GDPR & data requests
What NavonaAI processes to run on your store, the data-request and redaction webhooks Shopify requires every app to support, and how each one is handled. For the full policy, see our Privacy Policy.
What NavonaAI processes, and why
NavonaAI runs on the cart, checkout, and order webhooks Shopify sends for your store, plus your product and collection catalog. That's what lets it apply the eligibility rules you configure and confirm when a discount was used — nothing here requires a shopper to have created an account or handed over contact details anywhere on your store.
Because Shopify's checkout and order webhooks can include the contact and shipping details a shopper has already entered at that point in checkout, that information can pass through NavonaAI as part of those webhook payloads. It is not something NavonaAI asks a shopper for directly, and arming the storefront popup and issuing a discount code never depends on it — see /security for how that's built.
Your Shopify access token is encrypted before storage — also covered on /security.
The three webhooks Shopify requires every app to support
NavonaAI subscribes to all three. Each is verified the same way every other Shopify webhook we receive is — see /security.
A shopper asks Shopify for a copy of the data an app holds about them.
We're notified immediately and record the request for review. This isn't a self-serve export — a person on our side handles each one directly.
A shopper asks Shopify to have their data deleted from an app.
We're notified immediately and record the request for review, the same way as a data request above.
About 48 hours after your store uninstalls NavonaAI or closes — Shopify fires this automatically, whichever happens.
We record it, and mark your store inactive in our systems if it isn't already — this is the one webhook of the three where our handler takes an automatic action beyond logging.
How this gets triggered
A shopper submits a data or deletion request through Shopify directly, not through NavonaAI — Shopify is the one that notifies every installed app, including us, once that happens. There's nothing for you to configure on your store for these three webhooks to work; they fire automatically because NavonaAI is a Shopify app.
If you have a question about what NavonaAI holds for your store that these webhooks don't cover, reach us directly rather than waiting on Shopify's flow.
Questions about your store's data
Read the full Privacy Policy, see what access NavonaAI has on /security, or email us directly.
privacy@navona.ai