What Luria stores
The events Luria records on your site, what it never records, the Shopify data it syncs, where it all lives and how long it is kept.
Luria's events are content-free by design. They record that something happened, and on which page, never what a person typed, bought, or is called.
What you'll need
Nothing. This page is a reference; none of it is configurable.
What the snippet records
Every event carries a random visitor id, a timestamp and the page path. Then, per type:
| Event | What it carries |
|---|---|
session_start | device type (mobile or desktop), the referring URL, and utm_source / utm_medium / utm_campaign if present |
pageview | the page path |
click | the visible label of the link or button clicked, first 60 characters |
form | that a form was started. Never the field contents |
checkout_step | the path, on pages that look like checkout or payment |
exposure | which test the visitor saw, and which arm |
conversion | the goal name and the value passed with it |
Events are batched and sent every 1.5 seconds, and again when the page is hidden.
What Luria never records
- Names, email addresses, phone numbers, postal addresses.
- Passwords, payment details, or anything typed into a form.
- Device fingerprints. No canvas, audio or device-entropy signals, ever.
- Precise location.
Visitor ids
A random id, generated in the visitor's own browser and kept in localStorage as luria_sid. It is first-party to your domain, it is not derived from anything about the person, and it is never matched to a visitor on another merchant's site.
What you give Luria directly
Your email, your store URL, your onboarding answers, and the scan of your own public pages (page content plus screenshots of pages that were publicly reachable). That is data Luria controls, rather than data Luria processes on your behalf.
What Shopify syncs
Once the app is installed and the terms approved, Luria keeps copies of the store objects it needs to measure conversions honestly: orders, refunds and returns; products and inventory; customers; fulfillments; abandoned checkouts; price rules and discounts; marketing events; locations and shipping; page content and locales; and the customer events that power the web pixel. Orders are what make a conversion trustworthy, which is why they are synced rather than inferred.
You can export or delete every one of those copies yourself. See Deletion and the DPA.
How long it is kept
| Data | Kept for |
|---|---|
| Raw visitor events | About 90 days, then deleted automatically by a daily job |
| Session recordings | Up to 180 days, to measure and improve your store and train its models, then deleted automatically. What Luria learned from them is kept as rows that hold no raw recording. Delete them sooner any time with Delete my data |
| Heatmaps | Page-level totals, kept until you delete them (Delete my data) or uninstall |
| Aggregated statistics | Indefinitely. They identify nobody |
| Lead and account records | While your account is active, then up to 24 months |
| Server logs | About 30 days |
| Anything, on request | Deleted within 30 days |
Where it lives
Hosting, server logs, the database and the scan workers that open your public pages all run on Cloudflare (the database is stored in the United States). Page content and pseudonymous summaries of visitor journeys (pages and clicks, never form input) go to Moonshot AI (Kimi) and DeepSeek (both China) for analysis and copy generation, except for stores in the EU, EEA, UK and Switzerland, whose AI runs only on Cloudflare Workers AI. Photos and ads that may show a person are read only by Workers AI. Cloudflare runs the Turnstile check on public forms and stores session recordings, screenshots and creatives in R2. Stripe handles billing, Shopify, GoHighLevel and Instagram hold only the data you connect, and Resend sends transactional email. The full list is on luriart.com/privacy.
Luria is based in the United States, and relies on Standard Contractual Clauses for UK and EEA transfers where the processor offers them.
Cross-store learning
Luria learns aggregate patterns across stores, for example which kind of headline tends to win in a niche. It never builds a profile of an individual visitor across merchants, and visitor data is partitioned per site in the database.
Verify it worked
Export everything from the Luria app in your Shopify admin and open the JSON file. What is in that file is what Luria holds for your store.
Common failures
- You expected customer names. Sessions carry no name. The Customers section on the Overview tab labels a converted session by a short visitor tag, with the traffic source beside it.
- The events look thin. They are meant to. Content-free is the design, not a gap.
- Data older than 90 days is missing. Raw events age out. Change history and the aggregate counters stay.
- You want a specific visitor erased. Email privacy@luriart.com; see Deletion and the DPA.