Privacy policy · NextIntent

1. Who we are

NextIntent, Inc., [registered address to be added]. We make NextIntent for Shopify and NextIntent for any website. For the data of shoppers and visitors on a store or site that uses NextIntent, the store or site is the controller and we process it on their behalf. For the data of the businesses that use the service, and for visitors to nextintent.ai, we are the controller.

Questions and requests go to privacy@nextintent.ai.

2. Shoppers on a store, visitors on a website

What our script reads is how a person moves, not who they are. On every page it reads scroll position and direction, time on the page, time since the last click or scroll, which element was clicked (never what was typed), hovering that settles on one part of the page, page load timing, the device type and screen size, and the path and title of each page.

On a store it also reads the cart: item handles, variant ids, quantities, prices, the total, the shopper's country from the store's country selector, and whether a discount code was accepted. The code itself is hashed on the page. On Shopify stores it reads checkout steps through Shopify's web pixel: started, contact, shipping, payment, completed, with the order total, currency and order reference. Nothing typed into checkout is read.

When a form is submitted or the page shows a validation message, the script reads the field name and the message. Every typed value is replaced by a one-way hash before it leaves the page, so we can tell that the same discount code was tried twice without ever holding the code. A validation message is scrubbed of email addresses, long runs of digits and quoted text before it is used.

Each visitor is a random identifier that the script keeps in a small frame served from a NextIntent domain. It is not derived from anything about the person, and no cookie is set on the store's or website's own domain.

Never read, never kept: names, email addresses, phone numbers, postal addresses, payment details, anything typed into a form in the clear, the text of discount codes, chat messages, and a visitor's IP address on the records we keep about a visit.

One setting changes the answer above for websites that are not stores. With visitor identification turned on, the script may read an email address a visitor typed into a form and we may attach a name and company to the visitor's record. It is off by default, it is off on every Shopify store, and it is turned on only for an account that has asked for it in writing and has the legal basis to use it.

3. Orders

A store that uses NextIntent sends us its new orders and refunds so a purchase can be matched to the moment that preceded it. On Shopify, the app strips every order before anything leaves for us. What we receive: the order id, name and number, the time, the currency, the totals, the financial status, whether it is a test order, discount codes used, line items as product handle, product and variant ids, price and quantity, the one cart attribute that carries the visitor identifier, and the customer's Shopify id as a number. We hash that number on arrival with a key that belongs to the store and keep only the hash, so an erasure request can find the orders.

What we never receive from an order: the customer's name, email address, phone number, billing address, shipping address, or the order note.

4. What the business gives us

The store's facts that the sentence is built from: shipping rates and free-shipping lines, the return window read from the store's policy, discount codes and their rules, product notes, a delivery promise, links to store pages. The settings chosen in the app. The email address the weekly summary goes to, and a Slack webhook if one is set. On Shopify, the store's domain and the contact email Shopify provides. For NextIntent for any website, the name, work email and company of the person who opened the account, and sign-in records.

5. What we send to others, and when

Only on the business's own instruction, and only these:

Klaviyo. When a store turns on "Tell Klaviyo why they got stuck", the script on the shopper's own browser tells the store's Klaviyo account the reason the shopper stalled and the sentence shown. It does this only for a shopper Klaviyo already recognizes in that browser. We send Klaviyo no email, no name and nothing typed; Klaviyo already knows the shopper.
A popup tool the store already runs (Klaviyo forms, OptiMonk, Justuno, Privy, Wisepops), when the store chooses it as the way the sentence appears. We ask the tool to show the store's own campaign; the tool's own data handling applies.
Slack, when the store adds a webhook: the weekly summary, which contains counts and money, never a shopper's identity.
The weekly summary by email, sent through Resend to the address the business chose.

We do not sell personal data, we do not share it for advertising, and we never build a profile of a person across businesses.

6. Who processes data for us

We use these providers to run the service. Each processes data in the United States unless stated.

Railway: hosting and databases.
Cloudflare: the network in front of the service, nextintent.ai, and the archive storage for moment records.
Anthropic: the model that reads a snapshot of a visit to decide whether and what to say. The snapshot carries no name, email, phone or address.
Shopify: the platform, for stores that run on Shopify, including billing.
Resend: the weekly summary email.
Clerk: sign-in for the NextIntent console (NextIntent for any website).

Changes to this list are posted on this page at least 30 days before they take effect. The Data processing agreement carries the same list with purposes.

7. How long we keep things

These are the periods the service applies today.

The live picture of a visit: minutes after the visit ends.
A sentence waiting to be shown: 3 minutes.
The marker that a shopper just bought, which keeps us quiet: 24 hours.
The visitor record (visits, moments, whether we helped, whether they bought): 90 days from the last visit.
Moment records (page, cart, reason, sentence, outcome), keyed by the random visitor identifier: archived for the life of the business's account, so reports can be rebuilt. Erased visitors are excluded from every report and export by a deletion marker.
The order ledger (order reference, totals, refunds, the hashed customer reference): for the life of the business's account, minus erasures.
A business's account data: for the life of the account and the period the law requires for billing records.

8. Erasure

A shopper or visitor who wants their record erased should ask the store or website they visited, which is the controller of that data; we act on the store's instruction. A store can also ask us directly on a shopper's behalf.

On Shopify we handle the platform's privacy requests without anyone having to do anything:

A customer asks what the store holds (customers/data_request): the app holds no personal fields for the customer, only a behavioural record under a random visitor identifier and orders under a hashed customer reference, and says so.
A customer asks to be erased (customers/redact): we erase the orders matching the hashed customer reference, the visitor records linked to those orders, and the moments for those visitors. If we are unreachable, Shopify retries the request, and the app does not report success until the erasure succeeds.
The store uninstalls (shop/redact, sent by Shopify 48 hours after uninstall): we erase everything for the store, then the app deletes its own record of the store. If the erasure fails, the store record is kept so it can be retried; it is never deleted first.

For NextIntent for any website, erasure requests come from the account holder through the console or by email, and are completed within 30 days.

9. Businesses that use NextIntent

We use a business's account data to provide the service, to bill it (on Shopify, billing is Shopify's; for the console, our payment provider holds the card details and we do not), to support it and to send service messages such as the weekly summary. Use of the console and of the API is logged with who made each call, for security and support.

10. Visitors to nextintent.ai

Our own site runs our own script under the rules in section 2, plus the standard server logs of our hosting provider. We run no advertising trackers.

11. Security

Data is encrypted in transit. Identifiers that could point at a person are stored as one-way hashes. Credentials are stored hashed or encrypted. Access is limited to the people who operate the service and is logged. Test and production are separate.

12. Your rights

Depending on where you live, you may have the right to access, correct, delete or restrict the processing of your personal data, to object to it, to receive a copy, and to complain to a supervisory authority. Shoppers and visitors should contact the store or website they visited; we help it respond. Everyone else can write to privacy@nextintent.ai and we answer within 30 days.

13. Children

The service is for businesses. We do not knowingly collect personal data from children, and the script reads nothing that would tell us a visitor's age.

14. Transfers

We process data in the United States. Where data originates in the European Economic Area, the United Kingdom or Switzerland, we rely on the standard contractual clauses incorporated in our Data processing agreement.

15. Changes and contact

We post changes here with a new date at the top. If a change reduces what this policy promises, we tell businesses that use the service by email first. Questions: privacy@nextintent.ai. NextIntent, Inc., [registered address to be added].