Privacy Policy for Storefront Router
Effective date: September 19, 2026
Storefront Router (“the App”) is provided by university of Utah marketing scholars. This Privacy Policy explains how information is collected, used, stored, and deleted when a Shopify merchant installs or uses the App.
Information We Collect
Merchant and store information
When the App is installed, we may receive and store:
The merchant’s Shopify store domain
Shopify authentication and installation information
Access scopes and access tokens required to operate the App
Limited information about the Shopify administrator who installed or uses the App
A/B experiment settings, variant configurations, and tracking preferences
Storefront visitor information
When enabled by the merchant, the App may collect:
A randomly generated visitor identifier
A randomly generated browsing-session identifier
Assigned A/B variant
Experiment identifier
Page URL
Page visit timestamps and time spent on a page
Click timestamps and click sequence
Information about clicked elements, such as element type, visible label, link destination, CSS class, selector, role, and click coordinates
The App uses anonymous browser-generated identifiers and does not require merchants to create participant IDs.
We do not intentionally collect passwords, payment information, form contents, customer email addresses, phone numbers, or the values entered into search boxes or text fields. We do not intentionally retrieve Shopify customer, order, or payment records for the App’s A/B testing functionality.
Browser Storage
The App uses browser storage technologies, including local storage and session storage, to assign visitors to a variant, maintain that assignment during normal browsing, and distinguish browsing sessions.
How We Use Information
We use collected information to:
Provide and operate A/B experiments
Keep variant assignments consistent
Measure page visits, engagement, clicks, and time spent
Produce analytics and downloadable reports for merchants
Authenticate merchants and maintain App functionality
Diagnose errors, prevent abuse, and secure the App
Meet legal and Shopify platform requirements
We do not sell collected information or use it for third-party behavioral advertising.
Merchant Responsibilities
Merchants control where and how the App is enabled on their storefront. Merchants are responsible for providing any required privacy notices, obtaining any legally required consent, and configuring the App consistently with the laws that apply to their business and customers.
Service Providers
Information may be processed using service providers necessary to operate the App, including:
Shopify, for authentication and platform services
Google Cloud, for application hosting and operational logging
Neon, for managed PostgreSQL database services
Infrastructure providers used by those services
These providers process information only as necessary to provide their services to us.
International Processing
Depending on the merchant’s and visitor’s locations, information may be processed in countries other than where it was originally collected, including the United States. Those countries may have different data-protection laws.
Retention and Deletion
We retain information while it is reasonably necessary to provide the App, maintain security, satisfy legal obligations, and resolve disputes.
When Shopify sends a verified shop/redact request following an uninstall, the App schedules the deletion of information associated with that shop. The deletion is completed no later than 30 days after receiving the request. Authentication sessions may be deleted sooner.
Shopify privacy requests concerning customer data are processed through Shopify’s mandatory privacy webhooks. Because the App does not intentionally store Shopify customer records, a customer request may return no matching customer-linked information.
Data Access and Requests
Merchants can access and export tracked experiment information from the App. Requests to access, correct, or delete information may also be sent to the contact address below.
Storefront visitors should normally submit privacy requests to the Shopify merchant whose store they visited. The merchant may then contact us when assistance is required.
Security
We use reasonable technical and organizational safeguards, including encrypted network connections and access controls. No internet-based system can be guaranteed to be completely secure.
Children
The App is intended for use by Shopify merchants and is not directed to children. We do not knowingly collect information directly from children.
Changes to This Policy
We may update this Privacy Policy when the App, our practices, or applicable requirements change. The updated policy will include a revised effective date.
Contact Us
University of Utah marketing scholars
Email: Utahmktscholars2@gmail.com
Mailing address: Office 17, BUC building,
1645 Campus Center Dr, Salt Lake City, UT 84112
Country: U.S