Privacy policy

Last updated 6 November 2026

The short version

• Heatwave records how shoppers use a store (clicks, scrolling, pages, and replays of some visits) so the store can see where shoppers get stuck. It never records names, email addresses, anything typed into forms, or payment details.
• Tracking only starts once the shopper allows analytics through the store’s cookie banner, and stops as soon as they withdraw it. Global Privacy Control is respected.
• Shopper data is anonymous and deleted automatically when the store’s history period ends (30 days, 90 days or 1 year, depending on the plan), and within 48 hours if the store uninstalls the app.
• We do not sell data or use it for advertising. Our service providers are listed in section 6.

1. Who we are

Heatwave is a Shopify app made by PixelFox Group AB (“we”, “us”). It shows Shopify merchants heatmaps, recordings of visits and recommendations for their store. Questions about this policy or your data: support@wearepixelfox.com.

PixelFox Group AB
Org. no. 559335-1157
Birger Jarlsgatan 21, 111 45 Stockholm, Sweden

For shopper data, we process data on behalf of the store you are shopping in, under our Data processing agreement. The store is the controller and is responsible for its own customer data, and its own privacy policy also applies. If you have a question about data collected on a particular store, you can contact the store or us.

For data about merchants using the app and visitors to this website, we are the controller.

2. Shoppers: what Heatwave records

When a store uses Heatwave and you allow analytics, Heatwave records:

• pages viewed, device type, browser family and country
• clicks and taps, how far you scroll and how long each part of a page is on screen
• cart and checkout steps reported by Shopify, page speed and website errors
• for some visits, a replay of the page and your movements on it, so the store can watch where shoppers struggle

What we never record:

• names, email addresses, phone numbers or postal addresses
• anything typed into forms, search boxes or the cart note
• passwords, card numbers or payment details
• customer account pages, order details or Shopify’s checkout pages
• IP addresses (see below)

Personal details that appear on a page, such as an email address, a phone number or “Hi, Jane”, are masked in your browser before anything is sent. Stores can mark further parts of their pages to hide.

Consent. Heatwave only starts once Shopify’s Customer Privacy API reports that you have allowed analytics. If you decline, use Global Privacy Control or withdraw your consent later, Heatwave records nothing further from that moment.

Identifiers. A random visitor ID is stored in your browser so a return visit can be recognised. It is not linked to your name, email or Shopify customer account, and it expires 13 months after it was created.

IP addresses. Your IP address is used briefly, in memory, to look up your country and to prevent abuse (rate limiting). It is not stored.

3. Merchants: what we store about your store

• Your store’s domain and the access token Shopify issues when you install the app.
• The name, email address and language of the staff member who opens the app, as provided by Shopify’s sign-in, so we can keep you signed in and contact you about your account if needed.
• Your settings: how many visits to record, extra parts of pages to hide, pages to exclude and, for password-protected stores, the storefront password (stored encrypted) so our browser can take pictures of your pages.
• Product and page information needed to label your data, such as product titles and page types.
• Your plan and usage, so we can bill through Shopify. Payments are handled by Shopify; we never see card details.
• Recommendations written for your store and their status.
• Support conversations, if you contact us.

4. Visitors to this website

This website does not use cookies, analytics, advertising pixels or third-party trackers. Our hosting provider processes standard technical data (IP address, browser type, requested page) in short-lived server logs to deliver and secure the site. If you email us, we use your email address and message to reply.

5. AI recommendations

To write recommendations, we send Anthropic’s Claude models pictures of the store’s pages (taken by our own browser, not shoppers’ screens), aggregated statistics and short anonymous summaries of visits. No shopper identities are included. Anthropic processes this data as our service provider and does not use it to train its models.

6. Service providers

We use these providers to run Heatwave. They only receive what they need for their part of the service, and each is bound by a data processing agreement. The same list, with the notice period for changes, is on our sub-processors page.

Some providers are based in, or may access data from, countries outside the EU/EEA, such as the United States. Where this happens, we rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission’s Standard Contractual Clauses.

7. Legal basis

• Shopper data: the store decides to use Heatwave and is responsible for its legal basis. Heatwave only runs after the shopper has allowed analytics through the store’s consent banner, and stops when that consent is withdrawn.
• Merchant data: to provide the service the store has signed up for (performance of a contract, GDPR Art. 6(1)(b)).
• Security, abuse prevention and reliability, and replying to emails: our legitimate interests (Art. 6(1)(f)).
• Bookkeeping records: legal obligation (Art. 6(1)(c)).

8. How long we keep data

• Shopper behaviour and recordings: the store’s history period (30 days, 90 days or 1 year, depending on the plan), then deleted automatically.
• All data for a store: deleted when Shopify sends its data-erasure request, 48 hours after the app is uninstalled. A merchant can also delete all collected data at any time in Settings.
• Merchant account and settings: while the app is installed, then deleted as above.
• Support emails: up to 24 months after the conversation ends.
• Billing and accounting records: as long as Swedish bookkeeping law requires (currently 7 years).

9. Your rights

Under the GDPR you have the right to access, correct, delete and port your data, to object to or restrict processing, and to withdraw consent. Email support@wearepixelfox.com and we’ll reply within one month. Shopify forwards customer data and erasure requests to us, and we handle them.

Because shopper data is not linked to your identity, there is usually nothing we can identify as yours. If you can share the visitor ID stored in your browser, we can find and delete that data. You can also clear your browser storage, decline analytics in the store’s cookie banner or turn on Global Privacy Control.

You can complain to a data protection authority. In Sweden that is the Swedish Authority for Privacy Protection (IMY, imy.se), or the authority where you live.

10. Security

Data is encrypted in transit and at rest, and storefront passwords are separately encrypted. Recordings are reached only through short-lived signed links. Tracker data is accepted only with per-store keys and rate limits. Access to production systems is restricted to the people who run the app.

11. Children

Heatwave is a business tool and is not directed at children.

12. Changes

We update this policy when the app changes. The date at the top shows the latest version. Significant changes are announced to merchants in the app or by email.