Wavelet

Privacy policy

Last updated November 3, 2026

Wavelet is a Shopify app that adds a slim bar under a store's menu, suggesting collections based on what a shopper is browsing. This policy explains what information the app uses, why, where it's kept, and how to have it deleted. Wavelet is run by an independent developer ("we" on this page); "you" means the merchant who installs it.

The short version

• We read your store's catalog (products, collections and menus) to work out how your collections relate.
• We never collect your customers' personal information. What a shopper browses stays in their own browser tab.
• We use a third-party AI service (Anthropic) to understand product and collection text. It receives catalog text only.
• To show you how shoppers use the bar, we count visits, suggestion clicks, add-to-carts and checkout starts (and, if you turn it on, orders and their subtotal). Only totals, never who the shopper is.
• Everything we keep about your store is deleted after you uninstall (48 hours later, when Shopify asks us to; backups expire within 7 days after that).

Information we access from your store

When you install Wavelet, Shopify asks you to approve these permissions:

• Products and collections (read only): titles, descriptions, product types, vendors, tags, options, prices, whether items are in stock, product custom fields (metafields), and which products are in which collections.
• Navigation menus (read only): which collections your menus link to, so we always treat them as pages shoppers can reach.
• Languages (read only): your store's primary language, so suggestion descriptions are written in it. We keep only the language code.
• Themes (read only): to check that the Wavelet app embed is switched on and where you placed the Wavelet bar block. We don't store theme files.
• Files (write): to save the collection map as a file in your store's Files, served from Shopify's CDN.
• Your Wavelet plan: your subscription status from Shopify's billing and your product count, to show your plan and its product limit.
• Customer events and pixels (optional): only if you turn on order measurement, to add the Wavelet pixel to your store (see below).
• Edit products (optional): only if you turn on Wavelet filters, to add Wavelet's own product fields (see below). Given back when you remove the last one.

We also keep your store's domain and the access token Shopify gives the app, so the app can work in the background (for example, to update the map when your catalog changes). We don't store information about you or your staff.

How we use it

• To build your collection map: which collections relate, how, and a short description for each link.
• To tag products with attributes shoppers choose by (like category or material), so suggestions match what a shopper looks at.
• To show store health findings in the app (for example, duplicate or internal-looking collections).
• To keep the map up to date: when products or collections change, Shopify notifies the app and the map is rebuilt.
• To show you results: how shoppers use the bar, and what visits that used it went on to do compared with visits that didn't.

We don't sell your data, use it for advertising, or combine it with other stores' data to identify anyone.

Your customers (shoppers)

The suggestion bar runs entirely in the shopper's browser. To personalize suggestions during a visit, it keeps a short record of what they browse in your store: the collections and products they view, the filters and searches they use, the name of the ad campaign they arrived from (if the link has one), items they add to the cart, and which suggestions they click or quickly leave. The record also holds a random identifier, so the shopper sees the same version of the bar on every page. It's stored in the browser's session storage for that one tab, is only kept when the shopper's cookie and privacy choices allow it (through Shopify's Customer Privacy API), disappears when the tab is closed, and is never sent to us.

Besides its own script and styles, the only thing the bar downloads is your store's collection map; all of it is served by Shopify's CDN. To notice cart additions, it reads your store's own responses to "add to cart" in the browser.

Measuring results

To show how shoppers use the bar, with the shopper's analytics consent (through Shopify's Customer Privacy API), the bar's script counts: visits, pages viewed, how many suggestions were shown, whether a suggestion was clicked and whether the click led to a product page, whether the visit added something to the cart, and whether it started checkout (for these two, also whether the visit had clicked a suggestion by then). Visits are randomly assigned to a version of the bar (for example with suggestion descriptions shown or hidden), and normally stay in it for the whole visit, so versions can be compared. Only if you ask us to measure the bar's effect, a share of visits set for your store sees no suggestions, as a comparison group.

Each count sent to our server contains only your store's domain, the version of the bar, the type of event, for page views the number of suggestions shown, for add-to-carts and checkout starts whether they came after a suggestion click, and for a visit's first click whether the visit had already added to cart or started checkout. No customer names, email addresses, phone numbers, addresses, products or identifiers. Our server adds each count to daily totals per store and version and keeps nothing else. It uses the request's IP address only in memory, to limit abuse, and doesn't store it; our hosting provider's standard request logs may include it for up to 7 days. So a visit isn't counted twice, the script keeps a short note in that browser tab's session storage (which steps were already counted, the cart size last seen, whether a suggestion was clicked, and whether the latest click has led to a product page yet), which disappears when the tab is closed.

Optional: order measurement

Checkout runs on Shopify's pages, where the bar's script doesn't run. If you turn on order measurement in the app's Results page, Shopify asks you to allow the "customer events" permission and the Wavelet pixel (a Shopify web pixel running in Shopify's sandbox) is added to your store. Shopify's wording for that permission mentions customer information because the permission could include it; Wavelet doesn't request access to customer information, so Shopify withholds names, email addresses, phone numbers and addresses from the pixel.

For each completed order, the pixel sends only your store's domain, the version of the bar the shopper saw, whether the visit had clicked a suggestion, and the order's subtotal (before shipping and taxes) and currency. If the shopper clicks a suggestion later in the same visit, it sends that order's subtotal and currency once more, marked as placed before the click, so it isn't counted as a visit that didn't use the bar. No order numbers, products or customer details. It keeps a short note in the tab's session storage (the version, whether a suggestion was clicked, the orders already counted so none is counted twice, and the subtotal and currency of orders placed before a click), which disappears when the tab is closed. Shopify only runs the pixel when the shopper's privacy choices allow analytics. Turning order measurement off removes the pixel and gives the permission back.

Measurement is never used for marketing or advertising, and the data isn't sold or shared. Apart from this, we don't use cookies, tracking pixels or third-party analytics on your storefront, and we don't receive names, email addresses, orders or any other customer information. Because we hold no customer data, Shopify's customer data and deletion requests have nothing to return or erase.

Optional: Wavelet filters

If you turn on filters in the app's Filters page, Shopify asks you to allow Wavelet to edit products. Wavelet then creates one product field (a metafield definition in the "wavelet" namespace) for each filter you choose, and saves on each matching product the attribute it already tagged (for example a material or finish). It doesn't change titles, descriptions, prices, tags, product types, categories, options or any other fields, and it never overwrites a value someone else put in its fields. These are catalog facts only, no customer data. Our database keeps a list of which values Wavelet wrote, so it can remove exactly those again. Removing filters in the app deletes them; uninstalling doesn't (Shopify ends the app's access at uninstall), so the fields stay in your store until you delete them under Settings → Custom data. To tidy filter values, Wavelet may send the attribute's values and a few product titles to Anthropic (see below).

Who processes the data

• Shopify: where your store and the app's saved settings and map live.
• Render (United States): hosts the app's server and its database (your store's domain, access token, product attributes, collection map data and the daily result totals), and keeps the server's logs (which include your store's domain) for 7 days.
• Anthropic (United States): an AI service that tags products and describes how collections relate. It receives catalog information only: your store's domain, product titles, types, tags and the first part of product descriptions, collection titles and descriptions, and typical prices per collection. Never customer information. Under Anthropic's commercial terms, data sent through its API isn't used to train their models.
• Cloudflare: runs our domain's DNS.
• Zoho Mail: hosts our support email (support@waveletapp.com), so messages you send us are stored there.

How long we keep it

We keep your store's data while Wavelet is installed. When you uninstall, the app's access to your store ends straight away, and when Shopify sends its data-erasure request (48 hours after uninstalling), we delete everything we keep for your store. Our hosting provider's automatic daily backups expire within 7 days after that, and server logs after 7 days. The app's settings live in your store as app data attached to the Wavelet installation. The collection map file may remain in your store's Files (named wavelet-map-…) until you delete it; it contains only catalog information. Product fields added by Wavelet filters stay in your store until you remove them (in the app before uninstalling, or under Settings → Custom data).

Your choices

• Pause the bar any time in the app's Settings, or switch off the app embed in your theme editor.
• Uninstall to stop all access and have your data deleted as described above.
• Email us to ask what we hold about your store, or to have it deleted sooner.

Security

Access tokens and store data are kept on our hosting provider's servers and only used by the app. Connections to Shopify, Anthropic and our server are encrypted (HTTPS). Shopify verifies every notification it sends the app.

Changes

If we change what the app collects or how it's used, we'll update this page and the date at the top before the change takes effect, and tell installed merchants in the app if the change is significant.

Contact

Wavelet is operated by an independent developer. Questions or requests about this policy or your data: support@waveletapp.com.