Privacy Policy
Last updated: March 15, 2026
1. Introduction
Experience Email, LLC (“we,” “our,” or “us”) operates Lexi Connect, an interpreted data feed for ecommerce teams. This Privacy Policy explains how we collect, use, store, and protect information when you use Lexi Connect at lexiconnect.app and experience.email (collectively, the “Service”).
Lexi Connect integrates with third-party platforms you choose to connect — including Shopify, Klaviyo, Attentive, Meta Ads, Google Ads, and Notion — to deliver daily cross-channel analysis and actionable insights to your team. This policy describes exactly what data we access from each platform, how we process it, and where it goes.
By using the Service, you agree to the collection and use of information in accordance with this policy.
2. Information We Collect
2.1 Account Information
When you create an account, we collect:
- Email address
- Password (hashed, never stored in plain text)
- Display name (optional)
2.2 Data from Connected Platforms
When you connect a platform via OAuth, we access specific data from that platform. All integrations are read-only — we do not write to, modify, or delete any data in your connected accounts.
Shopify
What we access:
- Order data: order ID, timestamps, status, total price, subtotal, tax, discounts, currency, tags
- Product data: product ID, title, handle, vendor, type, status, variant count, price range
- Customer email addresses (hashed immediately on receipt — see Section 5)
- Shop metadata: store name, domain, currency, timezone
What we do NOT access:
- Customer names, physical addresses, or phone numbers
- Payment details (credit cards, payment processor information)
- Billing addresses
- Shipping or tracking details
Klaviyo
What we access:
- Campaign performance metrics: send count, open rate, click rate, bounce rate, unsubscribe rate, revenue attribution
- Automated flow performance: per-flow metrics, revenue per recipient, trigger counts
- Deliverability metrics: delivery rate, bounce rate, spam complaint rate
- Channel breakdown: email vs SMS performance
What we do NOT access:
- Individual subscriber profiles or contact lists
- Email addresses of your subscribers
- Message content or templates
- Segment definitions or audience data
Attentive
What we access:
- Message performance metrics: send count, delivery rate, click rate, revenue attribution
- Subscriber growth: opt-in and opt-out event counts
- Channel performance: SMS and email aggregate metrics
- SFTP data feed: event-level performance data (delivered via secure file transfer)
What we do NOT access:
- Individual subscriber phone numbers or email addresses
- Message content or creative assets
- Audience segments or subscriber lists
Meta Ads (Facebook & Instagram)
What we access:
- Campaign performance: spend, impressions, clicks, conversions, ROAS, CPC, CPM, link CTR
- Campaign metadata: campaign name, status, objective
- Account-level daily aggregates
- Up to 365 days of historical data
What we do NOT access:
- Ad creative content, images, or copy
- Audience targeting or custom audience data
- Pixel or conversion data at the individual user level
- Facebook or Instagram user data
Google Ads
What we access:
- Campaign performance: spend, conversions, conversion value, ROAS, CPC, CTR
- Campaign metadata: campaign name, type (Search, Shopping, Performance Max, Display, Video), status
- Account-level daily aggregates
- Up to 365 days of historical data
What we do NOT access:
- Ad creative content or copy
- Keyword lists or search term reports
- Audience targeting or remarketing lists
- Google Analytics data
Notion
What we access:
- Workspace ID and workspace name
- Database IDs for Lexi Connect databases you grant access to
- Page and database content within the Lexi Connect template (for reading ticket status and Setup database configuration)
- Comments on Lexi Connect pages (for correlating team actions with metric changes)
What we do NOT access:
- Notion pages or databases outside the Lexi Connect template
- Your personal Notion content
- Workspace member lists or permissions
Note: Notion is the only platform where Lexi Connect writes data. We create and update database rows (daily metrics, insights, action items) in the Lexi Connect databases within your workspace.
2.3 Information We Collect Automatically
When you use the Service, we automatically collect:
- Log information: IP address, browser type, operating system, access times, and pages viewed
- Device information: hardware model, operating system version
- Usage information: features used, actions taken, and session duration
2.4 Payment Information
Payment processing is handled by Stripe, Inc. and, for Shopify App Store installations, by Shopify Inc. We do not store credit card numbers or complete payment information on our servers. We receive from our payment processors: subscription status, plan tier, billing period, and transaction history.
3. How We Use Your Information
3.1 Primary Use: Analysis and Insights
We use data from your connected platforms to:
- Calculate daily performance metrics (revenue, orders, AOV, conversion rates, ROAS, RPR)
- Compute rolling baselines and trend comparisons (week-over-week, month-over-month)
- Run cross-channel analysis to identify root causes of performance changes
- Generate AI-powered executive insights and recommendations
- Create prioritized action items (tickets) assigned to your team
- Sync aggregated metrics, insights, and tickets to your Notion workspace
3.2 AI Processing
Lexi Connect uses third-party AI services (Anthropic Claude API) to generate daily analysis and executive insights. When the analysis engine runs:
- Aggregated performance metrics (not raw customer data) are sent to the Anthropic API for real-time processing
- Per Anthropic's API terms, data submitted through the API is not used to train AI models
- AI-generated text (insights, ticket descriptions) is stored in our database and synced to your Notion workspace
- We do not build, train, or improve any machine learning models using your data
3.3 Other Uses
- Process subscription payments and manage billing
- Send service notifications (trial expiration, sync errors, payment issues)
- Respond to support requests
- Monitor service health and troubleshoot technical issues
- Comply with legal obligations, including GDPR data subject requests
3.4 What We Do NOT Do
- Sell your data to third parties
- Use your data for advertising or marketing to third parties
- Share your data with other merchants or users
- Build or train AI models on your data
- Access your data for purposes other than providing the Service
- Combine your data with data from other users for profiling
4. Sharing of Information
4.1 Third-Party Service Providers (Sub-processors)
We share data with the following service providers to operate the Service:
| Provider | Purpose | Data shared |
|---|
| Supabase | Database hosting, authentication | All application data (encrypted at rest) |
| Vercel | Application hosting | Authentication data, request logs |
| Anthropic | AI analysis engine | Aggregated metrics (not raw customer data) |
| Stripe | Payment processing | Billing and transaction data |
| Resend | Transactional email delivery | Email address, notification content |
4.2 Your Notion Workspace
Aggregated metrics, AI-generated insights, and action items are synced to database rows in your Notion workspace. This data is then subject to Notion's privacy policy and your workspace's sharing settings. We do not control who has access to your Notion workspace.
4.3 Data We Do NOT Share
We do not share your data with marketing platforms, advertising networks, data brokers, other merchants, or any unaffiliated third parties.
4.4 Legal Requirements
We may disclose information if required to do so by law or in good faith belief that such action is necessary to comply with legal obligations, protect our rights or safety, or investigate potential violations of our Terms of Service.
5. Data Protection and Security
5.1 Customer Email Hashing
Customer email addresses received from Shopify orders are immediately hashed using SHA-256 with a per-tenant salt before storage. The original email address is not retained. Hashing is one-way and irreversible — we cannot retrieve the original email from the hash. This allows us to identify repeat customers for analytics without storing personally identifiable information (PII).
5.2 Encryption
- In transit: All data transmitted over TLS 1.2+. All API calls to third-party platforms use encrypted connections.
- At rest: OAuth access tokens encrypted using AES-256 via pgcrypto. Database hosted on Supabase with encryption at rest. Passwords hashed using bcrypt.
5.3 Access Control
- Row-Level Security (RLS) enforced at the database level — users can only access their own data
- All API routes verify authenticated sessions server-side
- Administrative access restricted to role-verified team members
- OAuth tokens decrypted only at the moment of use, never exposed to the client
5.4 Webhook Verification
All inbound webhooks (Shopify GDPR webhooks, Notion events, Stripe billing events) are verified via HMAC signature validation using timing-safe comparison before processing. Payloads with invalid or missing signatures are rejected and logged.
6. Data Retention
6.1 While Your Account Is Active
We retain your data for as long as your account is active and your platforms are connected:
- Aggregated daily metrics: retained indefinitely for historical trend analysis
- AI-generated insights and tickets: retained indefinitely
- OAuth tokens: retained until you disconnect the platform or revoke access
- Account information: retained until you delete your account
6.2 After Disconnection or Cancellation
- When you disconnect a platform: OAuth token revoked immediately. Historical data retained for 30 days, then deleted.
- When you cancel your subscription: Access continues until end of billing period. Data retained for 30 days after expiration, then deleted.
- When you uninstall via Shopify: GDPR shop/redact webhook processed. All shop data deleted within 30 days.
6.3 Compliance Logs
GDPR compliance request logs (data_request, customers/redact, shop/redact) are retained for 7 years as required by law. These logs contain only request metadata (timestamp, request type, shop domain), not the deleted data itself.
7. GDPR and Shopify Compliance
We implement the mandatory GDPR webhooks required by Shopify:
customers/data_request
When a customer requests their data: we provide all data associated with their hashed email identifier. Processed within 30 days.
customers/redact
When a store owner requests customer data deletion: all data for the specified customer is deleted within 30 days.
shop/redact
When a store owner uninstalls the app: all shop data is deleted within 30 days, including orders, analytics, insights, tickets, and configuration.
8. Your Rights
8.1 Under GDPR (EU/EEA Residents)
You have the right to:
- Access: Request a copy of all data we hold about you
- Rectification: Correct inaccurate data
- Erasure: Request deletion of your data (“right to be forgotten”)
- Portability: Receive your data in a machine-readable format
- Objection: Object to processing of your data
- Restrict processing: Limit how we use your data
To exercise these rights, email privacy@experience.email. We will respond within 30 days.
8.2 Under CCPA (California Residents)
You have the right to know what personal information is collected, request deletion of your personal information, and opt out of the sale of personal information. We do not sell personal information.
8.3 For All Users
- Disconnect anytime: Remove any platform connection from the Connections page
- Revoke OAuth access: Revoke Lexi Connect's access from within Shopify, Klaviyo, Meta, Google, or Notion settings
- Delete your account: Contact support@experience.email
- Export your data: Contact support@experience.email
9. Cookies and Tracking
We use cookies for:
- Authentication: Session management and login state (essential, cannot be disabled)
- Security: CSRF protection and OAuth state validation
We do not use advertising cookies, cross-site tracking cookies, or third-party analytics cookies on the Lexi Connect application (lexiconnect.app).
10. International Data Transfers
Data is stored and processed in the United States. Our infrastructure providers (Supabase, Vercel) maintain SOC 2 certification. For EU-US data transfers, we rely on Standard Contractual Clauses (SCCs) and applicable adequacy decisions.
11. Children's Privacy
The Service is not intended for children under 13 years of age. We do not knowingly collect personal information from children. If we learn we have collected data from a child under 13, we will delete it promptly.
12. Data Breach Notification
In the event of a data breach that affects your personal information:
- Affected users will be notified within 72 hours
- Relevant regulatory authorities will be notified as required by law
- Notification will include: what data was affected, when, and what remediation steps are being taken
13. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-app notification at least 30 days before taking effect. The “Last updated” date at the top of this page indicates when the policy was last revised.