Privacy Policy

2.1 Merchant Data

When you install ParticleSearch via Shopify OAuth, we collect and store the following:

• Store URL and Shopify domain
• OAuth access token and approved Shopify permission set
• Catalogue data: products, variants, titles, descriptions, prices, SKUs, barcodes, images, tags, selected metafields and metaobjects, and inventory status
• Email address (if you contact support or subscribe to updates)
• Permission and installation state for optional product capabilities
• Required: read_products, read_inventory, and read_metaobjects for catalogue search
• Optional: read_content for page and article search; read_orders, read_customer_events, and write_pixels for Shopify-verified revenue attribution

We do not collect your Shopify admin password or customer payment-card details. Optional revenue attribution uses limited completed-order evidence described below; it does not request customer names, email addresses, phone numbers, or postal addresses.

2.2 End Customer Data (Shoppers on Your Store)

When a shopper uses the ParticleSearch widget on your store, we process and log:

• Search queries (the words they type into the search bar)
• Search results, impressions, clicks, product actions, filters, refinements, and exits
• Storefront surface, locale or market context, timestamps, and a store-scoped pseudonymous session identifier
• Recent-search and in-progress search state stored in the shopper's browser session
• When revenue attribution is enabled: a pseudonymised order identifier, order totals and currency, discount, tax and shipping totals, purchased product and variant line items, checkout time, and the eligible ParticleSearch touchpoints connected to that checkout

Search analytics are provided to the merchant that operates the store. Before persistence, ParticleSearch replaces raw browser session and order identifiers with store-scoped, non-reversible identifiers and redacts high-confidence email, phone, payment-card, and URL patterns from free-text search data. ParticleSearch does not request customer contact fields for analytics and does not use the identifier to track a shopper across different merchants. The storefront uses sessionStorage and, when attribution is enabled, limited localStorage to preserve search context.

2.3 Website and Contact Data

When you browse particlesearch.com or send the contact form, we may process:

• Standard network, request, device, and security metadata used to deliver and protect the website
• Your name, email address, message, and any optional phone, store, catalogue-size, or current-provider details you submit

We use contact-form data only to respond, provide requested support or commercial context, protect the form from abuse, and retain appropriate business records.

2.4 Technical & Usage Data

We collect standard technical data to operate and improve the service:

• API request metadata and error logs used for service reliability, security, debugging, and incident response
• Error logs (to diagnose issues)
• Search analytics and pseudonymous session evidence linked to the merchant's store for reporting and service operation
• Limited completed-order evidence when the merchant enables Shopify revenue attribution
• Performance metrics (query response times, sync latency) are aggregated, anonymised, and retained.
• Search analytics are linked to your store and provided to you for reporting purposes through store-scoped pseudonymous identifiers. We may aggregate and anonymise search analytics across multiple stores for service improvement, industry benchmarking, and research purposes.

2.5 Optional Email Updates

If you choose to receive ParticleSearch updates, we collect your email address, the date and status of your consent, and the page or signup location where you submitted it. We use the page context to understand which content is useful and to keep future communication relevant.

We use double opt-in: an email address is not added to the confirmed update list until you click the confirmation link. Unconfirmed addresses are not used for marketing communications.

4.1 Security Standards

• Data transmitted over public networks is protected using TLS
• Shopify OAuth tokens are stored securely in an encrypted database with access restricted to authorized systems only
• Access to production systems is restricted to authorized personnel
• We use anti-abuse rate limiting to prevent unauthorized access

4.2 Data Location

Your product catalogue data is stored and indexed on our infrastructure. Search queries are processed as requests arrive and are aggregated by store for analytics purposes. We use third-party infrastructure providers (including cloud hosting and Typesense for our search engine, Supabase for application data, and Resend for transactional email delivery). These providers are contractually bound to protect your data and process it only on our instructions.

4.3 Retention

• Product catalogue data: retained while your account is active, deleted within 30 days of account termination
• Service and security logs: retained under the applicable operational and security retention schedules, then deleted or anonymised, subject to legal and backup exceptions
• Contact messages: retained as needed to respond, provide support, maintain appropriate business records, and meet legal obligations
• Search analytics: retained while your account is active. Aggregated, anonymised analytics may be retained indefinitely for service improvement, industry benchmarking, research, and other purposes.
• Email addresses: retained until you unsubscribe or request deletion
• Email signup page context and consent records: retained with the associated email address
• OAuth tokens: deleted immediately upon uninstall