Legal

Privacy Policy

Updated 2026-08-06 · Legal

This crawlable page mirrors Lutiq’s Privacy Policy. The product SPA also serves /privacy for the branded layout.

Introduction

Lutiq LLC ("Lutiq," "we," "us," or "our") operates an AI landing-page optimization platform for e-commerce brands selling on Shopify. This Privacy Policy explains how Lutiq collects, uses, and shares personal information across the three contexts in which we process it.

Lutiq uses the data merchants authorize us to use — including landing-page engagement, conversion and purchase outcomes, and merchant-provided customer and order data — to deliver the Services and, separately, to train and improve Lutiq's own optimization and attribution models across our customer base. Knowing what a shopper purchases after clicking a Lutiq-served landing page is a core signal for those models. This Policy describes that use plainly and tells you how to opt out of it.

United States only. The Lutiq Services are currently intended for, and offered in, the United States only. They are not directed to, or offered to, individuals located in the European Economic Area ("EEA"), the United Kingdom, or Switzerland, and this Policy describes rights under U.S. state privacy laws rather than the EU or UK General Data Protection Regulation. Lutiq does not provide GDPR or UK-GDPR data-subject-rights mechanisms. See Section D.1.

How to use this document.

Part A applies if you are a Lutiq customer (merchant), an authorized user of a merchant account, or a visitor to lutiq.com. In this context, Lutiq acts as the "Business" under the California Consumer Privacy Act.
Part B applies if you are a shopper visiting a Lutiq-generated landing page (such as go.<brandname>.com) or a Shopify storefront on which the merchant has installed Lutiq's pixel. In this context Lutiq plays two roles: it acts as a "Service Provider" processing personal information on the merchant's behalf to deliver the service, and — for the data the merchant authorizes Lutiq to use to train and improve Lutiq's own optimization and attribution models — it acts as a "Business" in its own right. You can opt out of that second use as described in Part B §B.8 and at lutiq.com/privacy-request.
Part C lists Lutiq's sub-processors and vendor relationships. It applies to both Part A and Part B.
Part D contains common provisions (service availability, changes, contact information).

If more than one Part applies to you (for example, you are both a merchant authorized user and a shopper at one of our customer's stores), each Part governs the corresponding processing context. A consumer's rights against Lutiq differ depending on the role Lutiq plays — see Part A §A.9 and Part B §B.8.

Part A — Privacy Notice for Customers, Authorized Users, and Lutiq.com Visitors

Lutiq is the Business under CCPA for the processing described in this Part.

This Part describes how Lutiq LLC collects, uses, discloses, and otherwise processes personal information in connection with our website at lutiq.com (the "Site") and our landing-page optimization platform and related services (collectively, the "Services"). This Part applies to individuals who visit our Site, create an account, or otherwise interact with us directly — including Brand Partners who use our platform.

This Part does not describe the data Lutiq collects from shoppers who visit landing pages generated and served by Lutiq on behalf of our Brand Partners, or from merchant storefronts where Lutiq's pixel is installed. For information about how that data is collected and used — including the data Lutiq uses to train its own models, and how to opt out — please see [Part B](#part-b) below.

If you are a resident of California or another U.S. state with comprehensive privacy legislation, please see Section A.9 (State-Specific Privacy Rights) for additional disclosures and rights that may apply to you.

A.1 Personal Information We Collect

A.1.1 Information You Provide Directly

We collect personal information that you voluntarily provide to us when you sign up for our waitlist, create an account, subscribe to our Services, or communicate with us.

A.1.2 Information Collected Automatically

When you visit our Site or use our platform dashboard, we automatically collect certain information, including:

A.1.3 Information from Third Parties

We may receive personal information from the following third-party sources:

Shopify, when you connect your Shopify store to our platform. This includes store metadata and product catalog information; order and purchase data (including order value, items purchased, and order history) used for conversion attribution and model training; and customer records, which may include a customer's hashed email address and hashed phone number, marketing-consent status and preferences, coarse location (country, province/state, and city), lifetime order count, and total spend, plus a free-text customer "note" field. Lutiq uses this merchant-provided data both to deliver the Services to you and, where you authorize it, to train and improve Lutiq's own optimization and attribution models as described in Sections A.2 and A.4 and Part B. Lutiq does not store shoppers' plaintext email addresses or phone numbers from this source — only one-way SHA-256 hashes — and reduces addresses to coarse geography (country, province/state, city), never street address or postal code. The free-text customer "note" field, if present, is received and stored as provided by the merchant and may contain personal information.
Meta (Facebook & Instagram), when you connect your Meta Business account (read-only): your advertising accounts, campaigns, ad sets, ads, and creatives and their performance metrics; your Facebook Page content and insights; and your Instagram professional account profile, media, and insights. See the dedicated disclosure below.
Authentication providers, if you use a third-party login method.
Referral partners, who may share your contact information with your consent.

Meta (Facebook & Instagram) Data

When you connect your Meta Business account to Lutiq, you authorize us to read — on a read-only basis — the assets you select: your advertising accounts, campaigns, ad sets, ads, ad creatives, and their performance metrics (via the Meta Marketing API); your Facebook Page content and insights; and your Instagram professional account profile, media, and insights. We use this data solely to (a) attribute advertising clicks to the Lutiq landing-page experiments they reach and report performance, and (b) inform the content and design of pages we generate for you. We do not post, advertise, modify, or write any data back to Meta, and we do not sell or license your Meta data. We store it encrypted, retain it only as long as your account is active or as needed for the purposes above, and delete it on request or on disconnection. To request deletion of your Meta-derived data, disconnect Meta in your Lutiq dashboard or contact [email protected]; you may also trigger deletion by removing the Lutiq app from your Meta settings, which calls our automated deletion endpoint. Sub-processors: Google Cloud (hosting/storage). For Meta's terms see the Meta Platform Terms.

A.1.4 Sensitive Personal Information

We do not collect Sensitive Personal Information ("SPI") as defined by the California Privacy Rights Act (Cal. Civ. Code §1798.140(ae)). We do not request, infer, or process categories such as government identifiers, precise geolocation, racial or ethnic origin, religious beliefs, union membership, the contents of mail or messages, genetic or biometric identifiers, health information, or information about sex life or sexual orientation. If this ever changes, we will update this Policy and, where required, provide a conspicuous "Limit the Use of My Sensitive Personal Information" link.

A.2 How We Use Personal Information

Service Delivery and Operations

To create and manage your account
To provide, operate, and maintain our platform and Services
To generate landing page variants from your brand data (products, design tokens, media, testimonials)
To serve landing page experiments and manage traffic allocation
To provide experiment performance analytics and conversion attribution reports
To process payments and manage subscriptions

Communications

To respond to your inquiries and provide customer support
To send service-related notices (e.g., account confirmations, experiment status updates, security alerts)
To send marketing communications about our Services (with your consent or where otherwise permitted by law; you may opt out at any time)

Improvement and Development

To analyze usage patterns and improve our platform, algorithms, and user experience
To develop new features and services
To conduct research and analytics on platform performance
To train and improve Lutiq's own optimization and attribution models — including learning which landing-page experiences lead to engagement and to subsequent purchases — using landing-page interaction data, conversion and purchase outcomes, and merchant-provided customer and order data that you authorize us to use. This learning improves the Services for Lutiq's customers generally; it is described further in Section A.4, and shoppers may opt out as described in Sections A.9 and B.8

Lutiq trains and improves its own first-party models with this data. Lutiq does not transmit shopper or merchant personal information to the third-party large-language-model providers it uses to generate page content; those prompts contain only brand and product content. See the AI Transparency Statement.

Security and Compliance

To detect, prevent, and address fraud, security issues, and technical problems
To enforce our Terms of Service
To comply with legal obligations

A.3 How We Disclose Personal Information

We do not sell personal information for money to data brokers or advertising networks, and we do not share personal information for cross-context behavioral advertising. As described in Sections A.2 and A.4, Lutiq does use data the merchant authorizes — including landing-page engagement and post-click purchase outcomes — to train and improve its own models in ways that benefit Lutiq's customers generally. Under the CCPA and comparable laws, that cross-brand use may be treated as "sharing" or a "sale" of personal information, and consumers have the right to opt out (see Section A.9.3 and lutiq.com/privacy-request).

We may disclose personal information in the following circumstances:

We require all third parties to whom we disclose personal information to maintain the confidentiality and security of that information and to use it only for the purposes for which it was disclosed.

Regarding Brand Partner Data: We do not disclose one Brand Partner's proprietary data (brand assets, experiment configurations, performance results), customer records, or any individual consumer's identifiable profile to any other Brand Partner. Cross-brand benefit flows only through Lutiq's trained model parameters and aggregate statistical patterns, as described in Section A.4.

A.4 Cross-Brand Model Training and Network Intelligence

Lutiq uses data from experiments across its Brand Partners — including landing-page interaction data, conversion and purchase outcomes, and merchant-provided customer and order data that the merchant authorizes — to train and improve the optimization and attribution models that power the Services. This learning improves the effectiveness of the Services for Lutiq's customers generally. Knowing, for example, what a shopper purchases after clicking a Lutiq-served landing page is a valuable signal for these models, and using that signal across our customer base is a core part of how Lutiq works.

The benefit of this learning flows between Brand Partners only through Lutiq's trained model parameters and aggregate statistical patterns. No Brand Partner ever receives another Brand Partner's raw data, customer records, experiment configurations, or any individual consumer's identifiable profile. Where Lutiq uses pseudonymized individual-level signals (such as a hashed identifier tied to a purchase outcome) to train its models, it does so under the merchant's authorization and subject to the opt-out rights described in Sections A.9.3, B.2, and B.8. When a consumer opts out, Lutiq excludes that consumer's data from cross-brand model training.

A.5 Cookies and Tracking Technologies

We do not use third-party advertising cookies on our Site or platform. You can control cookies through your browser settings. Disabling strictly necessary cookies may impair your ability to use the platform.

A.6 Data Retention

We retain personal information only for as long as reasonably necessary to fulfill the purposes for which it was collected, unless a longer retention period is required or permitted by law.

When personal information is no longer needed, we delete or de-identify it in accordance with our data retention procedures. You may request deletion of your account and associated data at any time (see Section A.9). A verified consumer deletion request is handled within thirty (30) days.

A.7 Data Security

We implement commercially reasonable administrative, technical, and organizational safeguards to protect personal information against unauthorized access, alteration, disclosure, or destruction. These measures include encryption of data in transit (TLS) and at rest, access controls and role-based authentication, regular security assessments and vulnerability testing, incident response procedures, and secure software development practices.

No method of transmission over the Internet or electronic storage is completely secure. While we strive to protect personal information, we cannot guarantee absolute security. If you become aware of any unauthorized access to your account, please contact us immediately.

A.8 Children's Privacy

Our Site and Services are not directed to individuals under the age of 16. We do not knowingly collect personal information from children under 16. If we learn that we have collected personal information from a child under 16, we will take steps to delete that information promptly.

A.9 State-Specific Privacy Rights

A.9.1 California Residents (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, "CCPA"), provides you with the following rights:

Right to Know — You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you.
Right to Delete — You have the right to request that we delete personal information we have collected from you, subject to certain exceptions.
Right to Correct — You have the right to request that we correct inaccurate personal information we maintain about you.
Right to Opt Out of Sale or Sharing — Lutiq does not sell personal information for money and does not share it for cross-context behavioral advertising. Lutiq does use authorized data to train and improve its own models across its customer base, which may be treated as a "sale" or "sharing" under applicable law; you have the right to opt out, and you can do so as described in Section A.9.3 or at lutiq.com/privacy-request.
Right to Limit Use of Sensitive Personal Information — We do not collect or use sensitive personal information, and we do not use or disclose it for purposes beyond those permitted under the CCPA.
Right to Non-Discrimination — We will not discriminate against you for exercising any of your CCPA rights.

CCPA Categories Disclosure

A.9.2 Residents of Other U.S. States

If you reside in Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have similar rights under your state's privacy law, including rights to access, delete, correct, opt out, and data portability.

How to Exercise Your Rights: To submit a privacy rights request, please contact us at [email protected] or use the privacy request form at lutiq.com/privacy-request. We will verify your identity before processing your request and will respond within the timeframes required by applicable law (generally 45 days, with a possible 45-day extension).

Right to Appeal: If we deny your request, you may appeal by contacting us at [email protected] with the subject line "Privacy Rights Appeal."

You may opt out of the "sale" or "sharing" of your personal information — including Lutiq's use of authorized data to train and improve its own models across its customer base — in any of these ways:

Global Privacy Control (GPC). We recognize and honor the GPC browser signal as a valid opt-out request under applicable U.S. state privacy laws. When we detect GPC from your browser, we apply an opt-out for that browser automatically, without any further action from you. We do not override a GPC signal based on separately stored consent preferences.
Email. Email [email protected] and ask us to opt you out of the sale or sharing of your personal information.
Online request. Use the request form at lutiq.com/privacy-request and ask us to opt you out of the sale or sharing of your personal information.

When an opt-out applies, we exclude the corresponding personal information from use in training or improving Lutiq's models across our customer base. A current, working "Do Not Sell or Share My Personal Information" page is available at lutiq.com/privacy-request. For Shopify storefronts, the merchant is responsible for configuring Shopify's Customer Privacy API and surfacing a "Do Not Sell or Share My Personal Information" control on its storefront; Lutiq gates on those consent flags as described in Part B, Section B.8.5.

The consent signals and opt-out mechanics that apply to shoppers on a merchant's storefront or on a Lutiq-hosted landing page — including Shopify's Customer Privacy API and the Global Privacy Control — concern end-consumer (shopper) personal information, for which the merchant is the Business and Lutiq acts as a Service Provider. They are described in Part B, Section B.8.5.

A.9.5 Do Not Track (DNT)

Our Services do not currently respond to "Do Not Track" (DNT) browser signals, because there is no industry standard for how to respond. We do, however, honor GPC signals as described in Section A.9.3.

A.9.6 Authorized Agent

California residents may designate an authorized agent to submit a CCPA request on their behalf. To do so, the agent must provide (a) written and signed permission from the consumer authorizing the agent to act, (b) verification of the consumer's identity, and (c) the agent's own contact information. Lutiq may deny a request from an agent who fails to provide these items or whose authorization cannot be verified.

A.9.7 California Shine-the-Light

Under California Civil Code §1798.83 ("Shine the Light"), California residents may request information about a business's disclosure of personal information to third parties for those third parties' own direct-marketing purposes. Lutiq does not share personal information with third parties for their own direct-marketing purposes. California residents may request a disclosure by emailing [email protected] with the subject line "Shine the Light Request." We will respond within the timeframe required by law.

A.10 Retention Periods

The following retention periods apply to the main categories of personal information we process, consistent with the retention schedule in Section A.6:

Identifiers (name, email, account ID) — retained for the life of the account plus 24 months, except where a longer period is required by law
Internet or electronic network activity (attribution events, pixel interactions) — 24 months from the event date, then deleted or aggregated
Inferences and model-training signals drawn from the above (e.g., segment membership and post-click purchase outcomes used for variant ranking and model training) — 24 months
Support and communication records — 3 years from the last interaction
Billing records (invoices, payment receipts, tax records) — 7 years to comply with federal and state tax retention requirements
Aggregated, de-identified performance data and trained model parameters (no personal information) — retained indefinitely

A.11 AI and Automated Decision-Making

Lutiq uses automated systems, including generative AI, to produce landing-page variants and to allocate traffic between variants using Lutiq's own models and algorithms. This processing selects which landing-page variant a visitor is shown and measures engagement; it does not produce legal or similarly significant effects on individual consumers, it does not make eligibility or access decisions, and it does not assign credit, employment, housing, insurance, education, or healthcare outcomes to any consumer. Consumers retain the right to know that this automated processing is occurring and to opt out of the sale or sharing of their personal information. For more detail on how the AI system works and what Lutiq does and does not train on, see the AI Transparency Statement.

Part B — Privacy Notice for End Consumers of Lutiq-Powered Landing Pages

For the processing described in this Part, Lutiq acts as a Service Provider on the merchant's behalf to deliver the Services, and — for the data the merchant authorizes Lutiq to use to train and improve Lutiq's own models — as a Business in its own right. You can opt out of that second use; see §B.8.

This Part describes how Lutiq LLC collects, uses, and processes information when you visit a landing page or website experience that is generated and served by Lutiq's platform on behalf of one of our brand clients ("Brand Partners"), or a Shopify storefront on which a Brand Partner has installed Lutiq's pixel.

Lutiq's dual role under U.S. privacy law. Lutiq plays two distinct roles for the data described in this Part:

Service Provider, for delivering the Services. To generate and serve landing-page variants and produce the Brand Partner's own performance and attribution reports, Lutiq acts as a "Service Provider" under Cal. Civ. Code §1798.140(ag) (and a "processor" under comparable state laws), processing your personal information on the Brand Partner's documented instructions. For that processing, the Brand Partner is the "Business" (Cal. Civ. Code §1798.140(d)) and the equivalent "controller" under comparable state laws.
Business, for training and improving Lutiq's own models. For the data the Brand Partner authorizes Lutiq to use to train and improve Lutiq's own optimization and attribution models across Lutiq's customer base, Lutiq acts as a "Business" (controller) in its own right, using that data for its own purposes.

Under the CCPA and comparable laws, the Brand Partner's authorization of Lutiq's own use of this data may be treated as "sharing" or a "sale" of your personal information, and you have the right to opt out (see §B.8 and lutiq.com/privacy-request). Lutiq does not sell your personal information for money, does not share it for cross-context behavioral advertising, and never discloses your individual, identifiable data to another Brand Partner. The benefit of Lutiq's model training flows to other Brand Partners only through Lutiq's trained model parameters and aggregate statistical patterns.

For privacy requests related to the Service-Provider processing (such as access, deletion, or correction of the data Lutiq processes to deliver the Services), please contact the Brand Partner directly. The Brand Partner's privacy policy, which should be linked on their website, governs the use of your personal information in that context, and Lutiq will cooperate with the Brand Partner to respond to verified requests within the statutory timeframes. For Lutiq's own use of authorized data to train its models — including the right to opt out — you can also exercise your rights directly with Lutiq at [email protected] or lutiq.com/privacy-request, and Lutiq will honor your opt-out (see §B.8).

No Sensitive Personal Information. We do not collect Sensitive Personal Information as defined by Cal. Civ. Code §1798.140(ae). We do not collect government identifiers, precise geolocation, health information, genetic or biometric identifiers, the contents of your mail or messages, or information about your racial or ethnic origin, religion, union membership, sex life, or sexual orientation.

Lutiq's own cookies are first-party; the merchant chooses any third-party tracking. The cookies Lutiq itself sets on a Brand Partner domain are first-party cookies scoped to that domain, and through its own cookies Lutiq does not sync identifiers with advertising networks or data brokers or use device fingerprinting. Separately, on the pages Lutiq serves, Lutiq will place whatever third-party tags the merchant chooses to run (such as the merchant's own analytics or advertising pixels); those tags are configured and controlled by the merchant, set their own cookies, and may share data with their providers. See §B.3.

GPC honored. We recognize and honor Global Privacy Control (GPC) signals as valid requests to opt out of the sale or sharing of personal information. When a GPC signal is present, we limit processing to what is strictly necessary for the page to function for the current session and exclude the corresponding data from training Lutiq's models.

A current list of Lutiq's sub-processors is available in [Part C](#part-c) below.

If you have questions about Lutiq's own data practices as a merchant or as a lutiq.com visitor, please see [Part A](#part-a) above.

B.1 What Information Is Collected

Together, the data collected through the Lutiq Pixel and the customer and order data the merchant authorizes Lutiq to access from the merchant's e-commerce platform (such as Shopify) and/or the Lutiq Pixel make up your "Experiment Data." The categories and data points described in this Section B.1 are examples; the specific signals we collect evolve as the product changes.

B.1.1 Visitor Identifiers

We assign a random, pseudonymous identifier to your browser session using a first-party cookie set on the Brand Partner's domain (e.g., go.brandname.com). This identifier is used to ensure you see a consistent landing page experience during your visit and to connect your landing page visit to any subsequent actions you take on the Brand Partner's website. This identifier is not your name, email address, or any other directly identifying information — it is a randomly generated string meaningful only within the context of the Brand Partner's domain.

B.1.2 Interaction Data

B.1.3 Traffic Source Data

This information is typically passed through the URL by the advertising platform (e.g., Meta, Google) and does not include your personal identity on those platforms.

B.1.4 Purchase Funnel Data

If the Brand Partner has installed the Lutiq companion pixel on their e-commerce store, we may also collect information about your subsequent actions on the Brand Partner's store:

B.1.5 Identity Stitching Data

In some cases, we use a technique called "identity stitching" to connect your landing page visit to a subsequent purchase. When you make a purchase on the Brand Partner's store and provide your email address or phone number as part of checkout, the Brand Partner's e-commerce platform may pass a one-way SHA-256 hash of that information to the Lutiq Pixel.

This hash is a fixed-length, pseudonymized token. We do not store the plaintext email address or phone number behind it, and we treat the hash as personal information rather than anonymous data. It is used to link your purchase back to your earlier landing page visit for attribution and for training Lutiq's models. We do not collect or store your plaintext email address, phone number, or other directly identifying contact information from this process — only the one-way hashed value.

B.1.6 Merchant-Provided Customer and Order Data

If the Brand Partner connects its e-commerce store (such as Shopify) to Lutiq, or where purchase data is captured through the Lutiq Pixel, Lutiq also receives customer and order records from the Brand Partner's store. This may include a customer's hashed email address and hashed phone number, marketing-consent status and preferences, coarse location (country, province/state, and city), lifetime order count and total spend, order and purchase history (including order value and items purchased), and a free-text customer "note" field as provided by the merchant, which may contain personal information. Lutiq uses this data to attribute purchases to landing-page experiences (as a Service Provider) and to train and improve Lutiq's own optimization and attribution models across its customer base (as a Business). Lutiq does not store shoppers' plaintext email addresses or phone numbers from this source — it stores one-way SHA-256 hashes — and reduces addresses to coarse geography (country, province/state, city), never street address or postal code. You may opt out of Lutiq's use of this data for cross-customer model training as described in §B.8, and you may ask the Brand Partner or Lutiq to delete it.

B.2 How This Information Is Used

The Experiment Data described in §B.1 is used for the following purposes. The first three are performed on the Brand Partner's behalf (Lutiq as Service Provider); the fourth is Lutiq's own use to train and improve its models (Lutiq as Business), and you may opt out of it.

Experiment Optimization — Lutiq's platform generates multiple variants of landing pages and uses its own models and algorithms to determine which variants perform best. Your interaction data contributes to this optimization process.
Conversion Attribution — By connecting your landing page visit to your subsequent actions on the Brand Partner's store, we help the Brand Partner understand which landing page experiences drive the most valuable outcomes.
Performance Reporting — We provide the Brand Partner with aggregated reports on landing page performance, including conversion rates, engagement metrics, and revenue attribution.
Model Training and Improvement (Lutiq's own use) — We use landing-page interaction data, conversion and purchase outcomes, and merchant-provided customer and order data to train and improve Lutiq's own optimization and attribution models. This improves the Services for Lutiq's customers generally. The benefit flows to other Brand Partners only through Lutiq's trained models and aggregate patterns — never by disclosing your individual, identifiable data to another Brand Partner. You may opt out of this use (see §B.8 and lutiq.com/privacy-request), and when you do, your data is excluded from it.

B.3 Cookies and Tracking Technologies

B.3.1 Lutiq's First-Party Cookies and Merchant-Chosen Third-Party Tags

The cookies the Lutiq Pixel itself sets are first-party cookies, scoped to the Brand Partner's domain (listed below). Lutiq's own cookies are not used to track you across unrelated websites. Separately, on the pages Lutiq serves, Lutiq will load whatever third-party tags the merchant chooses to run — for example, the merchant's own analytics or advertising pixels. The merchant decides which tags are included; Lutiq places them on the merchant's instruction and does not control them or determine what they collect. Those third-party tags set their own cookies, send data to their providers under the merchant's configuration and those providers' own policies, and may be used for cross-site or interest-based advertising. They are not Lutiq cookies. The merchant is responsible for disclosing them and obtaining any consent the law requires.

B.3.2 No Cross-Site Tracking

Lutiq does not track you across different Brand Partners' websites. Your visitor identifier on one Brand Partner's domain is completely separate from any identifier on another Brand Partner's domain. There is no cross-domain cookie syncing or identifier sharing between Brand Partners through Lutiq's own cookies. Any third-party tags the merchant chooses to run (§B.3.1) are controlled by the merchant and governed by their providers' policies.

B.4 How This Information Is Disclosed

We do not sell your personal information for money, and we do not share it for cross-context behavioral advertising. We never disclose your individual, identifiable data to another Brand Partner. As described in §B.2, Lutiq does use authorized data (including pseudonymized, hashed identifiers tied to purchase outcomes) to train and improve its own models across its customer base, which under applicable law may be treated as "sharing" or a "sale." You may opt out at any time (see §B.8 and lutiq.com/privacy-request). Apart from that use, individual-level data is disclosed only to the Brand Partner on whose behalf it was collected and to our essential infrastructure providers. Lutiq does not send shopper personal information to the third-party LLM providers it uses to generate page content.

B.5 Data Retention

After the retention period, individual-level data is deleted or de-identified. A verified consumer deletion request, and a Shopify customers/redact webhook, are handled within thirty (30) days.

B.6 Data Security

We implement commercially reasonable administrative, technical, and organizational safeguards to protect the information collected through the Lutiq Pixel, including encryption of data in transit (TLS) and at rest, edge-first architecture with data processed at Cloudflare's global network for minimal data exposure, access controls limiting who within Lutiq can access individual-level data, and regular security assessments.

B.7 Children's Privacy

Lutiq's platform is designed for use by e-commerce brands marketing to adult consumers. We do not knowingly collect personal information from children under the age of 16 through the Lutiq Pixel. If a Brand Partner's products or services are directed at children, the Brand Partner is responsible for ensuring compliance with applicable children's privacy laws (such as COPPA).

B.8 Your Privacy Rights

For requests about data Lutiq processes to deliver the Services as a Service Provider, your primary point of contact is the Brand Partner whose landing page or storefront you visited, because the Brand Partner is the Business for that processing. However, because Lutiq also uses authorized data as a Business in its own right to train and improve its models, you can exercise your rights — including the right to opt out of the sale or sharing of your personal information — directly with Lutiq at [email protected] or lutiq.com/privacy-request, and Lutiq will honor your opt-out.

B.8.1 California Residents (CCPA/CPRA)

Right to Know what personal information has been collected about you
Right to Delete your personal information
Right to Correct inaccurate personal information
Right to Opt Out of the sale or sharing of your personal information — including Lutiq's use of authorized data to train and improve its models across its customer base. Exercise it via Global Privacy Control, by emailing [email protected], or at lutiq.com/privacy-request
Right to Non-Discrimination for exercising your rights

B.8.2 Residents of Other U.S. States

B.8.3 How to Exercise Your Rights

To opt out of Lutiq's model training, or to reach Lutiq directly: use Global Privacy Control (which we honor automatically), email [email protected], or use the privacy request form at lutiq.com/privacy-request. When you opt out, Lutiq excludes your data from cross-brand model training.

For access, deletion, or correction of the data Lutiq processes to deliver the Services: contact the Brand Partner whose landing page or storefront you visited; their privacy policy should include contact information for privacy requests. If you are unable to identify the Brand Partner, or if the Brand Partner directs you to us, you may contact Lutiq directly at [email protected] or use the form at lutiq.com/privacy-request, and we will route your request appropriately.

B.8.4 Opt-Out Preference Signals

We recognize and honor the Global Privacy Control (GPC) signal. When we detect a GPC signal from your browser on a Brand Partner landing page, we will limit data collection to what is strictly necessary for the page to function, will not use your data for optimization beyond the current session, and will exclude it from training Lutiq's models. On Shopify storefronts, we additionally gate on the consumer's consent flags exposed by Shopify's Customer Privacy API, as described in §B.8.5.

When Lutiq's pixel is deployed inside a Shopify merchant's storefront, our Web Pixel subscribes to Shopify's Customer Privacy API and reads the consumer's consent flags on every event. We suppress event collection that would conflict with the consumer's choices: when "analytics processing" is not allowed we drop attribution and analytics events; when "sale of data" is not allowed we drop events that would feed cross-brand model improvements; when "marketing processing" is not allowed we drop retargeting-adjacent events. Strictly necessary, session-scoped events (e.g., cart-attribution continuity for the consumer's own checkout) may continue to fire when permitted by the merchant's privacy configuration. The merchant is responsible for configuring the Customer Privacy API and surfacing a "Do Not Sell or Share My Personal Information" control on its storefront.

On Lutiq-hosted landing pages (e.g., go.brand.com), where Shopify's Customer Privacy API is not present, we honor the Global Privacy Control (GPC) signal as a request to opt out of sale or sharing of personal information. When GPC is detected we limit processing to what is strictly necessary for the page to function for that session and exclude the corresponding data from use in training or improving Lutiq's models across our customer base.

Where a consumer exercises a right to deletion through a merchant, the merchant forwards the request to Lutiq under the Data Processing Addendum and we delete that consumer's events within thirty (30) days. Because consent-restricted events are stored without stable identifiers, those events are typically not linkable to a specific consumer and require no further deletion action.

Part C — Sub-processors

This Part lists the vendors Lutiq engages to deliver the Services. It applies to processing described in both Part A and Part B.

C.1 Overview

This Part lists the vendors Lutiq LLC ("Lutiq") engages to deliver the Lutiq platform and related services. The list is current as of the effective date shown above. Lutiq processes two categories of personal information that require separate disclosures.

Tier A — Sub-processors of end-consumer personal information. When a shopper visits a Lutiq-generated landing page or interacts with a merchant's Shopify storefront where Lutiq's pixel is installed, Lutiq processes that shopper's personal information on the merchant's behalf as a Service Provider under California Civil Code §1798.140(ag). The vendors listed below in Tier A are sub-processors of that processing.

Tier B — Sub-processors of Lutiq customer (merchant) personal information. Separately, Lutiq processes personal information about its own customers — the merchants who subscribe to the Services — for billing, support, account management, and operational purposes. In that context Lutiq is the Business and the vendors listed below in Tier B are sub-processors.

C.2 Tier A — Sub-processors of end-consumer personal information

Vendors that may receive end-consumer (shopper) personal information in the course of delivering the Services to merchants. With respect to this processing, Lutiq acts as a Service Provider and the merchant acts as the Business.

Cloudflare, Inc. — Edge serving of Lutiq landing pages (go.<brand>.com), DNS, TLS termination, DDoS protection, and storage of generated variant assets in R2 — USA
Google LLC (Google Cloud Platform) — Primary application hosting (Cloud Run), managed Postgres (Cloud SQL), Cloud Storage, and Cloud KMS, holding attribution events, hashed shopper identifiers, inferences derived from them, and Meta (Facebook/Instagram) data read on the merchant's behalf (ad accounts/campaigns/ads and performance, Facebook Page and Instagram content and insights), with access tokens encrypted via Cloud KMS — USA
Functional Software, Inc. d/b/a Sentry — Application error and performance monitoring for the edge router and backend services that ingest pixel events, with PII scrubbing applied. The pixel itself does not ship a Sentry client and does not transmit data to Sentry from the shopper's browser. — USA

C.3 Tier B — Sub-processors of Lutiq customer (merchant) personal information

Vendors that process personal information about Lutiq's own customers — i.e., the authorized users of merchant accounts — for billing, transactional email, account authentication, error monitoring, and support correspondence. With respect to this processing, Lutiq acts as the Business and the merchant's authorized user acts as the consumer.

Stripe, Inc. — Subscription billing, payment-method storage, invoice issuance, and Customer-record retention for merchant accounts — USA
Resend, Inc. — Transactional email delivery to merchant users (account verification, password reset, user invites, billing notifications, support correspondence) — USA
Functional Software, Inc. d/b/a Sentry — Error and session diagnostics for the Lutiq dashboard signed-in experience, with PII scrubbing applied — USA
Google LLC (Google Cloud Platform) — Hosting of merchant account, billing, and support records in Cloud SQL (Postgres) and Secret Manager — USA

C.4 Internal operations vendors (not sub-processors of personal information)

The vendors below support Lutiq's internal operations and do not, in the ordinary course, receive merchant or end-consumer personal information. They are listed here for transparency.

Slack Technologies, LLC — Internal team notifications about system events and Cloud Monitoring incidents; payloads are scrubbed of personal information before being sent — USA

C.5 LLM inference providers

Lutiq uses third-party large-language-model APIs to generate landing-page content from a merchant's own brand assets and product catalog. Prompts and completions consist of brand and product content supplied by the merchant or scraped from the merchant's storefront under the merchant's authorization; they do not contain end-consumer (shopper) personal information or merchant authorized-user personal information. Because no personal information is transmitted in the ordinary course, these providers are not Tier A or Tier B sub-processors. They are listed for transparency.

OpenAI, OpCo, LLC — Brand extraction and page-generation inference — USA
Anthropic, PBC (Claude API) — Brand extraction and page-generation inference — USA
Google LLC (Gemini API via google-genai) — Brand extraction and page-generation inference — USA
DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd.) — Brand extraction and page-generation inference — China
Moonshot AI (Beijing Moonshot AI Technology Co., Ltd.) — Brand extraction and page-generation inference using Kimi models — China
Alibaba Cloud (Alibaba Cloud Computing Co., Ltd. / Alibaba Cloud (Singapore) Pte. Ltd.) — Brand extraction and page-generation inference using Qwen models via the DashScope API — China (with Singapore-resident billing entity for international customers)

See the AI Transparency Statement for a plain-language description of how these providers fit into the Service.

C.6 Self-hosted components (not sub-processors)

The components below are open-source software that Lutiq operates itself inside its own Google Cloud Platform tenancy. They are not engaged as third-party sub-processors and do not transfer personal information outside of Lutiq's GCP project boundary. They are listed here so readers do not mistake the brand names for SaaS engagements.

Keycloak — self-hosted identity and access management (Cloud Run + Cloud SQL within Lutiq's GCP project)
Arize Phoenix — self-hosted LLM-tracing and observability backend (Cloud Run + Cloud SQL within Lutiq's GCP project)

C.7 Shopify

Lutiq integrates with Shopify under the merchant's authorization. Shopify is the merchant's own e-commerce platform and is not a sub-processor of Lutiq. The merchant's relationship with Shopify is governed by the merchant's own agreement with Shopify, Inc. Lutiq is not affiliated with, endorsed by, or sponsored by Shopify, Inc.

C.8 Notice of Sub-processor Changes

Lutiq maintains the sub-processor list in this Part and updates it as its vendors change, and maintains an email list (see below) to which it sends notice of those changes. Lutiq does not commit to a fixed advance-notice period, or to an objection-and-termination right, for sub-processor changes. If you have concerns about a particular sub-processor, contact [email protected].

To subscribe to email notifications of sub-processor changes, send a request to [email protected] from the email address you want to subscribe. Subscribers will receive notice when Lutiq adds or removes a sub-processor. To unsubscribe, reply with "UNSUBSCRIBE" in the subject line.

Part D — Common Provisions

D.1 Service Availability — United States Only

The Lutiq Services are currently intended for, and offered in, the United States only, and are not directed to, or offered to, individuals located in the European Economic Area, the United Kingdom, or Switzerland; Lutiq does not provide the data-subject-rights mechanisms of the EU or UK General Data Protection Regulation. Lutiq routes traffic that it identifies as originating outside the United States away from the Lutiq experiment — such visitors are not served a Lutiq variant, and their personal data is not collected or retained — and Lutiq's customers acknowledge that this is how such traffic is handled. Lutiq's customers (merchants) also agree, under the Terms of Service and Data Processing Addendum, to configure their own advertising and storefronts consistent with this United-States-only scope. This Policy and the rights it describes are governed by the privacy laws of the United States and its states.

D.2 Changes to This Privacy Policy

Lutiq may update this Privacy Policy from time to time. Material changes will be communicated by posting the updated Policy at lutiq.com/privacy and, where required, by direct notice to affected customers or end consumers. The effective date shown at the top of this Policy reflects the most recent revision. For changes to Part C (Sub-processors), Lutiq will notify subscribers of the [email protected] mailing list of additions to or removals from its sub-processor list.

D.3 Contact Us

For questions about this Privacy Policy or to exercise your rights:

General privacy inquiries: [email protected]
Sub-processor change notifications: [email protected]
AI-specific concerns or feedback: [email protected]
Authorized agent submissions: [email protected] (with the documentation described in §A.9.6)

Lutiq LLC 2261 Market Street, STE 88210 San Francisco, CA 94114 United States