Privacy policy

What Perzo collects, why, who helps us process it, how long it is kept and what you can ask of us.

Last updated: October 17, 2026

Who we are

Perzo (www.perzo.art) is a Shopify app that turns a shopper’s photo into artwork in a style chosen by the store, and links the approved artwork and a print file to the store’s order. Perzo is operated by the business registered under CNPJ 37.511.626/0001-72, Avenida Professor Adhelar Matthes, 113, Campinas, SP, 13085-015, Brazil. Questions about this policy: support@perzo.art.

For the stores that use Perzo (“merchants”), we decide how their account data is used. For the photos and orders of a store’s shoppers, the store decides, and Perzo processes that data on the store’s behalf and under its instructions, as set out in the data processing terms.

What we collect

From merchants

Account details: name, email address and a hashed password (if you create a Perzo login), and team members you invite.
Store connection: the Shopify store domain and the access tokens Shopify issues to the app, stored encrypted.
What you set up in Perzo: products, print sizes, styles, reference images, test photos and settings.
Billing records: your plan, the generations used and the charges billed through Shopify.
Store analytics: when enabled, our servers may send Google Analytics 4 a few milestones of your store’s use of Perzo (app installed or uninstalled, plan selected with its name and monthly price, trial converted, first style published, first mockup ready, theme block detected, and your first personalized order with its value). In these events, which our servers send, your store is identified only by a keyed hash of its internal Perzo id, never by its domain or email addresses, and no shopper data is sent. (Measurement on our Shopify App Store listing is run by Shopify and works differently: see Shopify App Store listing measurement.) When you uninstall and Shopify asks us to erase your store’s data, we stop sending and delete our own records of these events; events already sent remain in Google Analytics under its retention (14 months for event-level data).

From shoppers of a store

The photo a shopper uploads, the framing they choose, the artwork generated from it and the version they approve.
Text a shopper enters to personalize the product (for example a name or a dedication).
When the store’s team makes art for a customer by hand: the label the team types to find it again, which may include the customer’s name or phone number.
For orders with a personalized item: the order and line item identifiers, amounts used to report revenue to the store, and Shopify’s customer identifier. We do not request the shopper’s contact or payment fields from Shopify.
Technical data to prevent abuse: the IP address and a device identifier, kept only as keyed hashes for rate limits.
Art reminder email, only where the store turned it on and only if the shopper ticks an unchecked box and types an email address: that address (encrypted), the exact consent text and its time. Perzo sends that shopper one email with a preview of their art and an unsubscribe link, then erases the address (also when the shopper buys, unsubscribes or the reminder no longer applies). A keyed hash of the address is kept to honor the one-email limit and opt-outs, and the record is deleted after 60 days; an opt-out is kept as a hash only.

Visitors of www.perzo.art

The live demo at /try handles the photo you upload in the same way, with a browser check by Cloudflare Turnstile.
Early-access sign-ups: your name, email address, WhatsApp number (if you give one), store and other details you give us, and the sentence you signed up under with the time. We use them to contact you, by email or WhatsApp, about Perzo becoming available. With each sign-up we also keep the campaign that brought you (campaign names, the site that sent you and the page you landed on), the cookie and ads state your browser applied (with its version and time, and whether it came from your choice, the default of your region, Global Privacy Control or an earlier opt-out) and the country and privacy region our server derived from the sign-up’s IP address (the country code only); while advertising measurement was on, also the ad click id you came with (such as gclid or fbclid). We use these to know which of our campaigns work and, while advertising measurement is on, to measure our ads with Meta and Google (see Advertising measurement). We keep a sign-up until we have told you Perzo is open, plus 90 days, and then delete it. To have it deleted sooner, write to support@perzo.art.
Site analytics (see Cookies and analytics): the pages you view, clicks on buttons such as “Get early access”, whether the live demo started and showed art, your device and browser type, an approximate location Google derives from your IP address, and the site or campaign that brought you here (page addresses are sent without their query strings, except plain campaign names and, while advertising measurement is on, Google ad click ids). If you sign up while analytics is on, our server also tells Google Analytics that this browser signed up (the event “generate_lead”, with the random browser and session ids Google Analytics set, the time and the sign-up page). From www.perzo.art and our servers, we never send your name, email address (hashed or not), WhatsApp number, store address or photos to Google.

Why we use it

To generate the artwork, show it to the shopper, and link the approved version and its print file to the store’s order.
To run the merchant dashboard, report revenue and usage, and bill through Shopify.
To keep the service secure: sign-in, rate limits and abuse prevention.
To understand how visitors find and use www.perzo.art and to improve it (site analytics, with your consent where the law requires it).
To understand how stores get started with Perzo and how our marketing performs (store analytics).
To measure our own ads on Meta (Facebook, Instagram) and Google: which ads lead to visits and early-access sign-ups, so the platforms can count them and show our ads to people more likely to be interested (advertising measurement, with your consent where the law requires it).

We do not sell personal data for money, and we do not use shopper photos to train AI models. Sharing sign-up data with Meta and advertising signals with Google to measure our ads, described below, may count as “sharing” or “targeted advertising” under US state privacy laws. In the United States it is on by default and you can opt out at any time (see Your US privacy choices); everywhere else it happens only if you allow it.

Who processes it for us

OpenAI: generates the artwork from the photo and the style (and answers the style assistant in the studio), under its API data terms.
fal.ai: generates the artwork instead of OpenAI when a style uses an image model hosted there.
Anthropic: its Claude models check the quality of our marketing videos and images, which may show artwork made from shopper photos.
Cloudflare: stores files privately (R2), runs our DNS and the browser check on the live demo.
OVH: hosts our servers and database.
Shopify: installs the app, runs the cart, checkout and billing, and sends us order notifications.
Google Workspace: our email.
Resend: delivers Perzo’s emails, including the art reminder email to a shopper who asked for it (their address and the email’s content).
Google Analytics and Google Tag Manager: measure visits on the public pages of www.perzo.art; Google Analytics may also receive the store analytics described above and the early-access sign-up event. Google Ads reads our sign-up conversions from Google Analytics.
Meta Platforms (Conversions API, from our server): measures our ads, as described under Advertising measurement. Meta uses this data under its own terms, as a separate controller for some purposes.
Meta and Google may also receive events about our Shopify App Store listing from Shopify, when we enable it (see Shopify App Store listing measurement).

Some of these providers process data outside your country, including in the United States.

Notice at collection

This notice applies when you visit www.perzo.art or sign up for early access, in particular for visitors in the United States, where our site measurement and ad measurement are on by default.

Categories we collect: identifiers (email address, name, WhatsApp number if you give one, IP address, random browser and session ids set by Google Analytics, ad click ids such as gclid or fbclid), internet activity on our site (pages viewed, buttons clicked, the site or campaign that brought you, browser and device type), approximate location (the country we derive from your IP address; Google derives its own) and commercial information you give us about your store.
Purposes: contacting you about Perzo, measuring visits to our site (analytics), measuring which of our ads bring visits and sign-ups (advertising measurement) and keeping the site secure.
Who receives it: Google (Google Analytics and Google Tag Manager in your browser; from our server, the sign-up event with the browser and session ids, never your email) and Meta (from our server, when you sign up: your email address hashed with SHA-256, the IP address and browser of that request and the Meta ad click id you came with). This may count as “sharing” for cross-context behavioral advertising, or “targeted advertising”, under US state privacy laws. We do not sell personal data for money.
How long: sign-ups until we have told you Perzo is open, plus 90 days; the request details used to send an ad measurement event, until it is delivered or for at most 7 days; Google Analytics event data up to 14 months. Details below.
Your choice: Do Not Sell or Share My Personal Information, at the bottom of every page and next to the sign-up form, or Global Privacy Control in your browser (see Your US privacy choices).

Cookies and analytics

The public pages of www.perzo.art use Google Analytics 4 and Google Tag Manager. They are never loaded in the Perzo dashboard, in Shopify admin, in the admin area or in the personalizer on stores. We do not use the Meta Pixel on www.perzo.art. (Our Shopify App Store listing is a Shopify page; see Shopify App Store listing measurement.)

Two purposes: analytics (Google Analytics) and advertising measurement (Google’s ad signals and sharing sign-up data with Meta to measure our ads).
How we choose your region: when a page opens, your browser asks our server which rules apply. Our server looks up the country of your IP address in an offline copy of the DB-IP country database (your IP address is not sent to anyone for this) and answers only the privacy region, never inside the cached page. A sign-up keeps the country code and region, not the IP address, for this purpose. Until the answer arrives, nothing is loaded or sent. The lookup can be wrong (for example with a VPN); if it fails, is unsure or the database is out of date, we apply the stricter rules. IP Geolocation by DB-IP, used unmodified under the CC BY 4.0 license.
United States: analytics and advertising measurement are on by default. A short notice says so when you first visit, with OK (which only closes the notice) and Do not sell or share my info (which turns advertising measurement off at once). More choices also lets you turn analytics off (Reject all).
Everywhere else (including the European Economic Area, the United Kingdom, Switzerland, Brazil and Canada) nothing is on until you choose: the banner offers Reject all, Analytics only and Accept all, with the same weight. Before you choose, Google’s tags are not loaded at all and nothing is sent to Google. Advertising measurement needs Accept all.
A choice made under an earlier version of this notice keeps counting: what it allowed and refused stays as it was. A choice made before October 8, 2026 covered analytics only and is never treated as a choice about advertising.
Global Privacy Control: if your browser sends this signal (as a browser setting or with its requests), we treat it as an opt-out of advertising measurement in every region, whatever you chose in the banner, and in the United States nothing is turned on by default.
Cookies: with analytics on, Google Analytics sets first-party cookies (_ga and _ga_*, up to 2 years) holding a random identifier for your browser, so repeat visits can be told apart. With advertising measurement on, Google’s tags may also use their ad cookies (_gcl_*). None of them is your name or email address. Your choice is kept in your browser’s local storage, not in a cookie, and so are the campaign that brought you (up to 90 days, only while analytics is on) and the ad click id you came with (only while advertising measurement is on). When you sign up for early access we set one strictly necessary first-party cookie, perzo_lead_ref (a random reference, 180 days, not readable by scripts), so an opt-out from this browser reaches your sign-up and still holds if you clear this site’s storage, and perzo_lead (just “1”, 180 days), so the page knows to send it.
Referral links: on a creator’s Perzo referral page (/ref/…), only if you choose to credit that creator, we set one first-party cookie, perzo_ref (a random token, 30 days, not readable by scripts). Opening the page sets nothing. It is used only to credit that creator if this browser then installs Perzo on a Shopify store; we keep only a hash of it, and it is removed once used. It is separate from analytics and advertising: your cookie choice does not share it with Google or Meta. You can remove it by clearing this site’s cookies.
Changing your choice: use Cookie settings or Do Not Sell or Share My Personal Information at the bottom of any page. Turning a purpose off stops it in this browser from then on (no more analytics events, or no more advertising signals) and removes what was stored for it; what it means for a sign-up already made is explained under Advertising measurement. You can also clear cookies in your browser or install Google’s opt-out add-on.
Event-level analytics data is kept in Google Analytics for up to 14 months; aggregated reports may be kept longer. Google may process this data in the United States.

Advertising measurement

We advertise Perzo on Meta (Facebook, Instagram) and Google. To learn which ads bring visitors and early-access sign-ups, and so that those platforms can count our results, we use the following while advertising measurement is on: in the United States unless you opted out, elsewhere only if you chose Accept all, and never while your browser sends Global Privacy Control (see Cookies and analytics):

Meta Conversions API: when you sign up for early access for the first time, our server sends Meta one “Lead” event with your email address hashed (SHA-256), the IP address and browser (user agent) of that request, the Meta ad click id you came with (if any), the sign-up page, its time and a random event id. Repeat sign-ups with the same email are not sent again. Meta is the only one that receives your hashed email.
Google: with analytics on, the sign-up event goes to Google Analytics as described above (browser and session ids, never your email), with advertising measurement as Google’s consent signals (denied while it is off); Google Ads reads our sign-up conversions from Google Analytics and matches them to its own ad clicks (gclid, gbraid, wbraid). We do not send your email address, hashed or not, to Google.

Hashing is not anonymization: Meta can match a hashed email address to an account that uses the same address, which is how it counts the sign-up for our ad. It does not let Meta read your email address from the hash alone.

Retention: the request details our server keeps to send these events (IP address, user agent, Meta click id, Google Analytics browser and session ids) are deleted as soon as it is delivered (the Google Analytics browser id one day later, so an opt-out that crosses the delivery can still be passed on to Google; when that happens, it is kept until our deletion request to Google is recorded as done), or after at most 7 days if it cannot be. The campaign and click ids stored with your sign-up are kept, and deleted, with the sign-up. Meta and Google keep what they receive under their own terms (Google Analytics: up to 14 months for event-level data). They may process it in the United States.

Stopping it: choose Do not sell or share my info (or Reject all), or turn on Global Privacy Control in your browser. This browser then shares nothing more for ads and the ad click id it stored is cleared (Reject all also stops analytics and clears the stored campaign). If you signed up from this browser, we also record the opt-out against your sign-up: any of its events not yet delivered to Meta or Google (including ones waiting for a retry) are not sent, or go to Google without advertising signals, and its stored ad click id is deleted. What Meta or Google had already received before your opt-out cannot be recalled by us; if an event was already on its way when your opt-out arrived, we record it and tell the recipient. If you opt out from another browser, write to support@perzo.art and we will apply it to your sign-up, or delete the sign-up. Signing up again with the same email while refusing also applies the refusal to it (a later sign-up never turns sharing back on).

Shopify App Store listing measurement

Perzo’s listing on the Shopify App Store (apps.shopify.com) is a page operated by Shopify, not by us. When we enable Shopify’s listing measurement there, Shopify may send Meta and Google events about the listing: views of the listing, clicks on Install and completed installs. With these events, Meta may receive the store’s name and URL, and Google Analytics the store’s name, URL and Shopify store id.

Purpose: measuring which of our ads bring stores to Perzo (merchant acquisition). It is not used for shoppers’ data: no shopper photo, order or customer data is part of it.
Your choices there: Shopify’s own cookie and privacy controls apply on apps.shopify.com (see Shopify’s cookie policy). The cookie settings of www.perzo.art do not control that page. To ask us about the data we receive from it, write to support@perzo.art.
Retention: Meta and Google keep what they receive under their own terms (Google Analytics: up to 14 months for event-level data).

Your US privacy choices

Opt out of sale or sharing: Do Not Sell or Share My Personal Information at the bottom of every page (and next to the sign-up form) opens your choices; one click on Do not sell or share my info applies it, with no account, form or confirmation. Global Privacy Control is honored the same way, automatically, and this browser remembers it even on a later visit without the signal. The site then shows “Opt-out request honored”.
After you opt out we do not ask you to turn sharing back on for at least 12 months, and we never turn it back on by ourselves: only you can, from the same choices, and only after confirming it in a separate step.
Other rights: depending on your state, you may ask to know, access, correct or delete your personal data, and appeal our answer, by writing to support@perzo.art. We will not treat you differently for using these rights. You may use an authorized agent.

Brazil and the LGPD

Perzo is operated from Brazil, so Brazil’s LGPD also applies to how we handle personal data, wherever you are. For the site, we rely on your consent for analytics and advertising measurement outside the United States, and for visitors in the United States on our legitimate interest in measuring our own marketing, with the opt-out above; contacting you about Perzo relies on the request you made when you signed up. Transfers to providers outside Brazil, such as Google and Meta in the United States, rely on their contractual safeguards. You can exercise your LGPD rights at support@perzo.art and complain to the ANPD.

How long we keep it

Each store sets its own retention periods in Perzo. The defaults are:

Photos and artwork of ordered items: 360 days.
Photos and artwork of personalizations that were not ordered: 30 days.
Photos uploaded to the live demo on www.perzo.art: about 1 day.

When a store uninstalls Perzo, our access to the store ends at once. Shopify then asks us, 48 hours or more later, to erase the store’s data, and we delete its files and remove shopper identifiers from its records. Merchant account and billing records may be kept longer where the law requires it.

Your choices and rights

Shoppers: ask the store you bought from. Stores can access and delete their shoppers’ data, and Shopify forwards customer data and deletion requests to us. You can also write to support@perzo.art, and we will work with the store to answer.

Merchants: you can ask us for access to, correction of or deletion of your personal data at support@perzo.art. Depending on where you live, laws such as the GDPR or Brazil’s LGPD may give you further rights, including to object and to complain to a data protection authority.

Security

Files are private and served only through short-lived links. Store access tokens are encrypted, and each store’s data is kept apart from other stores’ in the database. No system is perfectly secure; if a breach affects your data, we will tell you as the law requires.

Children

Perzo is a service for businesses and is not directed to children. Stores must not ask children to upload photos through Perzo.

Changes

We will update this page when our practices change and note the date above. For significant changes, we will tell merchants in the app or by email.