Privacy Policy

Quiz Path ("Quiz Path", "we", "us") provides a product-recommendation quiz application for Shopify stores. This policy explains what data we collect, how we use it, and the choices available to merchants and their customers. By installing or using Quiz Path, you agree to this policy.

1. Who is responsible for your data

When a merchant installs Quiz Path, the merchant is the data controller of their customers' personal data; Quiz Path acts as a data processor on the merchant's behalf. For data we collect to operate and bill the app (merchant account details), Quiz Path is the controller.

2. Data we collect

From merchants

• Store domain, basic shop profile, and Shopify access token (to operate the app).
• Product, customer, and discount data via the Shopify Admin API, used to build quizzes, recommend products, save quiz answers to customer records, and generate discounts. Order and revenue attribution are not enabled in the current app.
• Integration credentials you provide (e.g. Klaviyo API keys), stored securely.
• Billing status managed through Shopify Billing.
• Product feedback you send in the app, including your message and an optional reply email. We use it to provide support and improve Quiz Path.

From store visitors (quiz respondents)

• Quiz answers and the recommended result.
• Email address and, optionally, phone number when a visitor submits the capture form.
• Technical and attribution data: request IP address, user agent, referrer, UTM parameters, and a cart identifier associated with quiz activity.

3. How we use data

• To deliver the quiz experience and recommend relevant products.
• To capture leads and, where configured, sync them to the merchant's Klaviyo account or send a results email.
• To produce quiz analytics for the merchant (starts, answers, completions, captured leads, and add-to-cart activity).
• To generate discount codes for quiz recommendations.
• To operate, secure, debug, and improve the app, and to provide support.

We do not sell personal data, and we do not use it for advertising of our own.

4. Subprocessors

We share data only with services needed to run Quiz Path:

• Shopify — platform, authentication, and billing.
• Klaviyo — lead sync and marketing events, only when the merchant connects it.
• Resend — transactional emails (quiz results, merchant digests).
• Linear — issues for product feedback submitted by merchants. The issue contains the feedback message and category, but not the optional reply email or store domain.
• PostHog — internal product analytics using pseudonymous quiz-session and shop identifiers. Shopper email addresses and phone numbers are not sent to PostHog.
• Sentry — application error monitoring and troubleshooting.
• Cloud hosting & database providers — to host the application and store quiz data.

5. Data retention

We retain quiz and lead data while the app is installed and as needed to provide its features. On uninstall, we remove stored Shopify authentication sessions and mark the installation inactive. Store data is scheduled for deletion when Shopify sends its shop-redaction request, normally 48 hours after uninstall. Deletion runs in the background, with retries for temporary failures and connected-provider erasure. A reinstall before that deletion is processed preserves the active installation's quiz data. We also process Shopify customer data-request and redaction webhooks to provide access to, anonymize, or delete individual customer records.

Merchant feedback notes copied to Linear may remain after an app uninstall so we can resolve support and product issues. The Linear issue does not include the store domain or optional reply email. Merchants can contact us to request review or deletion of a feedback note.

6. Your rights

Depending on your location (e.g. GDPR/UK GDPR, CCPA), you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. Store visitors should contact the merchant whose store they used; merchants can contact us directly. We respond to verified requests within the timeframes required by applicable law.

7. Security

We use encryption in transit, access controls, and secure credential storage. API keys and secrets are stored server-side and never exposed to the storefront. No method of transmission or storage is completely secure, but we work to protect your data and promptly address vulnerabilities.

8. International transfers

Our subprocessors may process data in countries other than yours. Where required, we rely on appropriate safeguards such as standard contractual clauses for these transfers.

9. Children

Quiz Path is not directed to children and we do not knowingly collect data from children under the age of 16.

10. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by the "Last updated" date above.

11. Contact

Questions or privacy requests? Email hello@jamaklab.com.