Privacy standards for Lit websites, apps, and client services

1. Scope

This policy applies to personal information processed through the litapp.ai website, contact forms, support and sales communications, Lit-operated applications, merchant-facing tools, client portals, and related implementation or advisory services.

It does not override any separate data processing agreement, app-specific privacy notice, or client contract that applies to a particular Lit service. Where those documents conflict with this policy, the more specific document will govern for that service.

2. Roles: when Lit is a controller and when Lit acts on a merchant's behalf

Lit may act in different privacy roles depending on the context.

• Lit acts as a controller for information about website visitors, leads, merchants, billing contacts, support contacts, applicants, and other business contacts where Lit decides why and how that information is used.
• Lit may act as a processor, service provider, or similar role when handling merchant store data, order-related data, customer-related data, or other platform data on behalf of a merchant or client under their instructions.
• Where Lit processes customer or store data on behalf of a merchant, the merchant remains responsible for its own customer-facing notices, legal basis, and instructions, unless the applicable agreement says otherwise.

3. Information we collect directly

• Contact and identity details such as name, email address, phone number, company name, job title, and the contents of inquiries or messages you send us.
• Commercial and account information such as project details, subscription or billing contacts, invoices, transaction records, service preferences, and support history.
• Website and device information such as IP address, browser type, operating system, language, referral URLs, page interactions, timestamps, and similar diagnostic or analytics data.
• Files, form submissions, call notes, and communications you choose to provide through our website, email, forms, meetings, or support channels.

4. Information we may process through Shopify and other platforms

When Lit builds, implements, supports, or operates Shopify apps, store workflows, or similar commerce services, we may process platform data made available by the merchant or the relevant platform permissions.

• Merchant account and store information, such as store identifiers, shop domain, configuration settings, installed features, app events, and support metadata.
• Operational commerce data needed to provide the service, such as product, order, fulfillment, discount, or customer-related records that are required for the app or workflow to function.
• Usage, event, and log data generated through the use of Lit apps or services, including technical logs, troubleshooting data, audit records, and performance telemetry.
• Integration data from third-party services connected by the merchant, subject to the permissions granted to Lit and to the policies and terms of the connected service.

5. Information from merchants' customers

Some Lit services may process information relating to a merchant's customers, end users, or site visitors where that information is needed to deliver the relevant service to the merchant.

• Examples can include customer identifiers, order history, contact details, shipping or billing-related fields, event activity, or support-relevant records made available through Shopify or another connected platform.
• Lit does not treat this type of data as its own marketing list merely because it passes through a Lit service. Where Lit handles such data on behalf of a merchant, it does so under the merchant's instructions and applicable agreements.
• If a Lit service places cookies, pixels, widgets, scripts, or other tracking technologies on a merchant storefront or customer touchpoint, the merchant remains responsible for ensuring that the required notices and consents are provided unless the service-specific documentation states otherwise.

6. How we use information

• To provide, configure, maintain, support, secure, and improve Lit websites, apps, and services.
• To communicate with prospects, merchants, clients, partners, and applicants, including responding to inquiries and providing support.
• To authenticate access, prevent abuse, investigate incidents, monitor uptime, debug issues, and protect our systems, users, and business.
• To manage contracts, billing, recordkeeping, compliance, corporate governance, and legal obligations.
• To analyze service performance, usage patterns, and product quality, including through aggregated or de-identified analytics where appropriate.
• To send service-related communications and, where permitted by law, marketing communications that you can opt out of.

7. Cookies and tracking technologies

Lit may use cookies, similar storage technologies, analytics tools, and related scripts on its own website and in certain Lit-operated services.

These technologies may be used for essential site functionality, session management, security, fraud prevention, traffic measurement, product analytics, and service improvement.

If a specific Lit app, storefront component, or marketing-related feature uses additional tracking technologies or third-party measurement tools, those practices may be described in a service-specific notice, app listing, or implementation documentation.

8. When we share information

We do not sell personal information as part of our ordinary business operations. We may disclose information only where there is a legitimate business, contractual, or legal reason to do so.

• With hosting, infrastructure, analytics, communications, security, payment, support, and other vendors that help us operate the business and are subject to appropriate contractual or legal restrictions.
• With platform providers or integration partners where disclosure is required to enable a requested service or a connected workflow.
• With advisors, insurers, auditors, corporate affiliates, or transaction counterparties in connection with financing, restructuring, diligence, or a business transfer.
• With regulators, law enforcement, courts, or other authorities where required by law or where reasonably necessary to protect rights, safety, security, or the integrity of our services.

9. Retention

We retain personal information for as long as reasonably necessary for the purposes described in this policy, including service delivery, troubleshooting, contractual performance, recordkeeping, legal compliance, and dispute resolution.

Retention periods vary based on the type of information, the service involved, contractual obligations, and applicable law. Where we process data on behalf of a merchant, we retain and delete that data according to the relevant agreement, merchant instructions, and legal requirements.

10. International processing

Lit operates from Israel and may use service providers or infrastructure located in other jurisdictions. As a result, information may be processed outside the country in which it was collected.

Where required, we use reasonable contractual, organizational, and technical measures intended to protect personal information transferred across borders.

11. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, disclosure, misuse, loss, or alteration.

No environment can be guaranteed to be completely secure. You should also use appropriate access controls, credential management, and security practices in connection with any Lit service you use.

12. Rights and privacy requests

Depending on the applicable law and the context of processing, individuals may have rights to access, correct, delete, restrict, object to, or export certain personal information.

If Lit processes information as a controller, requests can be submitted to us directly. If Lit processes information on behalf of a merchant or client, the relevant request may need to be directed to that merchant or client first.

Shopify apps distributed through the Shopify App Store may also be subject to Shopify's compliance and redaction workflows, including requests relating to customer data and shop data.

13. Children

Lit services are not directed to children, and we do not knowingly collect personal information from children in violation of applicable law.

14. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our services, processing practices, or legal obligations.

When changes are material, we may update the published policy and provide additional notice where appropriate.

15. Contact and company details

For privacy questions, requests, or complaints, contact LIT at contact@litapp.ai.

Business location: Tel Aviv, Israel.

If a Lit app listing, customer agreement, or data processing addendum identifies a more specific legal entity or privacy contact for a particular service, that service-specific contact should be used for that matter.