Ply privacy policy
Ply is a Shopify app that shows product recommendations in a store's theme and reports how they perform. This policy explains what Ply collects, why, how long it keeps it, and how it is deleted. "Merchant" means the store owner who installs Ply; "shopper" means a visitor to that store.
What Ply does not collect
Ply does not collect or store shopper names, email addresses, phone numbers, postal addresses or payment details. It uses only the order and product fields listed below (Shopify's protected customer data "Level 1": order data without personal fields). Ply does not sell data, does not use it for advertising, does not share it with data brokers, and does not send it to any third-party AI or language-model service.
What Ply collects and why
| Data | Source | Used for |
|---|---|---|
| Product catalog: IDs, titles, product types, tags, prices (including Markets prices), image URLs, inventory and status | Shopify Admin API and product webhooks | Choosing and displaying recommendations |
| Orders: order ID, order time, product IDs in the order, and for recommended items the line amount and currency | Shopify Admin API and order webhooks | Learning which products are bought together; counting orders for plan limits; reporting influenced revenue |
| Storefront events: when a Ply recommendation is shown, clicked or added to cart, which products, which placement, and a time | Ply theme blocks via Shopify's web pixel | Reporting and the 7-day attribution described below |
A random browser ID (stored in the shopper's browser as ply_cid, and on the cart as the attribute _ply_cid) | Ply theme blocks | Linking a click to a later order in the same browser. It is not tied to a name, email or Shopify customer account. |
| Merchant store details: shop domain, currency, plan, settings, and Shopify access tokens | Shopify on install | Running the app and billing through Shopify |
Attribution
If a shopper clicks a Ply recommendation and the same browser orders that product within 7 days, Ply records the order line as "influenced" by Ply (last click wins). Ply reports this as influenced revenue, not as revenue Ply caused.
Where data is stored
Ply runs on Render (render.com) in the United States, with a managed PostgreSQL database in the same US region. Shopify processes billing; Ply never sees card details. The hosting provider may keep standard server logs, which can include IP addresses, for a short time for security and troubleshooting. Ply does not store shopper IP addresses in its database.
How long data is kept
- Storefront events: 90 days, then deleted automatically.
- Order rows and attributions: up to 365 days, the window Ply uses to learn product pairs, then deleted automatically.
- When a merchant uninstalls Ply, their access tokens are deleted immediately. All remaining store data is deleted when Shopify sends the shop data-erasure request (shop/redact), normally 48 hours after uninstall.
Shopper privacy requests
Shoppers should contact the merchant, who can request access or erasure through Shopify. Ply receives Shopify's mandatory privacy webhooks: for a customer data request, Ply holds no personal profile to return; for a customer erasure request, Ply deletes the listed orders' rows and attributions; for a shop erasure request, Ply deletes all of that store's data. Clearing browser storage removes the random browser ID.
Security
Data is sent over HTTPS. Shopify requests are verified with Shopify's signatures and session tokens. Access to the production systems is limited to Kingery Labs.
Changes and contact
We will update this page if Ply's data use changes, and change the effective date. Questions: Kingery Labs, Missouri, USA, gkingery91@gmail.com.