Scelto privacy policy

Scelto is a Shopify app and a WordPress plugin for WooCommerce stores that gives AI shopping agents a plain version of a merchant's store and a store agent to ask, and shows the merchant which agents visit. This policy explains what the app collects on a merchant's storefront and in their admin, and what our website collects.

What the app collects from store visitors

• With analytics consent (Shopify's cookie banner): the page address and type, the product handle, a random visitor id kept in the browser's local storage, and browser signals used to tell automated browsers from people (for example whether the browser reports automation, its time zone, graphics renderer name, language count and screen flags). The user agent is classified and then discarded. The referring site's name (not its full address) and the utm_source tag are checked against a list of AI assistants (ChatGPT, Perplexity, Gemini...): only a match is kept, as the assistant's name; anything else is discarded at once.
• Funnel events from Shopify's web pixel, after consent: product viewed, added to cart, checkout started and completed, with the product handle. No order contents, prices paid or customer details are stored.
• Agent hand-off, only if the merchant turns it on: when the app recognises an AI agent, the visitor's browser tab remembers that choice in session storage, and a short-lived signed token links the visit to the agent view.
• Agent view and store agent: requests to these are logged with the page or skill used. The message text sent to the store agent is not stored.

The app uses IP addresses only in memory, to look up the network and country (with the free DB-IP Lite database) and to group one automated visitor's requests for a day as a keyed hash. IP addresses, cookies, names, email addresses, phone numbers, addresses and payment details are never stored.

What the app collects from merchants

The Shopify session the app needs to work (shop domain, access token, the staff member's name and email as Shopify provides them), the merchant's settings and plan. Product and policy data is read from Shopify and kept in the app's database to answer agents; it is deleted when the merchant uninstalls the app.

To show the merchant which orders came from AI, the app reads recent orders' totals, the app or sales channel that created them, and the referring site and utm_source of the visits Shopify attributes to them. No customer details, addresses or order contents are read, and nothing from orders is stored: the totals are computed when the merchant opens the dashboard and kept in memory for a few minutes.

WooCommerce stores

On WooCommerce, the Scelto WordPress plugin measures visits instead of Shopify's web pixel. By default it measures only visitors who allow statistics in a consent banner that supports the WP Consent API; the merchant can choose to measure without consent where their visitors' law allows it. For each page view the visitor's browser sends the plugin, on the store's own domain, the page type, the product's slug, a random visitor id kept in the browser and the same browser signals described above, and the plugin forwards them to Scelto signed, with the visitor's user agent and IP address so the visit can be classified. Both are handled as described above: the IP address is used in memory only and never stored. Cart and checkout steps are sent with the product's slug only.

To connect, the merchant approves a WooCommerce REST API key in their own store. Scelto keeps that key and the plugin's signing secret encrypted, and reads the store's products, categories, pages, shipping zones and recent orders' totals and attribution (no customer details). Deleting the plugin asks Scelto to delete the store's data at once; the merchant can also revoke the key in WooCommerce, Settings, Advanced, REST API. Staff sign in to the dashboard from the plugin; the sign-in carries their WordPress user number only, never their name or email.

The free store check

Anyone can check a store's public pages at /check. The check reads a handful of the store's public pages, identifying itself as SceltoCheck and following the store's robots.txt, and saves the report (the store's address and what was found on its public pages) so it can be shared by link. The check is also counted as a visit to our website, as described below; the IP address is used in memory only, to limit how many checks one person can run.

Visitors to our website

To see how people find Scelto, our website records each page view: the page, the referring site, campaign tags in the link (utm tags, or a personal link we sent), the country, and, when a visitor's internet address belongs to a company network, that company's domain (from its public reverse DNS name; never for home or mobile connections). Views from the same address and browser on the same day are grouped by a keyed hash that changes every day, so visits can't be followed across days. The website sets no cookies, and IP addresses are not stored. For automated visitors such as AI assistants and crawlers, the user agent is kept. These records are kept for 400 days.

How merchants use the app

To improve the app, it records when a store installs, connects or uninstalls it, changes plan, first opens each app page on a day, and presses an action button (for example applying a suggested change). This is deleted with the store's data.

Research reports

When you ask for one of our research reports, we keep your email address, which report you asked for, whether you asked for future reports, how many times you downloaded it, and the same page-view details described above (campaign tags, country, company network). We use your address to give you the report and, only if you ticked the box, to send future reports. We don't sell it or share it for advertising. To unsubscribe or have your address deleted, email hello@getscelto.com.

How long data is kept

Visit events are deleted after 90 days. When a merchant uninstalls the app, Shopify asks the app to delete the store's data 48 hours later; the app then deletes its events, settings and sessions.

Who processes the data

The app runs on Fly.io and stores data in a Supabase Postgres database. Data is not sold or shared for advertising.

Visitors' rights

The app stores no data that identifies a store visitor, and nothing that identifies a visitor to our website unless they ask for a research report. Visitors with questions should contact the store they visited; merchants can contact us at hello@getscelto.com. For merchants, Vesuvio Labs LLC processes this data as described in the data processing agreement, part of the terms of service.