Privacy Policy

Who we are

Nepila is an independent software studio and the operator of this site, of the Shopify app MerchantOS: Visitor Intent, and of NewsQuoted. For questions about this policy, write to nepilanep@gmail.com.

Where a merchant installs MerchantOS, that merchant is the data controller for their shoppers' data and we act as their processor. For this website and for NewsQuoted, we are the controller.

What MerchantOS collects

Installed on a Shopify store, the app records:

• —Behavioural events. Page views, product views, cart actions and the checkout milestones Shopify exposes to apps (contact details entered, address entered, shipping chosen, payment entered, order completed), plus timing and scroll depth.
• —Session and device context. A generated session identifier, the referring source, and coarse device type (mobile or desktop).
• —A hashed IP address. The raw address is never written to our database; it is passed through SHA-256 and truncated on arrival, and is used only to group a returning visitor with their earlier session.
• —Order and cart values from the merchant's Shopify webhooks, so the reports can state the money attached to a drop-off.
• —A shopper's email address only where they entered one at checkout, and only so the merchant can follow up on their own cart. We do not enrich it, resell it, or use it to build any profile across stores.

We do not collect names, addresses, payment details, or card information. Payment data never touches our systems — Shopify handles checkout, and the app only ever learns that a step was reached.

Consent

The app runs inside Shopify's web pixel sandbox and is subject to the store's own customer privacy settings. Where a store asks visitors for tracking consent and a visitor declines, Shopify does not load our pixel at all, and we receive nothing about that visitor. That is enforced by Shopify, not by us.

How long we keep it

• —Raw behavioural events are deleted automatically after 90 days.
• —Visitor records with no further activity are deleted after 180 days.
• —When a merchant uninstalls, their data is scheduled for deletion and removed once Shopify confirms the uninstall, within 48 hours.
• —A merchant can delete an individual visitor from their dashboard at any time.

Your rights

We support the three privacy requests Shopify requires of every app — a shopper's data request, a shopper redaction, and a full shop redaction — and act on them automatically when Shopify forwards them. If you are a shopper, the fastest route is to ask the store you visited; they can raise the request through Shopify and it reaches us the same day.

You can also write to us directly to ask what we hold, to get a copy of it, to correct it, or to have it deleted. Depending on where you live, you may have these rights under the GDPR, the UK GDPR, or similar laws; we honour them regardless of where you live.

Who else processes it

We keep this list short on purpose:

• —Shopify — the platform the app runs on, and the source of the events and order webhooks.
• —Our hosting provider — runs the servers and the database that hold the data described above.
• —DeepSeek — generates the written summary of an individual session. It receives the behavioural events for that session and no shopper contact details. It is not involved in any figure in the Leak Report, which is computed entirely by us.
• —Resend — delivers the weekly report email to merchants and any offer email a merchant chooses to send.

We do not sell personal data, we do not share it with advertising networks, and we do not combine one merchant's data with another's.

This website and NewsQuoted

nepila.com sets no advertising or analytics cookies and needs no account. NewsQuoted is free to read, needs no account, and publishes only material that is already public — quotes drawn from published articles, each linked back to its source.

Changes

If this policy changes in a way that affects what we collect or who processes it, we will update the date at the top and, where the change is material, tell merchants by email.