Effective date: April 25, 2026
Last updated: April 25, 2026
LazyInsight is available to Shopify merchants globally. Our primary support focus and product localisation are for merchants operating in Hong Kong, Taiwan, and other Asia-Pacific regions; support for merchants in other regions is provided on a best-effort basis.
LazyInsight is not intentionally marketed to, or designed for, merchants whose Shopify stores primarily serve customers in the European Economic Area, United Kingdom, or Switzerland. We have not appointed a representative under Article 27 of the EU GDPR or the UK GDPR. Merchants whose customer base is primarily located in those regions should evaluate whether our Service meets their specific regulatory needs before installation.
Where personal data originating in the European Economic Area, United Kingdom, or Switzerland is nevertheless transferred to LazyInsight (for example, an EEA resident purchasing from an APAC-based merchant’s store), such transfers are safeguarded by the Standard Contractual Clauses, the UK International Data Transfer Addendum, and Swiss adaptations as incorporated into our Data Processing Agreement (see DPA §12).
LazyInsight (“LazyInsight”, “we”, “us”, or “our”) operates a Shopify-embedded application that helps merchants recover abandoned carts and send email marketing campaigns.
For the purposes of the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486) (“PDPO”), we are a “data user” and comply with the six Data Protection Principles in Schedule 1 to the PDPO.
Contact: privacy@lazyinsight.com
LazyInsight processes personal information in two capacities:
As a data controller — when we process information about our own merchant accounts (registration, billing, support, product usage, visitors to lazyinsight.com).
As a data processor — when we process information about the merchant’s end customers (shoppers, subscribers, email recipients) on the merchant’s behalf. In this role, the merchant is the data controller and determines purposes and means of processing; we act only on the merchant’s documented instructions.
Shopify Inc. is a separate processor engaged by the merchant directly; LazyInsight is not a sub-processor of Shopify.
We receive end-customer data indirectly from the merchant’s Shopify store via the Shopify Admin API, Storefront API, and webhooks. We do not collect from the customer directly.
LazyInsight does not collect:
| Purpose | Legal basis (EEA/UK) |
|---|---|
| Operate and provide the Service to merchants | Contract (GDPR Art. 6(1)(b)) |
| Generate and deliver abandoned cart recovery emails on behalf of merchants | Contract + processor role |
| Personalize email content with cart details and discount codes | Processor, on merchant’s documented instructions |
| Billing, invoicing, and payment processing | Contract + legal obligation |
| Product security, fraud prevention, abuse detection | Legitimate interests (GDPR Art. 6(1)(f)) |
| Product analytics and improvement | Legitimate interests |
| Customer support and communications with merchants | Contract + legitimate interests |
| Marketing LazyInsight to existing merchants | Legitimate interests (opt-out available) |
| Comply with legal obligations, respond to valid legal requests | Legal obligation (Art. 6(1)(c)) |
For Hong Kong merchants, we process personal data in accordance with PDPO Data Protection Principle 3 (use for the purpose of collection or a directly related purpose).
LazyInsight uses generative AI to help merchants draft and personalize marketing emails (subject lines, body copy, product recommendations). AI-assisted features are clearly labeled in the app.
AI service provider. Our AI features are powered by Google’s Gemini API (provided by Google LLC). See Annex 3 of our Data Processing Agreement for processing location and transfer safeguards. If we engage additional AI providers in the future, we will update this notice and our DPA subprocessor list with 30 days’ advance notice in accordance with DPA §8.3.
What data is sent. To generate or personalize an email, we may transmit to our AI service provider(s):
We do not send payment information, passwords, Shopify access tokens, or special categories of data to any AI service provider.
No training on your data. We contractually require our AI service provider(s) not to use data submitted through LazyInsight to train, fine-tune, or otherwise improve their AI or machine-learning models. Consistent with the Shopify Partner Program Agreement, we do not use Merchant Data or Customer Data to develop or train any AI or machine-learning system.
Retention by AI service provider. Our AI service provider(s) may retain API inputs and outputs for a limited period (typically up to 30 days) for abuse and security monitoring, after which the data is deleted, subject to longer retention only where legally required.
Human oversight. All AI-generated content is presented as a draft for merchant review; no email is sent to an end customer without merchant approval. LazyInsight does not use AI to make solely automated decisions that produce legal or similarly significant effects on any individual.
Merchant controls. Merchants can disable AI features in Settings → AI.
We do not sell or share personal information as those terms are defined under the California Consumer Privacy Act (CCPA) as amended by CPRA, and we do not engage in cross-context behavioral advertising.
We share personal information only with the following categories of recipients:
A detailed list of our sub-processors, together with their processing location and data transfer safeguards, is set out in Annex 3 of our Data Processing Agreement.
| Data category | Retention period |
|---|---|
| Active merchant account & shop configuration | Duration of subscription + 30 days |
| Shopify customer records, orders, abandoned checkouts | Duration of subscription; deleted within 30 days of shop/redact or customers/redact webhook |
| Email delivery logs, opens, clicks, bounces | 24 months, then deleted or anonymized |
| Suppression list entries (unsubscribed, bounced, complained) | Retained indefinitely to prevent re-sending (GDPR Art. 17(3)(b) exception) |
| AI prompts and outputs (our side) | 90 days |
| Billing and tax records | 7 years (Hong Kong tax law requirement) |
| Encrypted backups | Rolling 30 days |
| Security and access logs | 12 months |
| Aggregated, anonymized analytics | Indefinite |
We subscribe to and honor Shopify’s three mandatory privacy webhooks:
customers/data_request — We compile all personal data we hold about the identified customer and return it to the merchant within 30 days.customers/redact — We delete the identified customer’s personal data from production systems within 30 days. Residual copies in encrypted backups are overwritten within our rolling 30-day backup cycle.shop/redact — Sent by Shopify 48 hours after uninstall. We delete all personal data relating to the shop within 30 days.End customers should direct data-rights requests to the Shopify merchant whose store they interacted with; the merchant acts as the data controller and will trigger the applicable webhook.
LazyInsight is established in Hong Kong. Personal information may be processed in countries other than the one in which it was collected, including the United States (where most of our sub-processors operate).
For transfers from Hong Kong: We follow the Hong Kong Privacy Commissioner’s 2014 Guidance on Cross-border Data Transfer. Although section 33 of the PDPO (restricting cross-border transfers) is not yet in force as of April 2026, we voluntarily apply contractual safeguards consistent with the PCPD’s Recommended Model Contractual Clauses (May 2022) when engaging overseas processors. Under section 65 of the PDPO, we remain responsible for the acts of our overseas data processors.
For transfers of personal data originating in the EEA, UK, or Switzerland: We rely on the European Commission’s Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum, as incorporated by reference into our Data Processing Agreement (see DPA §12). Where a US-based sub-processor is self-certified under the EU-US Data Privacy Framework, we additionally rely on that framework as a supplementary safeguard.
No online service can be guaranteed 100% secure, but we implement administrative, technical, and organizational measures to protect personal data:
LazyInsight does not currently hold an independent SOC 2 Type II or ISO 27001 certification. We will update this notice if that changes.
Depending on your jurisdiction, you may have rights to:
Where to send requests:
The Service is intended for users aged 18 and over only. We do not knowingly collect or process personal data relating to individuals under 18, and the Service is not directed to anyone under 18. Merchants warrant that they will not use LazyInsight to collect, import, or process personal data relating to any individual under 18.
If you become aware that personal data of an individual under 18 has been provided through the Service, contact privacy@lazyinsight.com and we will take steps to delete it.
The LazyInsight merchant dashboard operates within the Shopify admin and uses only strictly necessary cookies for authentication and session management. We do not use third-party advertising cookies, analytics cookies with cross-site tracking, or fingerprinting.
Recovery emails sent through LazyInsight may contain tracking pixels and UTM-tagged links used to measure delivery, opens, clicks, and conversions. Merchants are responsible for disclosing email tracking to their end customers in the merchant’s own privacy policy and for obtaining any consent required under applicable law (such as EU ePrivacy / PECR where applicable).
Note on Apple Mail Privacy Protection: Email opens reported from Apple Mail users may be inflated, because Apple preloads email content on proxy servers. This data should not be treated as a reliable indicator of a human open.
Every marketing email sent through LazyInsight includes:
List-Unsubscribe headers for one-click unsubscribe in Gmail, Yahoo, and Apple MailUnsubscribe requests are processed within 2 business days and in all cases within 10 business days.
When a recipient unsubscribes, hard-bounces, is marked invalid, or reports a message as spam, we add the address to the merchant’s suppression list. Suppressed entries are retained indefinitely for the sole purpose of ensuring we do not send further commercial email to that address.
Merchant responsibility: Merchants warrant they have a valid lawful basis for each marketing email (consent, soft opt-in under PECR Reg. 22, or legitimate interest as applicable) and maintain consent records where required (e.g. 3 years under Canadian CASL).
If we become aware of a confirmed or reasonably suspected breach of security leading to unauthorized access to, or disclosure, loss, or alteration of, personal data processed through LazyInsight, we will:
Direct notification of affected end customers is generally the merchant’s responsibility as controller; we will assist where appropriate.
We may update this policy from time to time. Material changes will be notified through the LazyInsight dashboard or by email to the merchant’s contact address at least 14 days before they take effect. The “Last updated” date at the top reflects the latest version.
Email: privacy@lazyinsight.com