Privacy Policy

Lemon is an analytics app for Shopify stores. It reads a merchant's order and cart data to work out which marketing channel produced each sale, and shows the result back to that merchant.

We never store IP addresses, we never track anyone across other websites, and we never sell data or use it to target advertising. Our access to Shopify and to connected ad platforms is read-only.

Merchants are the people who create a Lemon account and connect a store. For their account data, Lemon Analytics is the data controller.

Shoppers are the customers of those stores. We only ever see shopper data because a merchant connected their store and asked us to analyse it. For that data the merchant is the controller and Lemon Analytics acts as a processor on their instructions.

• Store IP addresses.
• Track people across websites we do not operate.
• Sell, rent or share data with data brokers.
• Use shopper data to target advertising.
• Write to your store or your ad campaigns.
• Use one merchant's data to serve another.

We keep the number of subprocessors small. Application hosting is provided by Vercel, and the database is managed PostgreSQL hosted by Neon in the AWS US-West-2 region. Data reaches Shopify, Meta and Google only as requests we make to their APIs on your behalf.

We may disclose data if the law compels us to, and we will tell the affected merchant unless we are legally prohibited from doing so.

Data is stored in the United States. If you or your shoppers are in the European Economic Area or the United Kingdom, that means data is transferred out of your region; those transfers rely on the European Commission's Standard Contractual Clauses with our subprocessors.

Shopper details: 13 months. Buyer email addresses, names, and city and region are erased automatically 13 months after the order or cart they came from. That is the longest period the app reports on, so nothing a merchant can look at goes missing, and past it those details serve no purpose. The erasure is a scheduled job that runs daily; nobody has to ask for it.

Order totals and counts: while the store is connected. Amounts, dates, channels and product names are not personal data, and historical orders are what year-over-year comparisons are made of, so these stay. Country is kept too — it cannot identify a shopper and the reports break sales down by it.

Everything, on disconnect. Disconnect a store from Settings, or uninstall the app, and the whole of that store's data is deleted. Uninstalling stops all processing at once and revokes our access; Shopify then sends us a shop erasure request, which we act on automatically. If the store was the only one on an account created by an install, the account goes too.

A record that we answered a customer data request is kept for 90 days afterwards, then deleted, because it holds the requester's email. Erasure requests forwarded by Shopify are handled as described below whether or not the store is still connected.

Shoppers: please contact the store you bought from. Because the merchant is the controller of your data, requests properly begin with them. Lemon implements Shopify's mandatory privacy webhooks, so when a store forwards a request to access or erase your data, we act on it automatically and return everything we hold about you, or delete it.

Merchants: you can reach your data in the app at any time, and Settings has a Disconnect button on each store that deletes everything we hold for it. Uninstalling the app from your Shopify admin does the same. Depending on where you live you may also have rights to access, correct, export, restrict or object to our processing — write to us and we will action it.

Depending on your jurisdiction you may also have the right to complain to a data protection authority.

Connections are encrypted in transit and the database is encrypted at rest. Passwords are stored only as hashes. Access tokens for Shopify and the ad platforms are encrypted a second time by the application before they are written, so a leaked database would not yield a usable credential for any store, and they are held for the sole purpose of making the read-only API calls described above. Every query is scoped to the account that owns the store. No system is perfectly secure, but we would rather hold less data than defend more — which is why there are no IP addresses or payment details here at all.

Lemon is a tool for businesses and is not directed at children. We do not knowingly collect data from anyone under 16.

If we change this policy we will update the date at the top, and for anything material we will tell connected merchants directly rather than relying on you to notice.

Questions, requests or complaints about privacy go to wristworld11@gmail.com.