Atomato Privacy Policy

Last updated: October 7, 2026

This Privacy Policy explains how Binaery LLC d/b/a Atomato (“Atomato,” “we,” “us,” or “our”) collects, uses, shares, and protects information in connection with our websites, dashboards, Shopify app, web pixels, APIs, integrations, and related services, collectively the “Services.”

Our Services are designed for businesses and are not intended for personal or household use. By using the Services, you agree to this Privacy Policy.

If you do not agree, do not use the Services and do not provide us with your information.

1. Scope

This Privacy Policy applies to information we process about visitors to our websites, account owners and users, agency partners, merchants, and merchant customers whose data may be processed through the Services on behalf of a merchant.

When we process personal information about a merchant’s customers, we act as a service provider or processor to that merchant. The merchant’s own privacy policy governs how the merchant uses customer data and what disclosures or consents are required for the merchant’s storefront.

2. Personal Information We Collect

The term “personal information” means information that identifies, relates to, describes, or could reasonably be linked to an identified or identifiable person.

We may collect the following categories of information:

Account and Contact Information

This may include name, email address, phone number, company name, role, login credentials, account settings, and related business contact details.

Billing and Transactional Information

This may include plan selections, subscription status and history, and trial information. Paid plans are billed through Shopify’s billing system, and charges appear on the merchant’s Shopify bill. Atomato does not receive or store payment card details.

Usage, Device, and Diagnostic Information

This may include IP address, approximate location based on IP, user agent, device type, operating system, browser type and version, language and locale, pages viewed, referring and exit pages, timestamps, feature usage, error logs, session diagnostics, and cookie or storage identifiers.

Support and Communications

This may include messages, support requests, survey responses, feedback, call notes, and recordings or transcripts if you agree to them during support calls or chats.

Shopify and Merchant Store Data

When you install or connect the Atomato Shopify app, we may process data from Shopify and your store as needed to provide the Services. This can include store configuration, theme assets, products, variants, collections, discounts, offers, orders, checkout events, customer events, and operational webhooks.

Revenue Attribution Analytics

For Atomato features such as NotiFeed, NotiPop, NotiSell, and related campaign tools, we may collect event-level analytics to measure campaign performance and revenue attribution. This may include:

• Add-to-cart events, such as product_added_to_cart
• Checkout initiation and checkout completion events, such as checkout_started and checkout_completed
• Campaign attribution fields, such as campaign type, campaign ID, click timestamp, session identifier, and attribution metadata
• Checkout and order linkage fields, such as checkout token, checkout reference, order identifier, or order correlation fields
• Commerce fields, such as product ID, variant ID, quantity, currency, order value, and attributed revenue
• Customer identifiers only when available from Shopify, such as for logged-in customers or customer-linked checkout activity
• We use this data to provide analytics and attribution reporting to the merchant. We do not sell merchant customer personal information or use merchant customer personal information for our own advertising.

Cookies and Similar Technologies

We use cookies, local storage, session storage, pixels, SDKs, and similar technologies as described in Section 8 below.

Aggregated, De-Identified, or Anonymized Data

We may create aggregated, de-identified, or anonymized data that no longer identifies an individual. We may use and share such data for any lawful purpose, including analytics, benchmarking, reporting, product improvement, and business operations.

3. Sources of Information

We collect information from:

• You, when you create an account, configure settings, contact us, or use the Services
• Merchants, when they install, configure, or use Atomato on their store
• Automatic collection through cookies, web pixels, SDKs, browser storage, and server logs
• Shopify Admin APIs, webhooks, customer events, and other Shopify platform functionality when authorized
• Third-party integrations that you connect to Atomato
• Service providers and partners who help us operate, secure, support, and improve the Services

4. How We Use Information

We use personal information to:

• Provide, operate, maintain, and secure the Services
• Authenticate users and manage accounts and subscriptions
• Process transactions, invoices, renewals, and billing records
• Deliver on-site widgets, notification feeds, popups, upsells, offers, and analytics features you enable
• Attribute confirmed revenue to campaign-driven product additions
• Estimate pending, abandoned, and attributed revenue windows
• Provide campaign analytics, reporting, and dashboard insights
• Monitor performance, troubleshoot issues, debug errors, and improve reliability
• Improve campaign effectiveness, product quality, and user experience
• Personalize the merchant dashboard and recommend relevant features
• Communicate with you about the Services, including operational messages, support updates, security alerts, and product notices
• Send marketing communications where permitted by law
• Protect the Services, detect and prevent fraud, abuse, unauthorized activity, and security incidents
• Enforce our Terms of Use and other agreements
• Comply with legal obligations and respond to lawful requests

On the free Starter plan, we collect impressions, clicks, and click-based revenue attribution. If a merchant upgrades to a paid plan, the additional analytics that plan includes, such as hovers and dismissals, are collected from the upgrade date and are not backfilled unless expressly stated otherwise.

5. Shopify Data and Our Role

When you install or connect the Atomato Shopify app, you authorize us to access certain Shopify Admin API objects, webhooks, customer events, and related platform data as needed to provide the Services.

This may include access to Shopify data such as themes, assets, products, variants, collections, discounts, offers, orders, checkout events, and other store data necessary to operate Atomato features.

For personal information about merchant customers that we process through your store, Atomato acts as a service provider or processor to the merchant, under our Data Processing Agreement.

Atomato does not sell merchant customer personal information and does not use merchant customer personal information for Atomato’s own advertising.

Merchants are responsible for:

• Publishing accurate customer-facing privacy disclosures
• Obtaining legally required consents
• Configuring Atomato features in compliance with applicable laws
• Ensuring their use of tracking, analytics, campaigns, and storage technologies is lawful for their store and jurisdiction

6. Revenue Attribution and Analytics

Atomato may provide revenue attribution analytics for campaigns, notifications, popups, upsells, and other on-site experiences.

These analytics may connect campaign interaction events to later commerce events, including add-to-cart, checkout started, checkout completed, and order events.

Atomato may classify revenue or cart activity into states such as confirmed, pending, abandoned, or unattributed based on event-based attribution logic and defined time windows.

Revenue attribution analytics are provided on a best-effort basis. They may be affected by factors such as:

• Browser or device changes
• Tracking prevention or storage restrictions
• Consent settings
• Ad blockers or privacy tools
• Cross-device behavior
• Guest checkout behavior
• Checkout behavior outside attribution windows
• Shopify event availability
• Network interruptions or delayed event delivery

Atomato analytics are intended for informational and product performance purposes. They may not match accounting totals, Shopify reports, payment processor totals, tax records, or financial statements.

7. Legal Bases for Processing for EEA and UK Users

If you are located in the European Economic Area, United Kingdom, or another jurisdiction requiring a legal basis for processing, our legal bases may include:

• Performance of a contract, where processing is necessary to provide the Services
• Legitimate interests, including operating, securing, analyzing, and improving the Services
• Compliance with legal obligations
• Consent, where required by applicable law, including for certain cookies, browser storage, analytics, marketing communications, or tracking technologies

Where Atomato processes merchant customer data on behalf of a merchant, the merchant is responsible for determining the appropriate legal basis and obtaining any required consent from its customers.

8. Cookies, Browser Storage, Analytics, and Online Ads

We and our partners use cookies, web pixels, SDKs, local storage, session storage, and similar technologies to operate, secure, analyze, and improve the Services.

For more detail on the cookies and browser storage we use, see our Cookie Policy.

These technologies may include:

Strictly Necessary Technologies

Used to provide core functionality, security, authentication, fraud prevention, and service reliability.

Preferences Technologies

Used to remember settings such as language, region, dashboard preferences, or interface settings.

Analytics Technologies

Used to understand how the Services are used, measure campaign performance, provide reporting, and improve performance.

Attribution Storage

In web pixel or storefront contexts, Atomato may use browser storage technologies such as local storage or session storage for analytics attribution and event delivery reliability.

Stored values may include:

• Attribution session identifiers
• Campaign click timestamps
• Campaign type, campaign ID, and attribution metadata
• Temporary event queues for reliable event transmission
• Checkout or correlation token references
• Session or checkout linkage fields

Storage may be used to:

• Link campaign clicks to later commerce events
• Distinguish confirmed, pending, and abandoned revenue states
• Prevent event loss during network interruptions
• Improve campaign analytics and reporting accuracy

Advertising Cookies

On Atomato marketing websites, we may use advertising cookies to help show ads that may be relevant to you. These advertising cookies do not run inside the Shopify admin of our app.

Your Choices

You can control cookies and browser storage through your browser settings. Some features may not work properly if cookies or storage are disabled.

Where required by law, analytics storage and non-essential cookies are used only after valid user consent. If consent is denied or storage is restricted, some campaign attribution metrics may be unavailable, incomplete, or less accurate.

Our Services do not respond to Do Not Track signals.

9. How We Share Information

We may share personal information as follows:

Within Atomato

We may share information with our affiliates and internal team members for purposes consistent with this Privacy Policy.

Service Providers and Processors

We may share information with service providers that perform services for us, such as hosting, cloud infrastructure, databases, logging, analytics, email delivery, payments, customer support, security, and monitoring.

These providers are bound by confidentiality and security obligations and may only use information to provide services to us.

Examples may include infrastructure or database providers such as Supabase, as well as other hosting, analytics, support, and operational vendors. Our current list of subprocessors, the outside services that process data on our behalf, is on our Subprocessors page.

Integration Partners

When you connect a third-party service, we may share information with that integration partner consistent with your settings, the integration’s functionality, and the partner’s terms.

Shopify Platform APIs and Events

We use Shopify platform APIs, webhooks, customer events, and related platform functionality as part of app functionality.

Business Transfers

We may share information in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, subject to appropriate confidentiality obligations.

Legal and Safety

We may share information to comply with law, legal process, court order, or lawful government request; to enforce our agreements; or to protect the rights, property, or safety of Atomato, our users, merchants, customers, or the public.

With Your Direction or Consent

We may share information when you ask us to do so or otherwise provide consent.

We do not sell personal information. For site visitors, we may engage in interest-based advertising as described in this Privacy Policy. Where required by law, you may have the right to opt out of targeted advertising or the sharing of personal information for cross-context behavioral advertising.

10. Shopify Privacy Webhook Compliance

We subscribe to and handle Shopify privacy-related webhooks and compliance topics as required for Shopify apps, including topics such as:

• app/uninstalled
• shop/redact
• customers/data_request
• customers/redact

When a store uninstalls the Atomato app, we stop collecting new data from that store. At uninstall, we delete the store’s sign-in records, including the name and email address of each staff member who opened Atomato, clear the store’s plan, and reset its setup progress. The store’s campaigns, analytics, settings, and integration API keys remain in our database until we receive Shopify’s shop/redact webhook.

Shopify usually sends the shop/redact webhook 48 hours after a store uninstalls the app. When we receive it, we delete the following records about the store from our database, as required by Shopify and applicable law:

• Campaigns of every type and their scheduled jobs
• Analytics, including daily totals, campaign summaries, and revenue attribution records, which can include order and customer IDs
• Customer data received from SKIO
• Integrations and their saved API keys
• Styling presets, plan details, notification settings, and store settings
• Any remaining sign-in records

One limit applies. Campaign activity that we received before the webhook but had not yet added to analytics is added at the next run, which happens every 6 hours, and the totals created from it are not removed by this deletion.

Our deletion does not reach data outside our systems. Items Atomato created in the merchant’s Shopify store, such as customer segments, order tags, uploaded images, signup discount codes, and any remaining message content, stay in the store until the merchant deletes them. Contacts that Atomato sent to Klaviyo, Mailchimp, Omnisend, or Drip, and the API keys the merchant created for Atomato in those tools or in SKIO, stay there until the merchant removes them.

When we receive Shopify’s customers/data_request webhook, our system looks up the revenue attribution records and the customer data received from SKIO that we hold under that customer’s Shopify customer ID for that store, and emails our team a summary. Our team then compiles every record we hold under that customer ID for that store, including the customer’s ID and name in any campaign the merchant set to show only to specific customers, and sends the records to the merchant within 30 days of the request. We send them by email to an address we have on file for the store, the store owner’s where we have one, either as a password-protected file with the password sent in a separate email or as a download link that expires. If we hold no records under that customer ID, we tell the merchant. We do not send the records to the customer or to Shopify. Revenue attribution records made while the shopper was not signed in carry no customer ID and are not included.

When we receive Shopify’s customers/redact webhook, we delete the revenue attribution records and the customer data received from SKIO that we hold under that customer’s Shopify customer ID for that store. This does not reach revenue attribution records made while the shopper was not signed in, which carry no customer ID, or the customer’s ID and name saved in campaigns set to show only to specific customers. For what each request covers and what stays behind, see what happens when a customer asks Shopify for their data or to be erased.

We may retain billing records, tax documentation, fraud-prevention logs, security logs, legal records, and de-identified or aggregated analytics that cannot reasonably be linked to a store or individual, as permitted by law.

If a merchant reinstalls Atomato before we receive the shop/redact webhook, the merchant completes setup and chooses a plan again. Message content stored in the merchant’s Shopify store may have been removed at uninstall, so campaigns may not be fully restored. If the merchant reinstalls after that webhook, Atomato must be set up again.

11. Your Privacy Rights

Depending on where you live, you may have rights such as:

• Access to personal information
• Correction of inaccurate information
• Deletion of personal information
• Portability of personal information
• Restriction of processing
• Objection to processing
• Withdrawal of consent
• Opt out of sales, sharing, or targeted advertising where applicable

To exercise your rights, contact us at support@atomato.co and include your name, the nature of your request, and the email address used with the Services.

We will verify your request and respond within the time required by applicable law. You may designate an authorized agent where permitted by law.

Residents of California, Virginia, Colorado, Connecticut, Utah, Texas, and other states may have additional privacy rights under state privacy laws. Texas residents may exercise rights under the Texas Data Privacy and Security Act.

We do not discriminate against you for exercising your privacy rights.

For EEA and UK residents, you may contact your local data protection authority and have the right to lodge a complaint.

12. Security

We use reasonable technical and organizational measures to protect personal information, taking into account the nature of the data and the risks involved.

No method of transmission or storage is fully secure. We cannot guarantee absolute security.

You are responsible for keeping your account credentials confidential and for limiting access to your Atomato account to authorized users.

13. Retention

We retain personal information for as long as needed to provide the Services, comply with legal obligations, resolve disputes, enforce agreements, maintain security, prevent fraud, and support legitimate business operations.

For the Atomato Shopify app, we keep data on the following schedules:

• Campaign activity events, such as impressions, clicks, and signups, are combined into daily totals every 6 hours, and the individual events are then deleted.
• Daily engagement totals and daily add-to-cart totals by product are kept for 180 days, then deleted.
• Revenue attribution records (which can include checkout, order, and customer IDs), NotiEmail daily signup totals, and campaign summaries have no fixed deletion date. We keep them while the app is installed and delete them when we receive Shopify’s shop/redact webhook after uninstall. Campaign summaries and NotiEmail daily signup totals are also deleted when the merchant deletes the campaign. Revenue attribution records linked to a customer ID are also deleted when Shopify sends a customer redaction request for that customer.
• In the shopper’s browser, the attribution note saved after a campaign click, and the email address or phone number and discount code saved when a signup shows a discount, expire after 30 days and are removed the next time Atomato’s code reads them. The attribution note is also removed after an order. Lists of messages a shopper has already seen stay in the browser until the shopper clears site data.

A completed checkout is linked only to campaign add-to-cart records from the previous 30 days.

Add-to-cart attribution windows may be limited to a defined period, such as up to 6 hours from a campaign click.

We may retain aggregated, de-identified, or anonymized campaign analytics for longer periods where the data cannot reasonably identify an individual.

When we no longer need information, we will delete, de-identify, or anonymize it.

14. International Transfers

Atomato is based in the United States. Atomato and the subprocessors listed on our Subprocessors page process personal information in the United States, and the subprocessors may also store and process it in other countries where they operate. Members of Atomato’s team also access personal information from Ukraine and Serbia to provide, support, and secure the Services.

For merchant customer data that Atomato processes on a merchant’s behalf, transfers from the EEA, the UK, and Switzerland rely on the EU Standard Contractual Clauses and the UK International Data Transfer Addendum incorporated in our Data Processing Agreement, with the adjustments for Swiss law set out there. For other personal information we transfer from the EEA, UK, Switzerland, or another jurisdiction requiring transfer safeguards, we use appropriate safeguards such as Standard Contractual Clauses or other lawful transfer mechanisms.

15. Children

The Services are intended for users who are at least 18 years old.

We do not knowingly collect personal information from children under 16. If you believe a child has provided us information, contact us and we will take appropriate steps to delete it.

16. Third-Party Links and Widgets

The Services may contain links to third-party websites, apps, integrations, widgets, or SDKs.

This Privacy Policy does not apply to those third parties. Their privacy policies and terms govern their practices.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time.

For material changes, we may notify you through the account portal, dashboard, email, or other reasonable means.

The updated Privacy Policy will be effective on the date posted unless stated otherwise.

18. Contact Us

Controller: Binaery LLC d/b/a Atomato
Address: 1606 Headway Cir STE 9708, Austin, TX 78754
Email: support@atomato.co

If you are a merchant, our Data Processing Agreement forms part of our Terms of Service. It applies automatically, without a signature, where your processing of personal information is subject to the GDPR, the UK GDPR, the Swiss Federal Act on Data Protection, or US state privacy laws.