Privacy Policy

Last updated: 20 September 2026

About Autonoma

Autonoma ("we", "us", "our") is a Shopify application operated by ON Technologies Pty Ltd (Australia). Autonoma automates store growth for Shopify merchants: product and page creation, image and video ad creative, ad publishing, split testing, upsell building and an AI assistant. This policy explains what data we collect, why we collect it, how it is stored, and your rights.

Data we collect

• Store data from Shopify — your shop domain, products, pages, collections, theme content, orders summary metrics and store settings, accessed through the permissions you grant during installation.
• Account credentials — the Shopify OAuth access token for your store, and (if you connect it) a Meta access token for your ad account, Facebook Page, Pixel and Instagram account.
• Content you create in the app — prompts, chat messages, uploaded images and videos, generated products, pages, ads, advertorials, split tests and their results.
• Usage and billing data — your plan, feature usage counters, and job history, used to operate quotas and Shopify billing.
• Mobile app data — if you pair the Autonoma Mobile app: a device identifier, device label and push notification token.
• Marketing site cookies — this website sets minimal cookies: essential cookies, and affiliate-attribution cookies when you arrive through an affiliate link (see "Cookies" below).
• Affiliate program data — if you apply to the Autonoma affiliate program: your name, e-mail address, how you plan to promote Autonoma, your referral link activity and the commissions you earn. Payout details are collected by First Promoter, our affiliate platform, directly.

Why we collect it

We use your data exclusively to provide the service: to build products and pages in your store, to generate and publish ad creative, to run split tests, to send you notifications about job status, and to bill your subscription through Shopify. We do not sell your data, and we do not use your customers' personal data to train AI models.

Cross-store insights (anonymised, aggregated — on by default, optional)

Autonoma can include anonymised, aggregated usage insights from your store in cross-store insights that improve recommendations for all merchants in your product niche: for example, "merchants in this niche saw higher click-through rates with question-style hooks." For new stores this sharing is on by default: the "Share anonymised insights" box is pre-checked when you choose a plan, and you can uncheck it there or turn it off at any time in Settings (web or mobile app). Stores that installed before this default keep whatever they chose; a store that never opted in is not included. What is shared is limited to de-identified pattern data — creative element tags (such as hook style or image style), product category, and aggregate outcome metrics — and is not personal data and not store data: we never share your store identity, store name, domain, product names, customer data, or individual sales figures, and no other merchant can see your store's data. Store identifiers are hashed before aggregation, and insights are only computed from a niche when several stores contribute, so no single store's performance is identifiable. Turning sharing off excludes your store from all future aggregation.

Third-party processors

To deliver AI-generated content, parts of your store data (product titles, descriptions, images, and content you submit) are processed by the following providers:

• Shopify — store platform and billing.
• Meta — ad publishing, if you connect a Meta account.
• Anthropic (Claude) — text generation and the AI assistant.
• fal.ai — image and video generation infrastructure.
• Google (Veo) — video ad generation.
• Nano Banana — image generation.
• Higgsfield — image generation.
• ElevenLabs — voiceover generation.
• OpenAI (Whisper) — caption transcription for video ads.
• Expo — mobile push notification delivery.
• First Promoter — affiliate program tracking, commission calculation and payout processing.
  • Data shared: merchant e-mail address, shop identifier, subscription amounts (in cents), invoice event IDs and plan name for referred stores; the IP address recorded at install (fraud prevention); and, for affiliates, the name, e-mail and payout details you give First Promoter.
  • Location: operated by Igil Webs SRL (Romania, European Union); hosted on Linode/Akamai and Cloudflare, with some of their sub-processors in the United States.
  • Retention: commission tracking for the 6-month commission window of each referred store, then per First Promoter's own retention policy.
  • Policy: firstpromoter.com/privacy

Each provider receives only the data required for its task. None of them receive your Shopify or Meta credentials.

How your data is stored

Data is stored on managed cloud infrastructure (Railway — application servers and PostgreSQL database; Redis for short-lived operational state; Cloudflare for content delivery). Access tokens and other sensitive credentials are encrypted at rest. Access to production systems is restricted to authorized personnel.

Data retention

We retain your data while your store has Autonoma installed. When you uninstall, Shopify's data-removal webhook triggers cleanup of your data, completed within 30 days. Billing records are retained for 7 years as required by Australian tax law. See our data deletion page for details.

Your rights

You may request a copy of the data we hold about your store, correction of inaccurate data, or deletion of your data at any time. Uninstalling the app triggers deletion automatically; you can also email us directly. If you are in a jurisdiction with specific privacy rights (e.g. GDPR, Australian Privacy Principles), we will honor requests consistent with that law.

Cookies on this website

Autonoma sets minimal tracking cookies. When you arrive at tryautonoma.app via an affiliate link, First Promoter cookies (_fprom_tid, _fprom_ref) are set to track affiliate attribution. Our backend also sets autonoma_fp_tid (signed, HttpOnly) to bridge attribution through the install flow. All three cookies expire in 30 days. If Google Analytics is enabled, IP anonymization is applied and no cross-site advertising identifiers are used. The embedded Shopify app uses session cookies strictly for authentication.

Governing law

This policy is governed by the laws of Australia.

Changes to this policy

We may update this policy as the product evolves. Material changes will be announced inside the app. The "Last updated" date above always reflects the current version.

Contact

For privacy questions or requests: [email protected]