Deletion and the DPA
Export or delete your data from the Luria app, what Shopify's privacy webhooks remove, and how to get a signed Data Processing Addendum.
You can pull everything Luria holds for your store, or wipe it, from inside the app. Anything the app cannot cover is one email away.
What you'll need
- Shopify: the Luria app open in your admin, plus your
.myshopify.comdomain to type as confirmation. - Every other platform (GoHighLevel, the script tag or Cloudflare): your Luria dashboard, signed in, plus your site's domain to type as confirmation. The "Your data" card is under Settings, More settings.
- Anything else: an email to privacy@luriart.com.
Export everything
In the Luria app (or your dashboard), find the "Your data" card and click the download button.
You get one file with every record Luria holds for your store: your connection and site records, your consent record, your usage counters, data sync status, install events, every visitor event, recording record, test and test result, scan, AI note, campaign, testimonial and integration record, and (on Shopify) every synced Shopify object. Access tokens and other secrets are never included in an export.
Delete your data
Same card, click Delete my data…, then type your shop domain (Shopify) or your site's domain (everywhere else) to confirm.
That permanently removes everything Luria collected or worked out for your store: visitor events, session recordings and heatmaps, every test and its history, scans and screenshots, AI notes, campaigns, testimonials, synced Shopify objects and data sync jobs. What stays is what keeps the store connected: your sign-in, the connection, your site settings, your plan record and the terms you accepted. Uninstall (or ask us to close the account) to remove those too. There is no undo.
Without a delete, Luria removes old data on its own: raw visitor events after about 90 days, and session recordings after 180 days (what Luria learned from them is kept as rows that hold no raw recording).
Everything else, by email
Email privacy@luriart.com. That is the route for a script install, for erasing a named visitor, and for any access, correction, export or objection request. Luria replies within 30 days.
If you are a visitor to a merchant's store rather than the merchant, contact that store first. A request sent to Luria directly is honored either way.
What Shopify's privacy webhooks do
Shopify sends Luria three kinds of request, and each is handled automatically.
- Customer data request. Luria records the request and alerts its operator with a 30-day due date. Luria holds no customer identity beyond what Shopify sent in the request itself. You are the controller, so you answer your customer.
- Customer redact. That customer's stored record is deleted, their orders lose every field that names or locates them (the order totals stay, so your revenue numbers do not change), and the visits that placed those orders are erased: their events and session recordings.
- Shop redact. After an uninstall, everything Luria holds for the store is removed: visitor events, recordings, tests and their history, scans, screenshots, AI notes, the site and connection records, your consent record, usage counters, privacy-request records and every synced Shopify object. Large stores' stored files finish deleting within a day. One scrambled code made from your shop's address and the number of free conversions used stays, so a reinstall does not restart the free allowance.
The DPA
You are the data controller for your visitors. Luria is your processor, and processes their data only to deliver variants, measure them and attribute conversions.
The plain-language summary lives at luriart.com/data-processing. A signature-ready DPA, including the subprocessor list below, is available on request: email privacy@luriart.com and Luria sends it for counter-signature.
Subprocessors
| Subprocessor | What it handles | Where |
|---|---|---|
| Cloudflare | Hosting, server logs, the database (accounts, sites, events, scans), scan workers, transactional email, Turnstile bot check, R2 storage for session recordings and screenshots; Workers AI, the only AI for stores in the EU, EEA, UK and Switzerland and for any photo or ad that may show a person | United States (database) / Global |
| Moonshot AI (Kimi) | Page content and pseudonymous visitor-journey summaries (pages and clicks, never form input) for analysis and copy generation; never for a store in the EU, EEA, UK or Switzerland, never a photo of a person | China |
| DeepSeek | The same text, without images, for analysis and copy generation; never for a store in the EU, EEA, UK or Switzerland | China |
| Stripe | Billing | United States |
| Shopify | Store data you authorize by OAuth | United States |
| Anthropic | The setup assistant's AI, when switched on: your chat messages (keys and passwords removed) and your site's setup state, never visitor data | United States |
| Cloudflare, Stripe, Calendly (your own accounts) | Only when you connect them, off by default: the edge tracking script runs in your Cloudflare account and passes visitor IP and country to Luria; Stripe sales and Calendly bookings arrive with emails stored only as a one-way hash | United States / Global |
Luria is based in the United States, and relies on Standard Contractual Clauses for UK and EEA transfers where the processor offers them. Customers are notified before a subprocessor that handles visitor data is added or replaced.
Verify it worked
- After a delete, export again. Only your connection, site, plan and consent records come back.
- The Setup checklist still shows the app connected. That is expected: deleting data does not uninstall the app.
Common failures
- The delete button seems to do nothing. The confirmation has to be your exact
.myshopify.comdomain (or your site's domain), character for character. - You uninstalled first. The app page is unreachable once the app is gone. Email privacy@luriart.com.
- You expected the free allowance to reset. Usage counters survive a data delete deliberately.
- The export has no access token in it. By design. Tokens are never exported.