PRIVACY

Privacy Policy

Last updated: 19 August 2026

Luria tests your website and makes it better, on its own. This policy covers luriart.com and the Luria service. It says what we collect, why we collect it, where we keep it, and how to get it deleted.

1. Two different roles

Which rules apply depends on whose data it is:

• Data we control. Information you give us directly, as a lead or a customer: your email, your store URL, your signup answers, and your account. We decide how it is used.
• Data we process for a merchant. Visitor data that our snippet collects on a merchant's own website. The merchant is the controller. We act as a processor. We only do what they tell us to do, under our Data Processing Addendum. If you are a visitor to a merchant's store, ask that merchant first. We will still act on a request you send straight to us.

2. What we collect

From merchants and prospects (we control):

• Your email address, and your name if you give it. Your store URL, your platform, and the goal you pick. Plus the answers you give us when you sign up: traffic band, ad spend band, product.
• Scan results for the store URL you ask us to scan. This covers the content of your public pages, and screenshots of pages that anyone could reach.
• A session cookie (luria_session) once you sign in. It is strictly necessary. It is also HttpOnly, Secure, and SameSite=Lax. We do not use advertising or cross-site tracking cookies on luriart.com.
• Normal server logs. These hold your IP address, user agent, the time, and the page path. We use them to keep the site safe, to stop abuse, and to set rate limits.
• If you come here through a partner's link (?ref=), we set a first-party cookie (luria_ref) and a matching localStorage copy (luria-ref). Both hold that partner's code. We keep it for 14 days from your last click. It has one use only: to give the partner credit if you sign up in that time. It is strictly functional, and it expires on its own. We record the partner code, never the cookie, on your account and on your Stripe billing records. That is how the partner gets credit.
• If you sign up as an affiliate partner: your name, email address and phone number. We use them to know who you are. We use them to talk to you about your account and your payouts, and to set up your payout account with Stripe. We do not use your phone number for marketing unless you give separate consent first. Stripe collects and holds your payout details under its own privacy policy. Those details are your business type, your identity, your bank account, and your tax forms. We store only your Stripe account id, and whether it is ready for payouts. If Stripe cannot pay out to your country, we pay through Wise, and Wise then gets your name and email address. We never collect or store bank details on luriart.com.
• If you connect Shopify: your store domain, plan, currency, granted scopes, and an API access token that we hold on our server. We never show that token in a browser.
• Ad creatives you upload (images and videos) and the ad text you type. We read each one to write a page that matches the ad: its words, offer and claims, and the people it shows, as the ad presents them. That means a name only if the ad says or shows it, a role, gender, an age band, and apparent ethnicity. This describes your ad and the people you chose to put in it. It is never about a visitor. Remove a creative from the ad set, or delete the ad set, and that reading is deleted with it.

From visitors to merchant sites (we process):

• A random first-party visitor ID, kept on the merchant's own domain. We do not fingerprint devices. We do not read canvas, audio, or device-entropy signals.
• Pageviews, clicks, scroll depth, form submissions, and conversion events.
• Rough details: device type, referrer, UTM tags, and country or region. We do not collect exact location.
• Which page version a visitor saw, so we can measure results.

We do not knowingly collect data from children. We do not collect special-category data, so please do not send it to us. By that we mean data on your health or your biometrics. It also means political opinions, and the like.

3. What we do not do

• We do not sell personal information. We do not share it for what the law calls cross-context behavioural advertising.
• We do not build a profile of one visitor across merchants who are not related. We keep each merchant site's visitor data apart. The database itself locks it that way.
• Learning across merchants uses anonymised, aggregated patterns only (for example, "headlines that lead with a benefit beat ones that lead with a feature in this niche"). We never keep records about a person.

4. Why we are allowed to use it

Where the UK/EU GDPR applies, our lawful bases are: contract (running your account and the service), legitimate interests (to keep the service safe, to stop abuse, and to improve the product with aggregated data), and consent where consent is required for analytics on a merchant's site. You can withdraw consent at any time.

5. Where your data lives

Processor	What it holds	Where
Vercel	Site hosting, serverless functions, and server logs	United States
Supabase (Postgres + Storage)	Accounts, sites, events, scan results, screenshots	United States
Anthropic	Page content we send for analysis and new copy. They do not use it to train their models.	United States
Cloudflare	Turnstile bot check on public forms. R2 object storage for session recordings, page screenshots, and the ad creatives you upload.	Global
Shopify	Store data you authorise via OAuth	United States
Resend	Transactional email (sign-in links, reports)	United States
Hetzner	Scan workers that open your public pages during the onboarding scan	European Union

We are based in the United States, so your data goes there and is kept there. For transfers out of the UK/EEA we rely on Standard Contractual Clauses with our processors. We keep this list current. We tell customers about material changes before they take effect.

6. How long we keep it

• Raw visitor events: about 90 days, then deleted automatically.
• We keep session recordings and heatmap data. We use them to measure and improve each store's experience, and to train models for that one store. Recordings hide all form input by default. They stay first-party to that one store. We never use them to build profiles of people across stores. You can ask us to delete a store's recordings at any time.
• Aggregated and anonymised stats: we keep these with no time limit. They identify no one.
• Lead and account records: for as long as the account is active, then up to 24 months, unless you ask us to delete them sooner.
• Affiliate partners: we keep your partner records and your commission ledger while you are a partner. After that, we keep them as long as tax and accounting law requires.
• Server logs: about 30 days.

7. Your rights

Wherever you live, you may ask us to access, correct, delete, or export your personal information, and to object to or restrict how we use it. Under the UK/EU GDPR you may also complain. You can take it to your data protection authority. In the UK, that is the ICO.

If you are in California: we do not sell or share your personal information, as the CPRA defines those terms. We will not discriminate against you for using any right. You may use an authorised agent to make a request for you.

To make a request, email privacy@luriart.com. We reply within 30 days and may need to verify your identity first.

If you are a merchant using Luria: you are the data controller for your visitors. You can erase their data yourself at any time, and you do not have to ask us. Sending DELETE /api/sites/<your-site-id>/data from your account wipes out every record we hold for that site about its visitors. You can ask us to run it for you instead. That covers events, conversions, and the record of which page version each visitor saw. It covers sessions, visitor IDs, scans, and reports. It covers your brand-brain data, and it covers your integration records too. You cannot undo it. We keep your site rows and your test rows, so the history of what changed on your website stays auditable. Those rows hold no visitor personal data. We log that a deletion took place, and who asked for it. That way both sides can show that the request was met.

8. Automated decision-making

Luria runs on automated systems, and on AI. They suggest and make changes to a merchant's website. They also pick which page version each visitor sees. These choices affect page content only. They have no legal effect on anyone, and no effect of similar weight. We never set a price for a person based on their personal data.

9. Security

Your data is encrypted in transit (HTTPS/TLS). Our processors also encrypt it at rest. We limit access to each merchant's own data. The database locks that in for us, with row-level security. We encrypt third-party access tokens before we store them. If a breach hits your personal data, we will tell you and the right regulator, as the law requires.

10. Global Privacy Control

Our snippet honours the Global Privacy Control signal and DNT: 1. When we see either one, we set no visitor ID. We send no analytics events, and we load no session recording. The page still works as normal.

11. Changes

If we change this policy, we will update the date above. When a change is material, we tell customers directly.

12. Contact

Questions, requests, or complaints: privacy@luriart.com.

---

This page sets out what we actually do. It is not legal advice. Privacy counsel will review it before the paid tier launches. ← luriart.com · Terms of Service