Privacy Policy

1. Overview

Quoli, Inc. ("Quoli", "we", "us") provides a software platform that helps Shopify merchants collect and display customer reviews, photo and video user-generated content, and Questions. This Privacy Policy explains what personal data we collect, how we use it, and the rights you have over it.

Two distinct relationships are governed by this policy:

• Merchants: Shopify store owners and the staff they give access to Quoli. We act as a controller for the personal data we collect about you directly.
• Shoppers: End consumers of merchants who use Quoli. When a shopper submits a review, photo, or question on a merchant's storefront, we process that data as a processor on behalf of the merchant.

2. What we collect

From merchants directly

• Account information: name, email address, store URL, phone number (if provided), billing details (handled by Shopify).
• Usage data: dashboard activity, feature usage, support interactions, IP address, browser, device information.
• Communications: emails, chat transcripts, and survey responses you send us.

From Shopify on behalf of merchants

• Order data: order number, products purchased, order value, fulfillment and delivery status and dates, tracking numbers, order tags, discount codes used, and the customer's name, email address and phone number. We use this to send review requests and to match reviews to orders.
• Product catalog: product titles, descriptions, images, SKUs, variants. We use this to render review widgets and to power AI-assisted features.
• Theme metadata: required to deliver our Theme App Extension widgets.

From shoppers (on behalf of merchants)

• Review content: star rating, review text, photos, videos, reviewer name, reviewer email, optional location.
• Questions content: questions and answers submitted on product pages.
• Engagement data: votes, helpful flags, replies, sharing actions.
• Storefront interaction data: which Quoli widgets a shopper clicks, the page address, referrer and title, and a browser identifier taken from Shopify's _shopify_y cookie or stored by Quoli in the browser's local storage.

3. How we use your data

• To provide, maintain, and improve the Service.
• To send transactional emails (review requests, reminders, replies, billing confirmations).
• To respond to support requests and fix issues.
• To prevent fraud, abuse, and security incidents.
• To send marketing communications about Quoli (you can opt out at any time).
• To comply with legal obligations, respond to lawful requests, and enforce our Terms of Service.

We do not sell personal data. We do not share customer data with third parties for their own marketing purposes. We send review text to our AI providers only to produce the feature a merchant asked for, and we do not use shopper data to train AI models.

4. Legal bases for processing (GDPR)

Where the General Data Protection Regulation (GDPR) applies, we rely on the following legal bases:

• Contract: processing necessary to provide the Service to merchants under our agreement.
• Legitimate interest: processing to improve the Service, prevent fraud, secure our infrastructure, and conduct limited marketing to existing merchants.
• Consent: processing of shopper review submissions, photo / video uploads, and any optional features the shopper opts into.
• Legal obligation: processing required by law, court order, or regulatory request.

5. How we share data

We share personal data with a limited set of third parties, only where necessary:

• Sub-processors: cloud hosting and databases (Google Cloud), photo and video storage (Cloudflare), email delivery (Amazon Web Services), AI features (OpenAI and Anthropic), image processing for ad creatives (remove.bg), customer support (Intercom), merchant email (Brevo), subscription and partner tools (Mantle, PartnerJam) and the Shopify platform.
• Website analytics and chat: when you accept them in the cookie banner, Google Analytics and Intercom receive usage and chat data from quoli.io, as described in section 10.2.
• Integrations you enable: Klaviyo, Meta, Google, and other platforms you choose to connect via the Quoli Integrations panel. Data shared with these platforms is governed by their own privacy policies.
• Public store directory: Quoli publishes a directory of stores that use Quoli at reviews.quoli.io, which shows each store's published reviews and ratings.
• Legal compliance: when required by law, valid legal process, or to protect the rights, property, or safety of Quoli, our merchants, or others.
• Business transfers: in connection with a merger, acquisition, or sale of assets. We will notify you and offer a way to delete your data before any transfer takes effect.

6. International data transfers

Quoli is headquartered in the United States, and we store and process personal data in the United States. Some sub-processors, such as Cloudflare, may process data in other regions. When personal data of people in the EEA, UK or Switzerland is transferred, we rely on the safeguards described on our GDPR and DPA page.

7. Data retention

We retain personal data only as long as needed for the purposes described in this policy, or as required by law.

• Active merchant data: retained for the duration of your subscription.
• After uninstallation: your reviews, orders and settings stay in our systems so they are there if you reinstall. You can ask us to delete your store's data at any time by emailing [email protected].
• Review and UGC content: retained for as long as the merchant keeps it, or until the shopper or the merchant asks us to delete it.
• Billing and tax records: retained for the period required by applicable tax law (typically 7 years), in a separate financial system isolated from operational data.
• Short-lived records: review form sessions are kept for 90 days and helpful-vote records for 30 days. Website analytics on quoli.io follow the retention period set in our Google Analytics account.

To export or delete your store's data, email [email protected].

8. Your rights

Depending on where you live, you may have the following rights over your personal data:

• Access: request a copy of the personal data we hold about you.
• Correction: ask us to correct inaccurate or incomplete data.
• Deletion: ask us to delete your data, subject to our legal retention obligations.
• Portability: receive your data in a machine-readable format.
• Object: object to processing based on legitimate interest, including marketing.
• Withdraw consent: where we rely on consent, withdraw it at any time.
• Lodge a complaint: with your local data protection authority.

To exercise any of these rights, email [email protected]. We will respond within 30 days. If you are a shopper, you should generally direct your request to the merchant whose store you submitted data to; we will assist the merchant in responding.

9. Shopper data we process for merchants

When a shopper submits a review on a merchant's storefront, we process the submission on behalf of the merchant under the merchant's privacy policy. Our role is that of a processor (GDPR) or service provider (CCPA). We do not use shopper data for our own marketing purposes and we do not sell shopper data.

If you are a shopper and want to access, correct, or delete a review you submitted, contact the merchant directly. The merchant can find your reviews in their Quoli dashboard, unpublish them, and ask us to delete them. If you cannot reach the merchant, email [email protected] and we will assist.

10. Cookies and tracking technologies

This section explains every cookie or similar technology (local storage, session storage, pixel tags) used on quoli.io and on merchant storefronts running Quoli widgets. We deliberately keep our cookie footprint minimal.

10.1 What are cookies?

Cookies are small text files placed on your device by websites you visit. They are widely used to make websites work, to remember user preferences, and to provide aggregated information to site operators. We treat similar technologies (local storage, pixel tags) the same way for purposes of this policy.

10.2 Cookies on quoli.io (the marketing site)

We use a small, deliberately limited set of cookies. Analytics and chat cookies are set only after you accept them in the cookie banner. We do not run advertising cookies, retargeting pixels, or marketing trackers on quoli.io, and Google advertising storage stays off.

• Strictly necessary: q_consent remembers your cookie choices for 180 days. It cannot be disabled.
• Analytics (Google Analytics): Google Analytics 4 measures visits through two data streams: one for page views and navigation on quoli.io, and one that records clicks on links to the Quoli listing on the Shopify App Store. After you accept analytics, it sets _ga and _ga_Q6MBQL29F9 for the first stream and _ga_XXR86Q9J9T for the second, each for up to 2 years. Until you accept, no analytics cookies are set and Google Consent Mode sends only cookieless pings that carry no identifiers. Google LLC processes this data under its own privacy policy.
• Live chat (Intercom): the Intercom messenger loads only after you accept live chat. It sets intercom-id-avoxs9uu and intercom-device-id-avoxs9uu (up to 9 months) and intercom-session-avoxs9uu (up to 1 week) so a conversation continues across pages.

10.3 Cookies on merchant storefronts

Quoli widgets render on merchant storefronts through the Shopify theme app extension. Quoli widgets do not set cookies. They record which widgets a shopper interacts with, using a browser identifier from Shopify's _shopify_y cookie or one stored in the browser's local storage, so merchants can see how reviews affect sales. Merchants are responsible for the cookie notice on their own store.

10.4 How to manage cookies

• Cookie banner: the first time you visit quoli.io, you will see a cookie banner. Use it to accept all, reject non-essential cookies, or choose categories in Settings. You can change your choice at any time with the Cookies link in the site footer.
• Browser settings: most browsers let you block or delete cookies. Blocking strictly necessary cookies may break parts of the site.

10.5 Do Not Track signals

Some browsers send a "Do Not Track" (DNT) signal. There is no industry consensus on how to interpret DNT, so we do not currently respond to it.

11. Security

We encrypt data in transit with TLS and store data with providers that encrypt it at rest. Read our Security page for details.

12. Children's privacy

The Service is not directed to children under 13 (or 16 in the EEA / UK). We do not knowingly collect personal data from children. If we learn we have collected data from a child without verified parental consent, we will delete it promptly.

13. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or applicable law. When we make material changes, we will notify you by email or through the Service and update the "Last updated" date at the top of this page.

14. Contact us

Questions about this policy or your data? Contact our Data Protection point of contact at [email protected]. For GDPR-specific requests, see our GDPR & DPA page.