchant, and answer within 30 days.
• customers/redact: we delete the data we hold for that shopper.
• shop/redact: sent 48 hours after a merchant uninstalls the app. We delete the store's Last Mile data.

Shoppers should first contact the store they bought from, since the store is the controller. You can also email privacy@conversionwax.com and we will pass the request to the right merchant or act on the merchant's instruction. Merchants can email the same address.

Security and transfers. Data is processed and stored on Google Cloud in the United States.

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, maintain, and improve our Services
• Process transactions and send related information, including purchase confirmations and invoices
• Create and manage your account
• Send you technical notices, updates, security alerts, and support messages
• Respond to your comments, questions, and requests
• Send you marketing communications (where permitted by law and subject to your opt-out rights)
• Monitor and analyze usage trends to improve user experience
• Detect, investigate, and prevent fraudulent transactions and other illegal activities
• Comply with legal obligations

3. How We Share Your Information

We do not sell your personal information. We may share your information in the following circumstances:

3.1 Service Providers

We share information with trusted third-party vendors who perform services on our behalf, such as cloud hosting, payment processing, email delivery, analytics, and customer support. These parties are contractually obligated to use your data only to perform services for us.

3.2 Business Transfers

If ConversionWax is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email or prominent notice on our website prior to any such transfer.

3.3 Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., a court or government agency), or to protect the rights, property, or safety of ConversionWax, our users, or others.

3.4 With Your Consent

We may share your information for any other purpose with your explicit consent.

4. Legal Bases for Processing (GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, we process your personal data under the following legal bases:

• Contract performance: Processing necessary to fulfill our agreement with you
• Legitimate interests: Processing for our reasonable business interests, such as fraud prevention and improving our Services, where these interests are not overridden by your rights
• Legal obligation: Processing necessary to comply with applicable laws
• Consent: Where you have provided explicit consent, which you may withdraw at any time

5. Cookies and Tracking Technologies

We use cookies, web beacons, and similar technologies to collect information, remember your preferences, and understand how you interact with our Services. Types of cookies we use include:

• Essential cookies: Necessary for the Services to function (cannot be disabled)
• Analytics cookies: Help us understand how visitors use our Services (e.g., Google Analytics)
• Preference cookies: Remember your settings and personalize your experience
• Marketing cookies: Track your browsing habits to serve relevant advertising

You can control cookies through your browser settings or by using our cookie preference center. Note that disabling certain cookies may affect the functionality of our Services.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you with our Services. We will also retain and use your information as necessary to comply with legal obligations, resolve disputes, and enforce our agreements. When we no longer need your data, we will securely delete or anonymize it.

7. Your Rights and Choices

Depending on your location, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal data we hold about you
• Correction: Request that we correct inaccurate or incomplete data
• Deletion: Request that we delete your personal data ("right to be forgotten")
• Restriction: Request that we limit how we process your data
• Data portability: Receive your data in a structured, machine-readable format
• Objection: Object to processing based on legitimate interests
• Withdraw consent: Where processing is based on consent, withdraw it at any time

To exercise any of these rights, please contact us at privacy@conversionwax.com. We will respond within 30 days (or as required by applicable law). We may need to verify your identity before processing your request.

California Residents (CCPA/CPRA)

California residents have additional rights under the California Consumer Privacy Act, including the right to know what personal information is collected, the right to delete personal information, the right to opt out of the "sale" or "sharing" of personal information, and the right to non-discrimination for exercising these rights. To submit a CCPA request, contact us at privacy@conversionwax.com or use the "Do Not Sell or Share My Personal Information" link on our website.

8. Data Security

We implement industry-standard technical and organizational security measures to protect your personal information against unauthorized access, disclosure, alteration, and destruction. These measures include encryption in transit (TLS) and at rest, access controls, regular security assessments, and incident response procedures.

However, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security, and you provide your information at your own risk.

9. International Data Transfers

ConversionWax is based in the United States. If you access our Services from outside the United States, your information may be transferred to, stored, and processed in the United States or other countries where our service providers operate. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) approved by the European Commission to transfer personal data internationally.

10. Children's Privacy

Our Services are not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us immediately at privacy@conversionwax.com and we will take steps to delete such information.

11. Third-Party Links

Our Services may contain links to third-party websites or services. We are not responsible for the privacy practices or content of those third parties. We encourage you to review the privacy policies of any third-party sites you visit.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page with a revised "Last Updated" date and, where appropriate, by sending you an email notification. Your continued use of the Services after the effective date of any changes constitutes your acceptance of the revised policy.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

ConversionWax

Email: privacy@conversionwax.com

Website: <www.conversionwax.com>

If you are located in the EEA or UK and have an unresolved privacy concern that we have not addressed satisfactorily, you have the right to lodge a complaint with your local data protection authority.