PRIVACY

Privacy Policy

Last updated: 10 October 2026

Luria tests your website and makes it better, on its own. This policy covers luriart.com and the Luria service. It says what we collect, why we collect it, where we keep it, and how to get it deleted.

1. Two different roles

Which rules apply depends on whose data it is:

• Data we control. Information you give us directly, as a lead or a customer: your email, your store URL, your signup answers, and your account. We decide how it is used.
• Data we process for a merchant. Visitor data that our snippet collects on a merchant's own website. The merchant is the controller. We act as a processor. We only do what they tell us to do, under our Data Processing Addendum. If you are a visitor to a merchant's store, ask that merchant first. We will still act on a request you send straight to us.

2. What we collect

From merchants and prospects (we control):

• Your email address, and your name if you give it. Your store URL, your platform, and the goal you pick. Plus the answers you give us when you sign up: traffic band, ad spend band, product.
• The free page audit (free.luriart.com): the page address you ask us to audit and its score. If you choose to get a copy by email: your email address, the consent text you agreed to and when, your country, and a salted one-way hash of your IP address (never the address itself). Every emailed copy has a delete link that removes your email from our records.
• Scan results for the store URL you ask us to scan. This covers the content of your public pages, and screenshots of pages that anyone could reach.
• A session cookie (luria_session) once you sign in. It is strictly necessary. It is also HttpOnly, Secure, and SameSite=Lax. We do not use advertising or cross-site tracking cookies on luriart.com.
• Normal server logs. These hold your IP address, user agent, the time, and the page path. We use them to keep the site safe, to stop abuse, and to set rate limits.
• How visitors find luriart.com. Once per browser tab we count one visit: the page you landed on, the site that linked you (its name only), any campaign tags in the link (utm_), which ad network's click tag was there (never its value) and your device type. No cookie, no IP address and nothing that names you is stored with it; we keep these counts 400 days. The first such source is kept in your browser (localStorage luria-src) and saved with your account if you sign up, so we know which marketing works. Global Privacy Control or Do Not Track turns the count off.
• If you come here through a partner's link (?ref=), we set a first-party cookie (luria_ref) and a matching localStorage copy (luria-ref). Both hold that partner's code. We keep it for 14 days from your last click. It has one use only: to give the partner credit if you sign up in that time. It is strictly functional, and it expires on its own. We record the partner code, never the cookie, on your account and on your Stripe billing records. That is how the partner gets credit.
• If you sign up as an affiliate partner: your name, email address and phone number. We use them to know who you are. We use them to talk to you about your account and your payouts, and to set up your payout account with Stripe. We do not use your phone number for marketing unless you give separate consent first. Stripe collects and holds your payout details under its own privacy policy. Those details are your business type, your identity, your bank account, and your tax forms. We store only your Stripe account id, and whether it is ready for payouts. If Stripe cannot pay out to your country, we pay through Wise, and Wise then gets your name and email address. We never collect or store bank details on luriart.com.
• If you connect Shopify: your store domain, plan, currency, granted scopes, and an API access token that we hold on our server. We never show that token in a browser.
• Ad creatives you upload (images and videos) and the ad text you type. We read each one to write a page that matches the ad: its words, offer and claims, and who it shows or names. For a person we keep only a name if the ad says or shows it, their role, and a plain line on what they are doing. We never guess anyone's gender, age, race or ethnicity, and never write a page aimed at one. It is never about a visitor. Remove a creative from the ad set, or delete the ad set, and that reading is deleted with it.

From visitors to merchant sites (we process):

• A random first-party visitor ID, kept on the merchant's own domain. We do not fingerprint devices. We do not read canvas, audio, or device-entropy signals.
• Pageviews, clicks, scroll depth, form submissions, and conversion events.
• Rough details: device type, referrer, UTM tags, and country or region. We do not collect exact location.
• Which page version a visitor saw, so we can measure results.

We do not knowingly collect data from children. We do not collect special-category data, so please do not send it to us. By that we mean data on your health or your biometrics. It also means political opinions, and the like.

3. What we do not do

• We do not sell personal information. We do not share it for what the law calls cross-context behavioural advertising.
• We do not build a profile of one visitor across merchants who are not related. We keep each merchant site's visitor data apart. The database itself locks it that way.
• Learning across merchants uses anonymised, aggregated patterns only (for example, "headlines that lead with a benefit beat ones that lead with a feature in this niche"). We never keep records about a person.

4. Why we are allowed to use it

Where the UK/EU GDPR applies, our lawful bases are: contract (running your account and the service), legitimate interests (to keep the service safe, to stop abuse, and to improve the product with aggregated data), and consent where consent is required for analytics on a merchant's site. You can withdraw consent at any time.

5. Where your data lives

Processor	What it holds	Where
Cloudflare	Site hosting, server logs, and the database (D1: accounts, sites, visitor events, test records, scan results). Scan workers that open your public pages. Transactional email (sign-in links, reports). Turnstile bot check on public forms. R2 object storage for session recordings, page screenshots, and the ad creatives you upload. Realtime for the live browser call on the booking page. Workers AI: the only AI that reads and writes for stores in the EU, EEA, UK and Switzerland and for European websites in the free review, and the only AI that reads a photo or ad that may show a person.	United States (database) / Global
Moonshot AI (Kimi)	AI that reads page content and pseudonymous summaries of visitor journeys (pages and clicks, never form input) to review pages and draft new versions. Only for stores and websites outside the EU, EEA, UK and Switzerland, and never a photo or ad that may show a person.	China
DeepSeek	AI that reads the same text (no images) for analysis and copy drafts, only for stores outside the EU, EEA, UK and Switzerland. Also runs the setup assistant when Anthropic is switched off: your chat messages (keys and passwords removed first) and your site's setup state, never visitor data.	China
Anthropic	AI for the setup assistant, when switched on: your chat messages (keys and passwords removed first) and your site's setup state. Never visitor data.	United States
Groq	Speech-to-text for the audio of videos you upload, when switched on	United States
Hetzner	Our internal operations assistants, which can read store and lead details to help us run the service, and the tool that copies a store's public pages (no visitor data)	European Union
Stripe	Billing, and payouts to affiliate partners	United States
Wise	Affiliate payouts where Stripe cannot pay (name and email only)	United Kingdom / European Union
Google	Our own calendar, read only for free and busy times, to show open call slots	United States
Shopify, GoHighLevel, Instagram (Meta)	Only the store, CRM, or account data you connect and authorise	United States
Cloudflare, Stripe, Calendly, WooCommerce, Webflow, HubSpot (your own accounts)	Only when you connect them, and switched off by default: with the key you give us, we install the tracking script on your site (Cloudflare), and read your sales (Stripe, WooCommerce, Webflow), bookings (Calendly), form sign-ups (Webflow) or contacts and won deals (HubSpot). Buyer and invitee emails are stored only as a one-way hash; names and addresses are not kept.	United States / Global

We are based in the United States, so your data goes there and is kept there. Some AI processing happens in China (see the table), but never for a store in the EU, EEA, UK or Switzerland: we tell where a store is from its country, its timezone and its web address, and its AI runs on Cloudflare Workers AI instead. If Workers AI is not available, that store's AI request is not sent at all. A photo or ad that may show a person is read only by Workers AI, wherever the store is; if it is not available, the photo is not sent and you type the words instead. The free review of a public website that anyone can start before signing up follows the same rule: a site that looks European (from your country, its web address, its page language, the currency of its prices, or a European company name on the page) is read only by Workers AI, and if Workers AI is not available the review shows your pages without AI suggestions. For transfers out of the UK/EEA to the United States we rely on Standard Contractual Clauses where the processor offers them. We never send passwords, payment details, or what visitors type into forms to an AI model. We keep this list current. We tell customers about material changes before they take effect.

6. How long we keep it

• Raw visitor events: about 90 days, then deleted automatically.
• Session recordings: we keep them up to 180 days to measure and improve that one store and to train its models, then we delete them automatically. The learning rows we derive from them hold no raw recording. For each recorded visit we also keep one small summary of what the visit did (the pages in order, how far they scrolled and how long they stayed on each, the part of the page and the element where they left or clicked in frustration, whether they added to cart, started a form or watched a video, the device, where they came from and whether they bought); it holds no typed text and no IP address, and is kept as long as the store uses Luria so the store learns what to test. Recordings hide all form input by default. They stay first-party to that one store. We never use them to build profiles of people across stores. A store owner can delete them any time with Delete my data, or ask us to.
• Personal pages memory (only on stores that use Personal pages): per random visitor id, the pages and products viewed, purchases, the versions shown, the visitor's country, the kind of network they browse from (and its name only when it is a business network, never a home or mobile one), and two scores the store's own model works out (chance to buy, chance of a return). It holds no name, email or IP address. Kept up to 400 days from the first visit (the visitor id's own lifetime); the record of which version was shown is deleted after 90 days, like raw events. A store owner can delete it any time with Delete my data.
• Heatmap data: kept as page-level totals for as long as the store uses Luria.
• Aggregated and anonymised stats: we keep these with no time limit. They identify no one.
• Lead and account records: for as long as the account is active, then up to 24 months, unless you ask us to delete them sooner.
• Free page audit emails: up to 24 months, unless you use the delete link in the email sooner.
• Affiliate partners: we keep your partner records and your commission ledger while you are a partner. After that, we keep them as long as tax and accounting law requires.
• Server logs: about 30 days.
• Failed sign-in records (IP address, browser, a one-way hash of the email): 90 days, to spot and stop break-in attempts.
• Database backups: one encrypted copy a day in Cloudflare R2 (United States), each deleted after 90 days. Anything deleted from Luria leaves the backups within those 90 days.

7. Your rights

Wherever you live, you may ask us to access, correct, delete, or export your personal information, and to object to or restrict how we use it. Under the UK/EU GDPR you may also complain. You can take it to your data protection authority. In the UK, that is the ICO.

If you are in California: we do not sell or share your personal information, as the CPRA defines those terms. We will not discriminate against you for using any right. You may use an authorised agent to make a request for you.

To make a request, email privacy@luriart.com. We reply within 30 days and may need to verify your identity first.

If you are a merchant using Luria: you are the data controller for your visitors. You can erase their data yourself at any time, and you do not have to ask us. Open Your data in your Luria dashboard (or in the Luria app inside Shopify) and choose Delete my data. It wipes out every record we hold for that store. That covers events, conversions, session recordings, and the record of which page version each visitor saw. It covers your tests and their history, scans, screenshots, and reports. It covers your brand-brain data, and it covers your integration records too. You can ask us to run it for you instead. You cannot undo it. Your sign-in, your store connection, your plan record and the terms you accepted stay until you uninstall or close your account; then they are deleted too, except a scrambled code made from your shop's address and how much of its free allowance it used, so reinstalling does not restart the free allowance. It holds no visitor data. We log that a deletion took place, so both sides can show that the request was met.

8. Automated decision-making

Luria runs on automated systems, and on AI. They suggest and make changes to a merchant's website. They also pick which page version each visitor sees. These choices affect page content only. They have no legal effect on anyone, and no effect of similar weight. We never set a price for a person based on their personal data.

9. Security

Your data is encrypted in transit (HTTPS/TLS). Our processors also encrypt it at rest. We limit access to each merchant's own data: the database has no public address, only our own server can reach it, and every request is checked against the account that owns the data. We encrypt third-party access tokens before we store them, keep keys and passwords out of our code, and log failed sign-ins. If a breach hits your personal data, we will tell you and the right regulator, as the law requires.

10. Global Privacy Control

Our snippet honours the Global Privacy Control signal and DNT: 1. When we see either one, we set no visitor ID. We send no analytics events, and we load no session recording. The page still works as normal.

11. Changes

If we change this policy, we will update the date above. When a change is material, we tell customers directly.

12. Contact

Questions, requests, or complaints: privacy@luriart.com.

---

This page sets out what we actually do. It is not legal advice. Privacy counsel will review it before the paid tier launches. ← luriart.com · Terms of Service