SIXFIT Analytics Privacy Policy
Version 1.0 · Last updated: October 2026
This privacy policy explains how the SIXFIT AnalyticsShopify app (“SIXFIT Analytics”, “we”, “us”, “our”), provided by SIXFIT, collects, uses, and protects data when installed on a merchant’s store.
SIXFIT AI B.V., Schipholplein 237, 6843 BR Arnhem, The Netherlands.
This policy covers the SIXFIT Analytics app only. For the Catalog Checkup app, see the Catalog Checkup Privacy Policy; for the SIXFIT app, see the SIXFIT App Privacy Policy; for the sixfit.ai website, see the Website Privacy Policy.
Who This Policy Is For
This policy is for Shopify merchants who install or are considering installing SIXFIT Analytics, and for shoppers who visit a store that uses it. It explains what the app records on the storefront, what it reads from the store, what we do with it, and how we protect it.
What the App Does
SIXFIT Analytics shows a merchant how shoppers use their storefront: what they search for, which menu links they click, and which filters and sort orders they use. It presents this in a dashboard inside the Shopify admin, with suggestions for what to change.
To do this it adds two things to the store: a Shopify web pixel, which records storefront activity, and a theme app embed, a small script that tells the pixel about menu clicks, filter changes and typed searches. Neither adds anything a shopper can see.
Our Role
When you install SIXFIT Analytics, you are the data controller for the data recorded on your storefront, and SIXFIT is the data processor: we record and analyse it on your behalf, to show you how your store is used.
Separately, SIXFIT is an independent controllerfor the limited business-contact information it uses to contact you about SIXFIT (see “Marketing and Outreach” below).
What Data We Collect
From visitors to your storefront (via the Shopify web pixel)
Recorded only for visitors who have allowed analyticsin your store’s cookie banner. Shopify enforces this: it does not run the pixel for a visitor who has not consented.
| Data | Why |
|---|---|
| A random browser identifier assigned by Shopify (its “client ID”) | Lets us count visitors instead of page loads. It is not a name or an account, and we cannot use it to tell who a visitor is |
| Pages viewed: the page address on your store (including search words and filter settings in it), page title, the address of the page the visitor came from, and browser window width | Shows which pages, collections and products are visited, and how visitors arrive at them |
| Searches: the words searched, how many products were found, and which products came first. Also words typed into a search box, even if the search is not submitted | Shows what shoppers look for and which searches find nothing |
| Clicks on links: the link’s text and address, and where on the page it sits (header, menu, footer) | Shows which menu links are used and which are ignored |
| Filters and sort orders chosen on collection and search pages | Shows which filters shoppers rely on |
| The time of each of the above | Lets the dashboard show activity per day and per period |
From your store (via the Shopify API)
| Data | Why |
|---|---|
| Shop domain (your .myshopify.com address) | Identifies which store the recorded activity belongs to |
| Shopify access token (and refresh token), stored encrypted | Lets the app switch on its web pixel and read your menus; refreshed automatically and deleted on uninstall |
| Your navigation menus (link titles and addresses) | Shows every menu link with its clicks, including links nobody clicked. Read when you open the dashboard and not stored |
The app requests three permissions: write_pixels and read_customer_events, which Shopify requires to switch on a web pixel, and read_online_store_navigation, to read your menus.
What we don’t collect:
- No names, email addresses, phone numbers or postal addresses of shoppers
- No Shopify customer accounts or customer IDs
- No orders, cart contents, checkout or payment data
- Nothing typed into forms, other than words typed into a search box
- No IP addresses are stored with the recorded activity
- No cookies of our own: the app relies on the identifier Shopify already assigns
What We Store
The app stores your Shopify session, where you are in the app’s setup, and the storefront activity described above, keyed to your shop domain. The dashboard shows it to you in aggregate: totals, daily counts and ranked lists.
How We Use This Data
- Showing your dashboard: counting and ranking the recorded activity for your store
- Suggesting changes: analysing your store’s activity to point out what to change, in the app or, where you work with SIXFIT, through our team
- Improving the app: using aggregated, de-identified statistics to improve how the app measures and what it suggests
- Marketing and outreach: contacting you about SIXFIT’s products and services (see below)
We do not:
- Sell data to third parties
- Use recorded activity for advertising or ad targeting, or share it with advertisers
- Combine one store’s visitors with another store’s to follow people across stores
- Try to work out who a visitor is
Marketing and Outreach
SIXFIT Analytics is a free tool offered by SIXFIT. When you install it, we may contact you about SIXFIT’s products and services.
For this we use your store’s business-contact details (such as business name, store URL, and business email), which we may obtain from Shopify, your public storefront, or reputable business-data providers. This is business-to-business outreach directed at the store, never at your shoppers.
You can opt out at any time by replying to any message, emailing hello@sixfit.ai, or uninstalling the app. See “Your Choices and Rights” below.
If You Are a Shopper
If a store you visit uses SIXFIT Analytics, your activity on that store is recorded only if you allowed analytics in the store’s cookie banner. You can withdraw that at any time through the store’s cookie settings, and recording stops.
The store is responsible for the data recorded on its storefront, so questions and requests about it are best sent to the store. Because we hold no name, email or account for you, we cannot look up your activity from your identity. If you believe we hold data about you, you can also write to dpo@sixfit.ai.
Legal Basis for Processing
Under the GDPR (Article 6), the following legal bases apply:
| Purpose | Legal basis | Explanation |
|---|---|---|
| Recording storefront activity | Consent (Art. 6(1)(a)) | Collected by you, the merchant, through your store’s cookie banner. Nothing is recorded for a visitor who has not allowed analytics |
| Showing your dashboard and suggestions | Contract performance (Art. 6(1)(b)) | Necessary to provide the app you installed |
| Improving the app (aggregated statistics) | Legitimate interest (Art. 6(1)(f)) | Our interest in improving the app, using de-identified data |
| Business-to-business marketing and outreach | Legitimate interest (Art. 6(1)(f)) | Our interest in offering relevant services to merchants who installed a free tool; you may object at any time |
Third-Party Services
- Shopify: the web pixel and theme app embed run on Shopify’s platform, and we read your menus through Shopify’s APIs. Shopify’s privacy policy
- Hosting: our servers are located in the European Union.
- Cloudflare: requests to the app pass through Cloudflare’s network, which handles IP addresses in transit to deliver them. We do not store IP addresses with the recorded activity.
- Internal alerting: we send ourselves an internal notification (containing your shop domain) when the app is installed, so our team is aware of new installs.
- Business-data providers: we may use reputable providers to look up publicly available business-contact details for the outreach described above.
We do not sell personal data, and we do not share recorded activity with advertisers or other third parties.
How Long We Keep Data
| Data | Retention | Notes |
|---|---|---|
| Shopify session / access token | Until uninstall | Deleted when you uninstall the app |
| Recorded storefront activity | While installed | Recording stops when you uninstall. The stored activity is erased within 48 hours of uninstall, via Shopify’s shop-redact webhook |
| Business-contact details (outreach) | Until you opt out | Removed on request or when no longer needed for outreach |
Shopify Compliance Requests
Shopify sends apps three privacy webhooks. SIXFIT Analytics stores no customer accounts, names, emails or customer IDs, so recorded activity cannot be matched to a Shopify customer:
- Customer data request: we hold nothing that can be identified as that customer’s.
- Customer redact: we hold nothing that can be identified as that customer’s.
- Shop redact: we delete your store’s session, setup record and all recorded activity (Shopify sends this about 48 hours after uninstall).
Data Security
- Data is encrypted in transit between browsers and our network (TLS/HTTPS)
- All data is encrypted at rest (encrypted database storage)
- Our servers are hosted in the European Union
- Access to production data is restricted to authorized personnel only
- We use Shopify’s HMAC verification to validate webhook requests
- Everything the storefront sends is checked and size-limited before it is stored
International Data Transfers
Our servers are in the European Union. If your store or its visitors are outside the EU, the data described here is transferred to and processed in the EU.
Your Choices and Rights
As a merchant, you can:
- Stop menu and filter recording: switch SIXFIT Analytics off under App embeds in your theme editor
- Stop all recording and delete your data: uninstall the app; recording stops and stored activity is erased within 48 hours
- Opt out of outreach: reply to any message or email us to stop marketing contact
- Access, correct, or export: contact us to exercise your GDPR rights
- Object: object to processing based on legitimate interest, including outreach
If California residents’ information is involved, note that under the CCPA/CPRA we do not sell personal information or share it for cross-context behavioral advertising. California consumers may exercise their rights by contacting us.
Children
SIXFIT Analytics is a business tool for merchants and is not directed at children. We do not knowingly collect data from children.
Changes to This Policy
If we make changes, we’ll update the date at the top. For significant changes that affect how we process data, we will make the updated policy available here.
Contact Us
If you have questions about this privacy policy or how we handle data:
SIXFIT AI B.V.
Schipholplein 237, 6843 BR Arnhem, The Netherlands
hello@sixfit.ai
For data protection inquiries, you can also contact us at dpo@sixfit.ai.
If you are in the EU and believe we have not addressed your concerns, you have the right to lodge a complaint with your local data protection authority.