Privacy Policy for Luca

Effective Date: October 6, 2026
Business Contact: [email protected]

Luca ("we," "our," or "us") provides a profit intelligence app for Shopify merchants. This Privacy Policy describes how we collect, use, and process your data when you install and use the Luca app.

1. Our Commitment to Your Privacy

Luca is built to provide "Your actual profit, finally." We operate on a principle of data minimization: we only collect the financial data necessary to calculate your metrics.

• No Customer PII: We do not collect, store, or process any Personally Identifiable Information (PII) of your customers, such as names, email addresses, physical addresses, or phone numbers.

2. Information We Collect

We collect information directly from your Shopify store via OAuth and through your manual inputs.

A. Shopify Store Data

We sync the following data:

• Order Information: Order IDs and Shopify internal IDs (used strictly for deduplication), order status, revenue, shipping paid, and refunds.
• Product Information: Product and variant IDs, SKU names.
• Financial Data: Shopify fees (calculated based on your settings).
• Sync Frequency: Historical data (past 90 days) upon installation, followed by incremental syncs every 6 hours.

B. Merchant Inputs

• Cost of Goods Sold (COGS): Values you enter per variant on the Luca COGS/Costs page.
• Shopify Fee Rate: The percentage rate you input in Settings (defaults to 2%).

C. Growth Plan Data (Meta & Google Ads)

If you are on the Growth plan, we collect:

• Ad Spend Integration: Aggregate spending data from your connected Meta and Google Ads accounts to calculate true net profit.

3. How We Process Your Data

We use the data collected to provide profit analysis:

• Profit Calculation: Revenue - COGS - Shipping Paid - Shopify Fees - Refunds.
• Growth LLM Processing: Growth plan subscribers receive a weekly plain-English insight card (60-120 words). These insights are generated using Abacus AI RouteLLM. Data sent for processing is limited to financial aggregates and SKU performance data; it is used solely to generate your specific insight card.

4. How We Store and Protect Your Data

Luca uses two complementary layers of protection for merchant credentials:

• Background Worker Tokens: The offline access token used by our background sync workers is stored with AES-256-GCM application-level encryption in our database. Only the Luca application (with the correct encryption key) can decrypt it.
• Session Credentials: Active session data (managed by Shopify's standard session adapter) is stored in our managed database. This data is protected by AES-256-bit disk encryption provided by DigitalOcean's managed PostgreSQL service.
• Hosting: All data is hosted on the DigitalOcean App Platform in New York (NYC1 region).
• Data Security: We store financial aggregates and necessary IDs (Order/Shopify IDs) for deduplication. No customer PII is stored.

5. Data Sharing & Sub-processors

We do not sell your data or use it for advertising purposes. We share data only with the following service providers necessary to run the app:

• Shopify: To sync store data and manage your subscription.
• DigitalOcean: For secure cloud hosting.
• Abacus AI: For generating LLM-powered insights (Growth plan only).

6. Retention & Deletion

Luca commits to hard deletion of merchant and personal data records in line with Shopify compliance webhooks and timelines.

• app/uninstalled: We immediately hard-delete all shop data (orders, line items, product costs, sync jobs, insights, ad spend, and the shop record) and all associated session credentials.
• shop/redact: Shopify sends this webhook 48 hours after uninstall. After receiving a valid webhook, Luca confirms deletion (or completes any in-progress deletion) within 30 days of receipt.
• customers/redact: After receiving a valid webhook, Luca hard deletes customer-linked order records and any records containing personal data within 30 days of receipt. (Shopify may deliver this webhook 10 days after request, or after six months if the customer ordered in the prior six months.)
• customers/data_request: We provide the requested customer data package within 30 days of receipt.
• Backups & logs: Database backups are purged within 30 days. Application logs are configured to avoid customer personal data and are retained for a short operational window (up to 30 days) before deletion.

7. Compliance (GDPR & CCPA)

We support your compliance with global data protection laws:

• GDPR (Europe): Luca acts as a Data Processor for your store's financial data and executes Shopify privacy-law webhooks per documented timelines.
• Data subject rights: Merchants can contact us for access, correction, export, and deletion support. For Shopify customer data requests, we act on Shopify customers/data_request and customers/redact webhooks within required timelines.
• CCPA (California): Luca does not "sell" personal information as defined by the CCPA.

8. Changes to This Policy

We may update this policy occasionally. We will notify you of any significant changes via the Shopify admin area or the email address associated with your store.

9. Contact Us

If you have questions about this Privacy Policy, please contact us at [email protected].

Related legal document: Terms of Service