What Alyon does with your data.

Who this covers

Alyon ("Alyon," "we," "us") is provided by Alyon, Inc. This policy covers two people: a merchant — the Shopify store that installs Alyon — and a shopper — a visitor searching that store.

For a shopper's search activity on a merchant's store, Alyon processes that data on the merchant's behalf — the merchant decides how Alyon is configured, and Alyon carries out that configuration. For a merchant's own account with Alyon, Alyon decides directly what to do with the data, within what this policy describes.

What Shopify gives Alyon

Installing Alyon asks you to approve the following access. Each is used for exactly one purpose:

• Products, product listings, inventory, and collections (read_products, read_product_listings, read_inventory, read_collection_listings) — to build and keep your searchable catalog in sync.
• Order history (read_orders) — read in aggregate only: how many units and how much revenue each product has generated, to give search and merchandising a sensible starting point on day one, before Alyon has observed any of its own traffic. We do not read customer names, addresses, emails, or payment details from your orders.
• Theme content (read_themes) — read-only, to detect which Alyon blocks are actually placed on your storefront so your admin shows accurate setup status.
• Managing the storefront tracking script (write_pixels, read_customer_events) — to register and run the Web Pixel that records search and purchase events, described in §3.
• A storefront access token (unauthenticated_read_product_listings) — used only to query your store's own native search as a fallback if your chosen AI provider is temporarily unavailable, so your search never goes down.

Two further permissions are requested only if you turn on the specific feature that needs them, never at install: writing your storefront's product sort order (write_products), if you turn on "Your store's own sort order"; and reading and changing your cookie-banner setting (read_privacy_settings, write_privacy_settings), if you ask Alyon to turn Shopify's own cookie banner off for you.

What we do not receive through any of the above: your customers' payment details, card numbers, or account passwords. Shopify never sends these to any app.

Your Shopify access token is encrypted at rest and used only to make the calls above on your behalf. It is deleted the moment you uninstall (§6).

What your storefront records

Alyon's storefront search block and its Web Pixel record what a shopper searches for, which results were shown, what was clicked, and whether a purchase followed — tied only to alyon_vid, a random identifier stored in a first-party cookie. No name, email, or account is ever attached to it, and Alyon has no way to connect it to a real person.

This only happens with the shopper's consent, read live from your store's own consent settings (§9). If consent is not given, the cookie is never set, no session is tracked, and every shopper is served identically.

What goes to the search engine

Alyon runs your store's search on the AI provider you've chosen — for example, Google AI Commerce Search, or Lucidworks. That provider receives your product catalog and the text of a shopper's search query, in order to return ranked results. It does not receive order history, customer identity, or payment information.

Depending on your plan, your store's catalog is served from a Google Cloud project dedicated to your store alone, or from a project shared across several Alyon stores — both arrangements exist today. Either way, we do not permit a search provider to use your catalog or your shoppers' searches to train a model for any other store.

Who else processes it

We share the minimum necessary with the following processors, one row each — who, and what for:

• Your chosen AI search provider — receives your catalog and shoppers' search queries to return ranked results (§4).
• Cloudflare — our infrastructure provider. Search requests, your published configuration, and aggregated analytics are processed and stored on Cloudflare's edge network.
• Shopify — the platform Alyon is built on; all store data originates from and flows back through Shopify's own APIs.

This is the row most likely to change as Alyon adds engines or infrastructure — the date at the top of this page is how you know which version of it you're reading.

We do not sell data, and we do not use your store's or your shoppers' data for any purpose other than operating Alyon for your store.

How long it is kept

While Alyon is installed, we keep your catalog, configuration, and analytics for as long as needed to operate the app for your store.

If you uninstall, we stop syncing and delete your access token immediately. Your configuration is kept for a short window in case you reinstall, so you don't have to set everything up again. Separately, Shopify sends a mandatory shop/redact erasure request roughly 48 hours after an uninstall — when it arrives, every table keyed to your store is permanently purged, whether or not the short reinstall window above has passed. Reinstalling before then cancels nothing that has already been erased.

You can ask us for a copy of what we hold, or ask us to delete it sooner — see §11.

Shopper and merchant requests

Because Alyon holds no shopper personal information — only the anonymous alyon_vid identifier (§3) — Alyon has no direct relationship with a shopper and no way to independently verify who they are. A shopper's request goes to the store they shopped with. Shopify's own customers/data_request and customers/redact webhooks reach Alyon automatically when a store handles a request that way; on customers/redact we erase anything keyed to that shopper's identifiers.

A merchant can ask for a copy of, or the deletion of, everything Alyon holds for their store at any time — contact us (§11), or simply uninstall the app, which starts the erasure described in §6 on its own.

AI agents reading your catalog

Alyon can let external AI agents and integrations search your catalog through the same search and recommendation logic your shoppers use — but only if you turn this on; it is off by default for every store. Access is read-only: an agent can search and get recommendations, and cannot add to a cart, change a price, or write anything to your store.

Each agent you allow gets its own credential, shown in your Settings, and you can revoke any one of them individually without affecting the others. Alyon does not receive the conversation a shopper has with an external agent — only the search or recommendation request itself, exactly as if a shopper had searched your store directly.

Cookies and consent

The one cookie Alyon's storefront components set is alyon_vid — a random identifier, no name or account attached. Setting it falls under the analytics category in Shopify's own consent framework. We read whether that category is allowed directly from Shopify's consent API at the moment of each request; Alyon does not keep a second, separate record of a shopper's consent choice.

If a shopper has not consented, or your store has no consent banner configured, the cookie is never set and no shopper's activity is tracked individually — search still works, personalized to nobody.

Changes to this page

If we materially change what we collect or how we use it, we update this page and change the "Last updated" date at the top — that date is this page's only version marker.

How to reach us

Questions about this policy, or a data request: info@alyon.io

Enterprise enquiries

If you send the Enterprise form on alyon.io, we keep what you wrote: your main store URL, the catalog size and traffic ranges you chose, the search you run today, your name, your work email, your company and your message. We keep it to reply to you and to agree Enterprise terms with you — nothing else, and never for marketing. It is stored in a database of its own, apart from any store's data, and read only by the Alyon team. We record a one-way hash of the address the form came from, to limit how many messages one place can send in an hour; the address itself is never stored. Nothing is emailed to you when you send the form — the first thing you hear is a person replying to your work email.

We keep an enquiry until you ask us to remove it — nothing deletes it automatically yet. To have it removed, reply to the person who answered you, or write to info@alyon.io. When it is turned on, the form is also protected by Cloudflare Turnstile, which checks that a person sent it; section 5 will name it the day it is.