Privacy Policy

Who we are

RioReply is an AI marketing autopilot for Shopify merchants. We help merchants analyze store and customer behavior to send relevant, personalized marketing emails. For privacy questions or requests, contact us at privacy@rioreply.app.

Who this policy applies to

• Merchants who create a RioReply account or connect a Shopify store.
• Store visitors and customers of merchants who use RioReply tracking and marketing features.
• Website visitors to https://www.rioreply.app.

Information we collect

Merchant account data

• Name, email address, and authentication details.
• Team and billing information when applicable.
• Email domain and sending configuration.

Shopify store data (via Shopify APIs)

When a merchant connects Shopify, RioReply accesses store data authorized by the merchant during installation. This may include:

• Store information: store name, domain, currency, timezone, and contact email.
• Products: titles, descriptions, prices, inventory, images, tags, and URLs.
• Customers: name, email, phone, order count, total spent, marketing consent status, and purchase dates.
• Orders: order ID, line items, totals, currency, status, and associated customer.

Storefront behavior data (tracking script)

Merchants may install a RioReply tracking snippet on their Shopify storefront. This captures behavioral events such as:

• Page views, product views, and collection views.
• Search queries.
• Add to cart, checkout started, and purchase events.
• Anonymous visitor and session identifiers stored in first-party cookies (_rr_vid, _rr_sid).
• Page URL, referrer, and browser user agent.

Storefront tracking does not intentionally collect payment card numbers or Shopify admin credentials.

Email engagement data

• Email delivery, open, click, bounce, and unsubscribe events.
• Campaign and message metadata needed to measure performance.

Website analytics

Our marketing site may use privacy-friendly analytics to understand aggregated traffic. We do not use this data to identify individual visitors.

How we use information

• Provide, operate, and improve RioReply.
• Synchronize Shopify store, product, customer, and order data for the connected merchant.
• Analyze customer behavior and purchase patterns to identify marketing opportunities.
• Generate and send personalized marketing emails on behalf of the merchant, respecting consent and frequency limits.
• Measure campaign performance and revenue attribution.
• Maintain security, prevent abuse, and comply with legal obligations.

We do not sell personal information. We do not use Shopify customer data for advertising outside the merchant's own store marketing.

Legal bases (EEA/UK)

Where applicable, we process data based on: (1) contract — to provide RioReply to merchants; (2) legitimate interests — to secure our services and improve product functionality; (3) consent — for marketing emails where required; and (4) legal obligation — where required by law.

Merchants are responsible for obtaining any required consent from their customers before sending marketing communications.

Data sharing

We share information only with service providers that help us operate RioReply, such as hosting, database, email delivery, and payment processors. These providers process data on our instructions and under appropriate agreements.

We may also disclose information if required by law or to protect the rights, safety, and security of RioReply, merchants, and users.

Data retention

• Merchant account data is retained while the account is active and as needed afterward for legal and billing purposes.
• Shopify store data is retained while the store remains connected.
• Storefront events are retained to support behavior analysis and marketing decisions, typically up to 24 months unless deleted earlier.
• Email logs and engagement data are retained as needed for deliverability, analytics, and compliance.

App uninstall and data deletion

When a merchant uninstalls the RioReply Shopify app or disconnects their store:

• We stop syncing new Shopify data immediately.
• We mark the store connection as uninstalled and revoke ongoing API access.
• Connected Shopify data (products, customers, orders, storefront events) is scheduled for deletion within 30 days unless the merchant requests earlier deletion or retention is required by law.
• Merchants may request deletion at any time by emailing privacy@rioreply.app.

Security

We use industry-standard measures to protect data, including encrypted connections (HTTPS/TLS), access controls, and secure storage of credentials such as Shopify access tokens. No method of transmission or storage is 100% secure, but we work to protect information appropriately.

International transfers

Data may be processed in countries other than where you live. Where required, we implement appropriate safeguards for cross-border transfers.

Your rights

Depending on your location, you may have rights to access, correct, delete, or export personal information, or to object to or restrict certain processing. Merchants can contact us to exercise these rights. End customers of a merchant should contact the merchant first; we will assist merchants with lawful requests.

Children

RioReply is not directed to children, and we do not knowingly collect personal information from children.

Changes

We may update this policy from time to time. Material changes will be reflected by updating the date below.

Contact

Privacy questions or data requests: privacy@rioreply.app