Privacy Policy

ACO connects to your Shopify store and processes two kinds of data: your product catalog and anonymous shopper behavior. This page explains exactly what is collected, where it goes, and what you can control.

What ACO reads from your store

When you install ACO, you grant it the following Shopify access scopes. ACO requests only what it needs to function.

• read_products — syncs your catalog: product titles, prices, inventory levels, images, and categories. This is the pool ACO ranks from.
• read_orders and read_draft_orders — receives orders/paid webhooks to record which products converted. ACO captures the order ID, currency, and line-item product references. No customer name, email, or address is stored.
• read_themes — scans your active theme to detect where recommendation surfaces are placed. No theme code is modified via this scope.
• write_pixels and read_customer_events — installs a Shopify custom pixel on your storefront to emit behavioral events.

Shopper behavior events

The ACO pixel fires the following events whenever a shopper interacts with a recommendation surface on your storefront. No personally identifiable information is attached to any event.

• impression — a surface became visible in the shopper's viewport.
• click — the shopper clicked a product within a surface.
• hover — the shopper hovered over a product, captured as an engagement signal.
• decision — ACO served a ranked product list to a surface; logged for attribution.
• conversion — an order was completed; derived from the orders/paid Shopify webhook and linked back to the session that saw the recommendation.

Each event carries a surface ID, a store ID, a timestamp, and two shopper identifiers described below. HTTP User-Agent and Referer headers are also captured. No IP address is stored.

Shopper identifiers

ACO uses two opaque, store-scoped tokens to stitch events together. Neither token is linked to a Shopify customer account, email, or any external identity.

• _aco_shopper_id — a stable token that persists across sessions for the same browser on the same store. Used to build product affinity (e.g. "this shopper recently viewed category X").
• _aco_session_id — a short-lived token scoped to a single browser session. Expires when the session ends.

There is no cross-store tracking. A shopper's identifier on your store is different from any identifier they may have on another ACO-enabled store.

Where data lives

ACO routes data through three layers of infrastructure.

• AWS-hosted edge-v2 — decision requests are handled by regional edge clusters close to your shoppers. Behavioral telemetry is sent separately from decisions so it does not delay the response.
• ClickHouse — raw behavioral events (impressions, clicks, hovers, decisions, conversions) are stored here. The pipeline reads from ClickHouse to compute aggregated signals such as 7-day and 28-day click-through rates for each product.
• PostgreSQL — your catalog, surfaces, policies, and computed signals are stored in a managed PostgreSQL database. Signals are re-computed on a scheduled basis from ClickHouse aggregates.

How data is used

Behavioral events are aggregated into per-product signals — click-through rate, hover engagement rate, momentum trends — and used exclusively to rank products on your store's surfaces. ACO does not use your store's data to influence rankings on any other store.

Catalog data is used to build the candidate pool ACO draws from when making a decision: inventory filters, pricing information, and category constraints all come from your synced catalog. It is not shared with other merchants.

Uninstall and data deletion

When you uninstall ACO from Shopify, the app/uninstalled webhook triggers a deletion job for all data associated with your store — catalog records, behavioral events, computed signals, surfaces, and policies. The pixel is also removed from your storefront, so no new events are collected after uninstall.