Segmented — Privacy Policy

Last updated: October 23, 2026

Segmented (“the App”) provides customer segmentation and storefront personalization to Shopify merchants. It is operated by Nathaniel Hayoun, entrepreneur individuel (sole proprietorship), SIREN 880 917 604, Strasbourg, France (“we”), who acts as a processor on behalf of each merchant using the App (the controller of their customers' data). This policy describes what personal data the App processes, why, where, for how long, and how it is protected. Our Data Processing Agreement applies to every merchant.

Data we store

To evaluate segments in milliseconds, the App keeps a copy of the purchase data it needs:

• Customer purchase profile — Shopify customer ID, tags, amount spent, number of orders, account creation date, customer metafields.
• Orders — order ID, customer ID, dates, totals, discounts and discount codes, currency, billing country and province, payment and fulfillment status.
• Order line items — product, variant, options, title, SKU, vendor, price and quantity.
• Storefront events — product and collection views of signed-in customers, cart and checkout activity (customer ID when known, otherwise the cart token, the products and amounts).
• Engagement metrics — views and clicks on the App's storefront content, with a random session identifier and, when the visitor is logged in, their customer ID; orders attributed to that content (order and checkout ID, amount).
• Segment memberships — which customer IDs belong to which of the merchant's segments.
• Access log — when the merchant's staff open customer profiles or segment member lists in the App, and who was given or removed access to the store in the App.
• Merchant team accounts — the email address, name (optional) and password of each person of the merchant's team who signs in to the App, kept as a one-way hash (scrypt); the workspaces each person belongs to (a name chosen by the team, the store linked to it) and their role; their signed-in sessions (a random token kept as a hash, the browser type, the last activity date); sign-in attempts (email or IP address, success or failure) to stop password guessing. These are the merchant's staff, never the store's customers.

The App does not store customer names, email addresses, phone numbers or postal addresses. When the merchant's staff view a customer in the App, or when storefront content uses a customer variable (for example a first-name greeting), these values are read live from Shopify and not kept. Only the variables actually used by the content are sent to the customer's own browser.

Purpose

The data is used only to provide the App's features to the merchant: evaluating segments, showing the right content to the right customer, and reporting on that content — including, when the merchant runs a holdout test, showing a random share of eligible visitors the default content instead, to measure the effect of personalization. We do not sell personal data, share it with advertisers, or use it for any other purpose.

Segment sync (only if the merchant turns it on)

For a segment the merchant chooses, the App can write a customer tag on its members in the merchant's own Shopify store (and take it off when they leave), update the Klaviyo property described under Sub-processors, and send a Shopify Flow trigger to the merchant's store when a customer enters or leaves the segment (the customer, the segment's name and id). Tags stay in the merchant's store after the App is uninstalled, and the Klaviyo property stays in the merchant's Klaviyo account; the merchant can remove them in Shopify and in Klaviyo.

Cookies and browser storage on the storefront

• sgm_session_id (first-party cookie, 30 days) — a random identifier that groups the App's engagement metrics of one browser. It is also stored on the visitor's cart as a hidden attribute (_sgm_sid), which Shopify copies onto the order, so the merchant can see which content preceded a purchase.
• Browser storage (localStorage) — the products and collections the visitor viewed, to personalize content during their visit, and the cart lines (product variant and quantity) already reported to the App, so that only new additions to the cart are recorded; the date of the visitor's first visit (sgm.seen.v1), to tell first visits from returning ones; and the current visit (sgm.visit.v2: how it started — campaign parameters such as utm_campaign, the referring site and the landing page —, whether it is a first or returning visit, and the time of its last page; a visit ends after 30 minutes without a page). For the current tab only (sessionStorage), a note that the cart is already linked to the visit, so it isn't linked again.

These are set only once the visitor's privacy choices are known and allow analytics (Shopify Customer Privacy API), never during a merchant's preview, and are deleted — the cookie, the stored views and cart lines, and the cart attribute — when the visitor refuses or withdraws that consent.

The only other browser storage is functional, set without that consent because it only remembers the visitor's own choices: which popups they already saw, closed or removed and their notification counts. It holds popup identifiers; for each, the kind of trigger (always shown, segment, cart, product viewed) and codes of what triggered it — opaque codes signed by the App: not readable in the browser, though the App itself could recognise them — the day it was last served; and how many new carts were started and whether the cart was empty at the last check. For the current tab only, the announcement bars the visitor closed (sgm.bar.v1). A merchant who opens a preview or demo link also gets, for that tab only, the previewed customer and its own popup state; a debug flag is stored when the merchant opens a debug link. In the theme editor, nothing is stored unless the merchant opens such a link.

To decide which content or popup to show, the storefront sends the App the products in the visitor's cart and the product or collection of the current page, on pages showing Segmented content or popups — with analytics consent, also the products and collections viewed earlier. For the merchant's visitor rules, it also sends how the visit started (campaign parameters, referring site, landing page), the current page path, the country, market and language of the storefront, the device type (mobile or desktop), whether it is a first or returning visit, and the cart's value and number of items: these are used for that answer only and never stored by the App. Shopify adds the id of a signed-in customer to these requests. Without analytics consent, all of this is used for that answer only and never stored. The engagement metrics record which workflow rule served the content seen (for example a rule on a campaign or a country), with the visit's random identifier or the signed-in customer's ID, so the merchant can measure each audience — not the values themselves.

Where the data is hosted

On servers rented from Hetzner Online GmbH in Helsinki, Finland, with an encrypted backup copy in Nuremberg, Germany (European Union). The App does not transfer data outside the European Union, except to Klaviyo when the merchant connects it (see Sub-processors).

Retention

• Purchase data (customers, orders, line items) and segment memberships: kept while the App is installed, refreshed continuously from Shopify; deleted as soon as the App is uninstalled, except the memberships of segments that write a customer tag, kept until shop/redact so that tags can be removed correctly if the App is reinstalled.
• Storefront events and engagement metrics: 24 months, then deleted automatically.
• Access log: 12 months.
• Merchant team accounts: while the person keeps their account; a store's workspace and the team's access to it are deleted with the store's data (shop/redact); a person's access ends when a workspace owner or admin removes them; a workspace with no store yet can be deleted by its owner. Sessions end after 30 days without use; sign-in attempts are kept 90 days; emailed links (invitation, password reset) expire within 7 days and are deleted 30 days later.
• Customer data request exports: 90 days.
• Background tasks that failed (with the customer ID they were about): 7 days.
• Merchant configuration (segments, sections, workflows): while the App is installed. All remaining shop data is deleted when Shopify sends the shop/redact webhook (48 hours after uninstall).
• Encrypted database backups: daily backups kept 14 days, weekly backups 8 weeks, monthly backups 12 months. Data deleted from the App disappears from backups when they rotate.

Privacy requests

• customers/data_request — the App prepares an export of everything it stores about the customer; the merchant downloads it in App settings → Customer data requests and sends it to the customer.
• customers/redact — the customer's purchase data, events, memberships and access-log entries are deleted; metrics lose any link to the customer.
• shop/redact — all data for the shop is deleted.

Security

• Encryption in transit (TLS) and of third-party credentials at rest (AES-256-GCM).
• Daily AES-256-encrypted database backups.
• Database reachable only from the application server; SSH access by key only.
• Access to personal data through the App is logged; operator access is limited to the App's maintainers.
• Security incidents affecting personal data are notified to the merchant within 72 hours.

Sub-processors

• Hetzner Online GmbH (Germany; servers in Finland and Germany) — hosting and backups.
• Klaviyo (United States) — only if the merchant connects it, with the merchant's own Klaviyo account and API key: the App looks up customers' Klaviyo profiles by email and reads their email/SMS engagement (campaigns, flows, events). When the merchant turns on Klaviyo sync for a segment, the App also writes one profile property (segmented_segments) listing the names of the synced segments the customer belongs to. Nothing else is sent to Klaviyo.
• Resend (United States) — sends the App's account emails (invitations, password resets, address confirmations) to the merchant's team: the recipient's email address and the message only.
• The App's pages load fonts from Google Fonts (no customer data is sent to it).

Contact

Privacy questions and requests: nathi.hayoun@gmail.com