Privacy Policy

Effective date: July 15, 2026 · Last updated: July 23, 2026

evolution ("we", "us") operates runevolution.io and the evolution service (the "Service"). This policy explains what we collect, why, and your choices.

1. Information we collect

• Account and contact info: name, email, and details you give us.
• Store information: information about your store that you share or connect, which may include store URL, product and order data, customer service content, and analytics, so we can perform the work you ask us to do.
• Payment info: processed by our payment providers — Shopify (for subscriptions started from the Shopify App Store, billed on your Shopify invoice) or our third-party payment provider, who acts as the merchant of record (for direct signups). We do not store full card numbers.
• Usage data: how you use the Service, plus standard log and device data (IP, browser).
• Cookies/analytics: we use cookies and analytics to run and improve the Service.

2. How we use it

• To provide, operate, and improve the Service and perform the tasks you request.
• To communicate with you (support, updates, and, where permitted, marketing you can opt out of).
• To process payments, prevent fraud, and meet legal obligations.

3. How we share it

We do not sell your personal information. We share data only with:

• Service providers / subprocessors who help us run the Service (for example hosting, analytics, payment processing, and AI/model providers), under confidentiality obligations and only as needed.
• Legal reasons, if required by law or to protect rights and safety.
• Business transfers, if we are involved in a merger or acquisition.

4. Store and customer data

When you connect or share your store data, you authorize us to access and process it only to perform the work you request. We access the minimum needed, do not use your store's customer data for any purpose other than serving you, and you can revoke access at any time.

5. Shopify stores

When you install Evolution from the Shopify App Store or connect your Shopify store, we request read-only access to products, orders, checkouts, and customers. Here is exactly how that data is handled:

• We do not store your customers' personal data. Customer names, emails, and checkout links are fetched live from Shopify when you open a panel (cart recovery, retention) and are shown only to you, the signed-in store owner, in your browser. They are never written to our database and never included in AI model prompts.
• What we do store: your store's domain, an encrypted-at-rest API access token, aggregate audit results (counts and totals — no names or emails), operational event metadata (order numbers, product titles, amounts), and the message templates you write.
• Mandatory privacy webhooks: we implement Shopify's customers/data_request, customers/redact, and shop/redact webhooks. Because we hold no customer records there is normally nothing to produce or erase, and we respond to data requests within 30 days. When you uninstall the app, Shopify's shop/redact notice triggers deletion of your store's remaining data (connection, events, audit history, templates) within 48 hours of receipt.
• Uninstalling: uninstalling the app immediately revokes our API access on Shopify's side and we discard our copy of the access token.

6. Subprocessors

We use a small set of infrastructure providers to run the Service:

• Vercel — application hosting.
• Supabase — database and authentication.
• Groq — AI model inference. Prompts contain aggregate store metrics and product info only; customer personal data is never sent to model providers.
• Resend — transactional email to our team and account emails.
• Shopify / our third-party payment provider (merchant of record) — billing, as described above.

7. Data retention and security

We keep data only as long as needed to provide the Service and meet legal obligations, then delete or anonymize it. We use reasonable technical and organizational measures to protect data, though no method is 100% secure.

8. Your rights

Depending on your location, you may have rights to access, correct, delete, or export your data, and to object to certain processing. Email subhan@runevolution.io or muneeb@runevolution.io to make a request.

9. International users

We may process data in countries other than yours. By using the Service you consent to this, subject to applicable law.

10. Children

The Service is not for anyone under 18. We do not knowingly collect data from children.

11. Changes

We may update this policy and will post the new effective date. Significant changes will be communicated where required.

12. Contact

Questions or requests: subhan@runevolution.io or muneeb@runevolution.io.