Privacy

intirn is operated by intirn LLC, a Delaware limited liability company, which is the controller of the personal data described here. Contact: info@intirn.com, or the contact form.

For shopper data inside a Shopify store (see below), the merchant is the controller and intirn processes that data on the merchant’s behalf.

Account data. Your email address; your name and profile image if you sign in with Google; any handle, display name, avatar and time zone you set; your plan and billing status. We never receive or store a password.

Creator content. The images and videos you upload, the products you tag in them and their links, prices and images, and the settings of your page and embeds.

Viewer interaction events. When someone views an intirn image or video, on intirn.com, in an embed or on a Shopify store: which item and product, what happened (view, play, hover, click, add to bag, store visit), when in the video, where on the picture a click landed, pointer positions over the picture (up to sixty points per visit, never keystrokes, form input or page text), the page it was on, a coarse device type, screen size, browser language and a country derived from the request. A viewer is identified only by random identifiers: a session id for one player load, and a visitor id kept in the browser for a year. Each player load is also logged (its session id, a watermark fingerprint and the page host) so leaked copies of our tracking data can be traced. We do not store IP addresses and we do not know viewers’ names. Rate limiting uses a one-way hash of the IP address, kept for at most a day. If the browser sends Global Privacy Control or Do Not Track, pointer positions are not recorded. On a Shopify store, intirn follows the store’s Shopify privacy settings: if the shopper declines analytics in the store’s consent banner, nothing is recorded.

Shopify data (intirn for Shopify). The store’s myshopify domain, name, contact email, primary domain, currency and app plan; the intirn account connected to it; and the access tokens Shopify issues to the app, stored encrypted and deleted when the app is uninstalled. We read the store’s product catalog (titles, handles, prices, images) and its themes, to place intirn on the images the merchant picks. When the merchant makes one of the store’s images or videos shoppable, intirn keeps its own copy of it in the store’s intirn account; photos the merchant places on the store are copied into the store’s Files. From the store’s order webhooks we keep only the order id and order name, line product and variant ids, quantities, prices, currency, refunds on those lines, whether it was a test order, and the intirn attribution tags intirn itself added to the cart. We do not store shoppers’ names, emails, phone numbers or addresses.

All first-party, no advertising and no third-party trackers: a sign-in cookie if you have an account; glw_last, set when a viewer clicks through to a product (30 days); and glw_vid, the random visitor id (one year). On a Shopify store, intirn adds a hidden _intirn tag to the store’s own cart when a shopper adds or opens a product from intirn, so the order can be credited. Clearing site data removes them.

• To provide the service you signed up for: your account, content, pages, embeds, billing and support (performance of a contract).
• To show creators and merchants how their images and videos performed and which orders they led to, and to keep the service secure and free of abuse (our and their legitimate interests in measuring and protecting the service).
• To meet legal, tax and accounting obligations (legal obligation).

We do not sell or rent personal data, do not share it for cross-context behavioural advertising, do not build advertising profiles, and do not use it to train machine-learning models.

Only these providers, each limited to what its job needs and bound to our instructions:

• Vercel: hosting and content delivery.
• Neon: database.
• Cloudflare R2: media storage.
• Modal: image and video processing (object tracking).
• Resend: email delivery (sign-in links, and messages you send us).
• Stripe: payments for plans bought on intirn.com. Card details go to Stripe directly.
• Google: sign-in, if you choose it; and Google Fonts, which may serve the font of a product card to the viewer’s browser.
• SerpApi: product search. When a creator looks up matching products for an item, it receives a cut-out image of that item and nothing about the creator or viewers.
• Shopify: for intirn for Shopify merchants, Shopify runs the store and bills the app charges.

intirn and these providers operate mainly in the United States. Where data from the EEA, UK or Switzerland is transferred there, we rely on the providers’ Standard Contractual Clauses or an adequacy framework they participate in.

• Account details, content and media: until you delete them or your account.
• Viewing and click events, and the player-load log: 25 months.
• Shopify data: while the app is installed. On uninstall the access token is deleted at once; 48 hours later, on Shopify’s request, the store’s connection and purchase records are deleted, the images and videos in the store’s own intirn account (including the copies made from the store) are deleted permanently, and its viewing events are anonymised. An intirn.com account the merchant linked to the store keeps its own content.
• Records from a withdrawn 2026 store integration: 7 years, as financial records. They contain no customer names, addresses or contact details.
• Error logs: 12 months.

You can delete your content and your account at any time from the account page. Depending on where you live (including the EEA, the UK and California), you may have the right to access, correct, delete or port your data, to object to or restrict its use, and not to be discriminated against for exercising these rights. Write to info@intirn.com and we will respond within 30 days. Shoppers on a Shopify store can also ask the store, which passes the request to us through Shopify. You may complain to your data protection authority.

California: we do not sell or share personal information, so there is nothing to opt out of.

intirn is not directed to children under 16, accounts require age 18, and we do not knowingly collect children’s data. If you believe we have, write to us and we will delete it.

If we change how personal data is handled, we update this page and its date, and account holders are emailed before a material change takes effect.