Security
Plain language explanation of how Zolvio handles your data and keeps it secure.
What We Collect
Session Recordings: We record how visitors interact with your store - mouse movements, clicks, and scrolling - for shoppers whose cookie consent allows it. This helps you see exactly what visitors do.
Click Events: We track where visitors click to generate heatmaps showing popular areas.
Scroll Data: We measure how far visitors scroll down your pages.
Device Info: Browser type, device type (desktop/mobile), and approximate country.
What stays private: Everything shoppers type is hidden, and other page text shows as ***. Product names, prices, headings, menus, buttons, breadcrumbs and size/colour options stay readable so recordings make sense. Checkout, account, order and login pages are never recorded, and Zolvio never receives card or payment details.
Screenshot Handling
For heatmaps and audits, we capture screenshots of your store pages.
- Screenshots are used to overlay click/scroll data
- With AI in audits and fixes turned on, Zolvio's AI agent reviews audit screenshots for problems shoppers can see
- Audit screenshots are stored privately and deleted once nothing uses them; heatmap screenshots are kept for display and refreshed when the page changes
- They're only accessible to you and our processing systems
Theme Files
To write fix instructions for your actual theme, Zolvio keeps a copy of your published theme's files, updated when you publish or change your theme and deleted with your store data after you uninstall. We use it to:
- Find the right file and line for each fix step
- Write theme-specific instructions (with AI turned on, short parts of the code are sent to our AI provider)
When you click Verify fix, Zolvio reads your published theme's files through Shopify to look for the change.
Important: Zolvio never edits your theme. You make every change yourself.
Data Retention
How long we keep your data depends on your plan:
| Plan | Retention |
|---|---|
| Free | 7 days |
| Starter | 30 days |
| Growth | 60 days |
| Pro | 180 days |
After this period, data is scheduled for deletion. You can also request deletion at any time. Some operational logs or backups may persist for a limited time for resilience and security.
Access Controls
Who can see your data:
- You and your team: Anyone with access to your Shopify store can view Zolvio data
- Zolvio support: Only when you request help, and only the minimum needed
- Automated systems: For processing recordings and generating insights
We never sell your data. We never share it with advertisers. Your data is yours.
Privacy
Privacy-first: typing is never recorded, and checkout is never recorded.
- Cookie consent: Recordings and surveys respect your store's cookie consent
- A/B tests: Assignment runs for every visitor so each one sees a consistent version; it uses a random ID and a 30-day cookie and never records the session
- Data requests: Shopify forwards customer data and deletion requests (for example under GDPR or CCPA) to us, and we review each one. You can also email privacy@zolvio.io
- Data minimization: We only collect what's needed
You should still update your privacy policy to mention session recording and analytics.
Questions about security or data handling?
Contact us at security@zolvio.io