Privacy, in plain words.

Last updated 11 November 2026.

Who we are

Growth Dept is the trading name of Growth Dept Inc. (“Growth Dept”, “we”, “us”). This policy covers Growth Dept CRO: the website and application at cro.growthdept.ai, the Growth Dept CRO app for Shopify, its storefront runtime and pixel, and its APIs. Questions, and requests to see or delete data, go to hello@growthdept.ai.

Two kinds of people

People who use CRO: the brand staff and Growth Dept staff who sign in, and store staff who open the Growth Dept CRO app in Shopify. We decide how their data is used.

Shoppers and message recipients: a brand puts the CRO runtime and pixel on its store, and may use CRO to split its emails and text messages. We process that data for the brand, under our agreement with it, and only to run the brand’s tests and report their results.

What we collect from people who use CRO

Your email address and name, your role in each organization, and when you last signed in.
If you sign in with Google: the name, email address and Google account id that Google shares with your permission (the openid, email and profile scopes). We ask for nothing else from your Google account.
If you use a password: a hash of it, never the password itself.
If you create an account with an email and password from the Shopify app: we email you a link to confirm the address, and keep only a hash of the link until you confirm it. An account that is not confirmed within 7 days is deleted. So that we can limit how often one address is emailed, we record the time of each email against a keyed hash of the address, not the address itself, and delete those records after a day.
For each session: a hash of the session token, when it started and expires, and your browser’s user-agent string.
If you send a support request: its subject, your message and any files you attach, until you delete it. You and Growth Dept staff can read it.
If you use the AI analysis or the assistant: the conversations you keep, with any images or PDFs you attach, until you delete them.
An audit log of changes to accounts, brands, access and API keys, and of support visits by Growth Dept staff.

Connected AI assistants

You can connect an AI assistant such as Claude or ChatGPT to Growth Dept CRO through its MCP server. When you allow one on the consent page, we keep the assistant’s name and the addresses it returns to, the brand and permissions you chose, who allowed it, and hashes of its access and refresh tokens. Access tokens last an hour; refresh tokens end 90 days after their last use, or when you disconnect the assistant or revoke it under Settings, API keys. The assistant reads the brand’s tests, results and sitewide numbers through the tools you allowed, and what it reads goes to the assistant’s provider under your own account and that provider’s terms. We do not read your conversations with the assistant.

Connected tools: Google Analytics and Klaviyo

When a brand admin signs in with Google to set up GA4, we ask Google for permission to see and edit the brand’s Google Analytics configuration. We read the names and ids of the accounts, properties and web streams you can see, so you can choose one, and we register one custom dimension, exp_variant_string, on the property you choose. We keep the chosen stream’s names, ids and measurement id. The Google access token is kept encrypted for an hour at most, and deleted and revoked once you choose the stream; we ask for no long-term access and read no reports or visitor data from Google Analytics.
When a brand admin signs in with Klaviyo, or pastes a Klaviyo private key, we keep the key or Klaviyo’s tokens encrypted until the brand disconnects. They are used only to set test-group properties on profiles Klaviyo has already identified and to check which of the segments the brand’s tests name a visitor is in. Disconnecting deletes them, and revokes Klaviyo’s token.

What the Growth Dept CRO app for Shopify holds

The first time someone opens the app in a store’s admin, Shopify gives us an access token for the store, which expires after an hour, and a refresh token to get the next one. Both are encrypted before they are stored, and both are deleted when the app is uninstalled.
Until someone links the store to a brand on cro.growthdept.ai, the tokens are kept with the store’s name and the Shopify staff user id of the person who first opened the app. That id is a number Shopify assigns; Shopify does not give us that person’s name or email address. The record is deleted when the store is linked, when the app is uninstalled, or when Shopify asks us to erase the store’s data.
The setup link the app opens carries the store’s address and the same staff user id, signed, and works for 30 minutes. When the store is linked, the audit log records the store and that id.

What the runtime and pixel collect about shoppers

Which tests and arms a visitor was shown, page views, and add to cart, checkout and purchase events.
A random visitor id and the visitor’s arms, kept in the brand’s own _cro cookie for one year and in the cart as an attribute. A browser can delete the cookie sooner: Safari keeps cookies that a page’s script sets for 7 days.
On a Shopify theme, the runtime and the Growth Dept CRO app’s pixel follow the shopper’s analytics consent in Shopify’s customer privacy settings. Where the store asks for consent, a shopper who has not given it is left out of tests: the runtime keeps nothing in their browser and sends nothing to Growth Dept CRO. If a shopper withdraws consent on the store, the runtime deletes the _cro cookie and takes the attribute off the cart.

What we read from a store’s orders

Results and the sitewide reports come from Shopify’s own order records. CRO reads these fields of each order from Shopify:

the order’s id and number; when it was created, last updated or cancelled; whether it is a test order; its payment status; the sales channel it came from; its tags; and whether it needs shipping;
amounts in the store’s currency: subtotal, discounts, shipping, tax, total and refunds, as placed and after any edits, and whether its prices include tax;
the number of items and, for each line (up to 25 per order, or 30 for an order in a test), its id, quantity, product and variant titles, vendor and variant id; for an order in a test, also the line’s product id, product type, unit price, discount and subscription plan id;
the shipping method’s title and code;
the order’s note attributes, which is where the runtime puts the visitor’s arms and visitor id;
the customer’s Shopify id and how many orders they have placed. The id is hashed with the brand’s own key as soon as it arrives, and only the hash is stored;
the order’s email address, when Shopify allows the app to read it. It is hashed with the brand’s own key the moment it arrives and only the hash is stored. With the customer id’s hash, it lets a brand’s results follow a test customer’s later orders, including orders placed without an account;
Shopify’s summary of the visits that led to the order, kept only as the landing page’s path, the referring site’s host name, the UTM source, medium and campaign, and the marketing channel worked out from them.

First name, for a post-purchase greeting. A brand may greet shoppers by first name on its post-purchase offer page. For that alone, CRO reads the first name on the order from Shopify when the offer is shown, puts it on that page and does not store it.

CRO does not ask Shopify for any shopper’s last name, phone number or postal address, and reads an email address only to hash it as above. It does not store shoppers’ names, email addresses or IP addresses (an email address is kept only as its hash, which cannot be turned back into the address), and it does not link a shopper across different brands.

Tools a brand connects

Klaviyo: when a brand connects its Klaviyo account, the runtime reads the exchange id Klaviyo’s own script keeps for a visitor in a test whom Klaviyo has already identified, once the shopper’s consent allows it, and sends it with the first events of the visit. We keep it encrypted until we have set one property per test (cro_ and the test’s id, set to the arm) on that person’s profile in the brand’s Klaviyo account, and for 7 days at most. We never read an email address, phone number or name from Klaviyo.
Microsoft Clarity: when a brand turns Clarity tagging on, the runtime sets a Clarity custom tag for each test the visitor is in (cro_ and the test’s id, set to the arm) through the brand’s own Clarity tag on the page, once the shopper’s consent allows it.
Hotjar, Amplitude, Heap and Segment: switched on the same way, the runtime sends each test’s arm to the tool’s own script on the page.

Clarity and the other four tools get the arms in the shopper’s browser, from the tool’s own script; our servers send them nothing, and CRO never loads any of them itself. A brand’s webhooks and Slack get notices about its tests when the brand sets them up.

Message tests

When a brand tests an email or text message, its sender tells CRO who the message is for. CRO keeps only a salted hash of the recipient, never the address or number, along with which version was sent and whether it was delivered, opened, clicked, replied to or led to an unsubscribe.

Shopify’s privacy requests

When a shopper asks a store for their data, we record that the request arrived and how many orders it named. CRO holds no contact details to return.
When a shopper asks to be erased, we delete their orders (found by the hashed customer id and the order ids Shopify names), the orders’ lines and purchase events, and any Klaviyo exchange id waiting to be sent for them.
When Shopify asks us to erase a store, we delete the brand’s shopper data (events, sessions, test assignments, orders and their lines, message sends, cached and AI analyses, and the Klaviyo queue) and then the store connection. The brand’s test definitions and settings are kept: they are its own work, not shopper data.

Why we use it

Account data: to sign you in, confirm a new account’s email address, show you the brands you have access to, keep the service secure and answer support requests.
The Shopify app’s tokens and the staff user id: to install the app, link the store to the right brand, and keep the store connected.
Shopper and recipient data: to decide which version each person sees and to report the brand’s test results, for the brand that collected it, and nothing else. The Klaviyo and analytics tags exist so a brand can see its test arms in its own tools.

We do not sell personal data, use it for advertising, or share it with other brands.

Google user data

Growth Dept CRO’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google sign-in data only to sign you in and identify your account, and Google Analytics access only to list the streams you can choose from and register the custom dimension described above. We do not sell it, use it for advertising, allow humans to read it except with your consent or for security and abuse handling, or use it to train or improve AI or machine-learning models.

Cookies on cro.growthdept.ai

cro_session: keeps you signed in, for up to 30 days.
cro_google_flow: holds a Google sign-in in progress.
cro_ga4_flow and cro_klaviyo_flow: hold a Google Analytics or Klaviyo sign-in in progress, for ten minutes.
cro_signin_pending: holds a sign-in waiting for a second factor.

This site sets no analytics or advertising cookies.

Who else handles it

Vercel hosts the application, and Neon hosts the database, both in the United States (US East).
Google, when you choose to sign in with Google, or a brand admin connects Google Analytics.
Klaviyo, when a brand connects Klaviyo.
The provider of an AI assistant you connect (for example Anthropic for Claude, or OpenAI for ChatGPT), for what the assistant reads.
Shopify, which sends CRO the brand’s orders and hosts the runtime and pixel in the brand’s store.
Resend, which sends our account emails, such as the link that confirms a new account’s address. It receives the address and the email’s text.
Anthropic, when a member uses the AI analysis or the assistant. It receives a test’s definition, totals per arm and statistics, or for a chat started outside a test, the brand’s tests, their headline numbers and the store details needed to draft a test, together with what the member types or attaches. It never receives visitor ids, order ids or customer details.
Growth Dept’s Slack workspace, which may get a one-line notice of each support request: the brand, subject, request type, test and number of files, with no message, file or email address.
The tools a brand connects itself (above), which receive what the brand sends them under its own agreement with each.

How long we keep it

Raw events, sessions and unconfirmed purchase claims: 400 days by default. Test results are kept.
A Klaviyo exchange id: until it is sent, and 7 days at most.
An unclaimed app install: until the store is linked, the app is uninstalled or Shopify asks us to erase the store’s data.
An account confirmation link: until it is used or replaced, and it stops working after 24 hours. An unconfirmed account: 7 days.
Your account: until you or your organization ask us to delete it.

How it is protected

Each brand’s rows are separated by Postgres row-level security. Store tokens, the Shopify app’s tokens, the Klaviyo key and Klaviyo exchange ids are encrypted with AES-256-GCM before they are stored. Passwords, session tokens, API keys and account confirmation links are stored only as hashes. Neon, which hosts the database, encrypts its stored data with AES-256 and accepts only encrypted (TLS) connections. The security page has the details.

Your choices

Email hello@growthdept.ai to see, correct or delete your account data. Shoppers and recipients who want their data removed should ask the brand they dealt with; we act on the brand’s instruction, and on the erasure requests Shopify forwards. You can remove CRO’s access to your Google account at any time in your Google account settings, and disconnect an AI assistant in the assistant or under Settings, API keys.

Changes

We may update this policy. The current version is always at cro.growthdept.ai/privacy, with the date it was last updated.