Smaily Connect — Privacy Policy

Effective date: 17 October 2026

Smaily Connect (“the app”) connects an e-commerce store (Shopify, WooCommerce, and other supported platforms) to the merchant’s own Smaily email-marketing account and, optionally, to Smaily Campaign Intelligence. This policy explains what data is processed, why, where it goes, and how it is protected, on every platform Smaily Connect supports; where the mechanics differ by platform, this policy says so explicitly. The app is operated by Sendsmaily OÜ.

Data we process

• Customer name and email address — to sync the merchant’s subscribers and customers to the merchant’s own Smaily account, and (only when the merchant uses the Campaign Intelligence add-on) as Campaign Intelligence’s per-customer identity.
• Order and product / catalog data — to power automations (welcome, first order, abandoned cart) and, when enabled, product recommendations.
• Anonymous browse events — collected through a consent-gated mechanism specific to each platform: on Shopify, a sandboxed Web Pixel gated by Shopify’s customer-privacy (consent) API; on WooCommerce, a first-party script gated by the WordPress Consent API, off by default.

We request only the customer fields the app needs — name and email. We do not request phone numbers or postal addresses.

How we use it

• Syncing the merchant’s subscribers and contacts to their Smaily account, gated by marketing consent.
• Triggering the merchant’s chosen Smaily automations.
• Generating personalized product recommendations (optional paid add-on).

We do not sell personal data, and we do not use it for any purpose beyond those stated above.

Where data goes

• Always (core): the merchant’s own Smaily account.
• Conditional (paid add-on): Smaily Campaign Intelligence — only if the merchant subscribes to the Campaign Intelligence service. It is not enabled by default. The Campaign Intelligence API key is never exposed to the storefront.

Security

• Credentials and API keys are encrypted at rest (AES-256-GCM).
• All data is transmitted over HTTPS.
• Each store’s data is strictly isolated from every other store.

Data retention and deletion

How local data is stored and removed depends on how the platform is deployed:

• Shopify (hosted app): the app stores merchant and integration data in its own hosted database. Uninstalling triggers Shopify’s shop/redact request, which purges all of the app’s hosted records for that store. The app also prunes its own operational records automatically (event logs and transient queue / checkout records are kept only for a limited period).
• WooCommerce (self-hosted plugin): the plugin runs on the merchant’s own server, so there is no equivalent Smaily-side hosted app storage for this platform — the plugin’s local data (recommendation-engine markers on orders and users, and, if enabled, abandoned-cart session data) lives only in the merchant’s own WordPress database. Uninstalling the plugin removes that locally-stored data from the merchant’s WordPress database.
• Uninstalling (on any platform) does not automatically delete the merchant’s data held in Smaily or Campaign Intelligence — a merchant may uninstall only to switch e-commerce platforms while keeping their Smaily account and history. That data is retained under Smaily’s retention policy and is removed when the merchant explicitly closes those services, or on request (see “Your rights” below).
• Recommendation-engine retention (Smaily Campaign Intelligence, where enabled): Campaign Intelligence keeps each kind of data for the period below — the same periods a shopper’s data export from Campaign Intelligence lists. A nightly cleanup deletes the data automatically when its period ends.
  • Browse events (the pages and products a shopper viewed): kept for 90 days, then automatically deleted.
  • Email-interaction signals (email opens, clicks and similar events): kept for 365 days, then automatically deleted.
  • Visitor tokens: a visitor token is kept for 90 days from when it was created; a visitor token carried on an order — including one the store created at checkout for a shopper who accepted email marketing — is kept for 365 days from the latest order that carried it. An expired visitor token is automatically deleted.
  • A recommendation issued for a shopper and not replaced by a newer one: kept for 730 days, then automatically deleted.
  • A recommendation replaced by a newer one: kept for 180 days after the replacement, then automatically deleted; one still linked to a click or purchase record is kept as long as that record, at most 730 days.
  • Purchase-attribution records (which recommendation led to a purchase): kept for 730 days, then automatically deleted.
  • Engagement-state history (when a shopper moved from one engagement state to another, for example from “warm” to “lapsed”): kept for 730 days, then automatically deleted.
  • Signals that a shopper may be due a recommendation (for example, a product is about to run out): kept for 30 days after Campaign Intelligence acted on the signal, or 90 days after the signal arose if it never acted on it, then automatically deleted; one still linked to an issued recommendation is kept as long as that recommendation.
  • The internal decision log (why a recommendation was chosen): kept for 30 days, then automatically deleted.
  • The rule-learning log (how a recommendation’s result changed the weight of the rule that chose it): kept for 90 days, then automatically deleted.
  • Identifiers of data deliveries from the store (so that data sent twice is not stored twice): kept for 90 days, then automatically deleted.
  • Customer records, orders and the store’s product catalog: kept for as long as the merchant uses Campaign Intelligence, or until deleted on request; they are not deleted automatically.
• Storefront recommendations: when a shopper sees a Smaily recommendations block, the app keeps the products recommended for that shopper for up to one hour, under a one-way hash of the shopper’s customer id or visitor token, so the store does not ask Campaign Intelligence again on every page view.

Your rights

A specific individual’s data can be erased at any time, whether or not the app or plugin is currently installed. The mechanism depends on the platform:

• Export: on Shopify, the customers/data_request webhook returns an export of the data we hold for that customer; on WooCommerce, the merchant runs WordPress’s native Privacy Tools (Export Personal Data), which export both the plugin’s own locally-stored data and the corresponding recommendation-engine data.
• Erasure: on Shopify, the customers/redact request deletes that customer’s records from the app’s own storage — their records queued for Campaign Intelligence, their abandoned checkouts, any Smaily message still queued for them, and the app’s records of their welcome email and their marketing-consent state — and keeps their entries in the store’s event log with their email address replaced by “[erased]”, usually within hours. The address is matched in any letter case. If the store uses Campaign Intelligence, the app also asks Campaign Intelligence to delete the customer. On WooCommerce, the merchant runs WordPress’s native Privacy Tools (Erase Personal Data), which erase both the plugin’s own locally-stored data and the corresponding recommendation-engine data via the engine’s GDPR deletion API. On either platform, the contact stays in the merchant’s own Smaily account; the merchant removes it there if needed.

To exercise access, correction, or deletion rights, contact us at info@smaily.com.

Contact

Sendsmaily OÜ — info@smaily.com