Privacy Policy
Effective date: 14 October 2026. This version replaces the previous, undated policy.
This policy explains what personal data PageFly collects about you (a visitor to pagefly.io, a merchant who uses the PageFly app, a partner or affiliate, or someone who chats with us), why, who else receives it, how long we keep it, and how you can control it.
1. Who we are
Data controller. SellerSmith Technology Joint Stock Company (SELLERSMITH TECHNOLOGY .,JSC), trading as PageFly, No 4, Lane 62, Nguyen Hong Road, Lang Ward, Ha Noi City, 10000, Viet Nam; enterprise and tax code 0106980380 ("PageFly", "we"). We decide why and how your data is processed for the website, our merchant accounts, our partner program and our support channels.
When we are a processor instead. If you shop on a merchant's store and PageFly analytics records your visit to a page built with PageFly, the merchant is the controller and PageFly processes that data on the merchant's behalf under our Data Processing Addendum. Please contact the merchant first; we will help them answer you.
Contact for privacy questions: happytohelp@pagefly.io, or by post to the address above.
Data Protection Officer and representatives. We have not appointed a Data Protection Officer or a representative in the EU or the UK. Please use the contact above for any privacy request.
2. What we collect, by who you are
| You are | What we collect | Where it comes from |
|---|---|---|
| Website visitor (pagefly.io) | Pages viewed, clicks, scrolls and session recordings, referrer and campaign parameters, device, browser, approximate location from IP, cookie and device IDs, your consent choice and language. | Your browser, through the cookies and scripts in section 6. Analytics and advertising tools load only as described there. |
| Someone who contacts us (contact or partner form) | Name, email, company website, your message. | You, through the form. |
| Someone who chats with us (Crisp chat) | Messages, email if you give it, chat session ID, the page you chatted from, browser and approximate location. | You and your browser. |
| Merchant using the PageFly app | Store: ID, domain, plan. Store owner: name, email, country, city, ZIP code, phone. App use: install, upgrade and uninstall dates, billing history, actions inside the app, browser and operating system. Content you give our AI features (prompts, page content, images). Orders, only if you turn on PageFly analytics: order ID and order total, not shopper names, emails, addresses or IPs. | Shopify, when you install the app and approve its permissions, and your use of the app. |
| Shopper on a merchant's PageFly page | Page visits, clicks on tracked elements, purchases on that page. | The merchant's store. We act as the merchant's processor (section 1). |
| Partner or affiliate | Name, email, company and website, country, referral link activity (clicks, installs, conversions), payout details (PayPal email). | You, when you join the program, and our referral tracking (partners.pagefly.io). |
| Survey respondent | Your answers and contact details for the incentive. | You. |
We do not ask for special category data (such as health or religion) and ask you not to send it in chat or forms.
3. Why we use it and our legal basis
| Purpose | Data used | Legal basis (GDPR Art. 6) |
|---|---|---|
| Run the website: page delivery, security, language, remembering your cookie choice | Essential cookies, IP address, consent choice | Legitimate interests in a working, secure site (6(1)(f)); strictly necessary under ePrivacy rules |
| Answer chats, forms and support requests | Contact details, messages | Steps you ask for before a contract, or the contract (6(1)(b)); otherwise legitimate interests in replying (6(1)(f)) |
| Provide the PageFly app, its AI features, billing and support | Store, store owner, app-use data and content you give the app | Contract (6(1)(b)) |
| PageFly analytics for merchants | Order ID and total, page visits and clicks on PageFly pages | Contract with the merchant; for shoppers, the merchant's legal basis (we are processor) |
| Measure and improve the website (analytics, heatmaps, session recording, A/B tests) | Usage data, cookie and device IDs | Consent (6(1)(a)) in the EEA, UK and Switzerland. Elsewhere, legitimate interests; you can switch it off in Cookie settings |
| Measure and run our ads (Google Ads, Microsoft Advertising, ClickMagick) | Ad click IDs, conversion events | Consent (6(1)(a)) in the EEA, UK and Switzerland; elsewhere legitimate interests with opt-out |
| Track partner referrals and pay commissions | Referral clicks, installs, conversions, payout details | Contract with the partner (6(1)(b)); for visitors who click a referral link, consent in the EEA, UK and Switzerland as above |
| Product and marketing emails to merchants | Name, email, app use | Legitimate interests in telling merchants about the app they installed (6(1)(f)), with an unsubscribe link in every email |
| Survey incentives | Answers, contact details | Consent (6(1)(a)) |
| Legal obligations, disputes, fraud prevention | Billing and account records | Legal obligation (6(1)(c)) and legitimate interests (6(1)(f)) |
Where we rely on legitimate interests you can object at any time (section 8). We do not make decisions about you that have legal or similarly significant effects based only on automated processing.
4. Who receives your data
We do not sell your personal data. We share it only with the service providers below, with Shopify as our platform, and with authorities when the law requires it. "Processor" means they act on our instructions; "own controller" means they also decide how to use the data under their own privacy policy.
Website (pagefly.io)
| Provider | What for | Role | Company (country) | When it loads |
|---|---|---|---|---|
| Shopify | Hosts the site, essential cookies, store analytics | Processor | Shopify International Ltd (Ireland) | Always (essential); analytics follows your consent |
| Cloudflare | Network delivery and error reports | Processor | Cloudflare, Inc. (US) | Always |
| Weglot | Website translation | Processor | Weglot SAS (France) | Always |
| Crisp | Live chat | Processor | Crisp IM SAS (France) | Always (functional) |
| bunny.net | Web fonts | Processor | BunnyWay d.o.o. (Slovenia) | Always |
| jsDelivr, code.jquery.com | Script libraries | CDN | Volentio JSD Ltd (UK); OpenJS Foundation (US) | Always |
| G2, DMCA.com | Review and copyright badge images | Own controller | G2.com, Inc. (US); DMCA Services Ltd (Canada) | Always |
| Google Analytics 4, Tag Manager | Website analytics | Processor | Google Ireland Ltd (Ireland) | After consent* |
| Google Ads | Ad conversion measurement | Own controller | Google Ireland Ltd (Ireland) | After consent* |
| Microsoft Clarity | Heatmaps and session recording | Own controller | Microsoft Ireland Operations Ltd (Ireland) | After consent* |
| Microsoft Advertising | Ad conversion measurement | Own controller | Microsoft Ireland Operations Ltd (Ireland) | After consent* |
| Hotjar | Heatmaps and session recording | Processor | Hotjar Ltd (Malta) | After consent* |
| Smartlook | Session recording | Processor | Smartlook.com s.r.o. (Czech Republic) | After consent* |
| Mixpanel | Product and website analytics | Processor | Mixpanel, Inc. (US) | After consent* |
| Amplitude | A/B experiments | Processor | Amplitude, Inc. (US) | After consent* |
| VWO | A/B testing | Processor | Wingify Software Pvt Ltd (India) | After consent* |
| ClickMagick | Ad click tracking | Processor | ClickMagick, Inc. (US) | After consent* |
| Trustpilot | Review widget | Processor | Trustpilot A/S (Denmark) | After consent* |
| PageFly partner tracking (partners.pagefly.io) | Affiliate referral attribution | Us | PageFly | After consent* |
*In the EEA, UK and Switzerland these load only after you click Accept. Elsewhere they load by default and stop when you choose Reject in Cookie settings (section 6).
PageFly app and accounts
| Provider | What for | Company (country) |
|---|---|---|
| Shopify | App distribution, store data, billing | Shopify International Ltd (Ireland) |
| Amazon Web Services | Cloud hosting and storage | Amazon Web Services, Inc.; data stored in the US |
| Mixpanel | In-app product analytics | Mixpanel, Inc. (US) |
| Customer.io | Product and marketing email | Customer.io, Inc. (US) |
| Crisp | Support chat | Crisp IM SAS (France) |
| AI model providers | Generate pages and content in FlyMate, our AI page builder | Processors; some are located outside the EEA |
| PayPal | Partner commission payouts | PayPal (own controller; the entity depends on the partner's country) |
FlyMate sends the prompts, page content and images you give it to the AI model providers that generate the result. They process it on our instructions and do not receive shopper data.
5. Transfers outside the EEA and UK
PageFly's team works from Vietnam, which has no EU adequacy decision, and several providers above are in the United States, India or Canada. This is how each transfer is protected:
- Merchant and shopper data handled by PageFly in Vietnam: the European Commission's Standard Contractual Clauses (2021) in our Data Processing Addendum.
- Other data our team handles to answer you or to run a contract with you: the transfer is necessary for that purpose (GDPR Art. 49(1)(b)).
- US providers that self-certify under the EU-US Data Privacy Framework (such as Google, Microsoft, Mixpanel, Amplitude, Cloudflare): the Commission's adequacy decision, with Standard Contractual Clauses as fallback.
- Other providers outside the EEA (such as VWO in India, AI model providers, and DMCA.com in Canada): Standard Contractual Clauses or equivalent safeguards in our terms with them, or Canada's adequacy decision.
- EU-based providers (Shopify International, Weglot, Crisp, Hotjar, Smartlook, Trustpilot, bunny.net) may use sub-processors outside the EEA under their own Standard Contractual Clauses.
You can ask us for a copy of the safeguards that apply to your data (section 8).
6. Cookies and similar technologies
Our cookie banner has three groups. The table lists what we observed on pagefly.io on 14 October 2026; lifetimes are as set in the browser.
How consent works. If your browser's time zone is in the EEA, the UK or Switzerland (or is not set), only the first two groups run until you choose. Reject all and Accept have the same weight. Anywhere else, all three groups run by default and you can switch analytics off. Your choice is stored for 180 days and also passed to Shopify, so Shopify's own analytics follows it.
Change your mind at any time: click Cookies in the footer of any page, untick Analytics and customization, and press Save.
| Group | Name | Set by | Purpose | Lifetime |
|---|---|---|---|---|
| Strictly necessary | _shopify_essential | Shopify | Security, session | 1 year |
| Strictly necessary | cart, cart_currency | Shopify | Store cart (Shopify platform default) | Up to 91 days |
| Strictly necessary | localization | Shopify | Country and language | 1 year |
| Strictly necessary | pf_consent, __pf_consent | PageFly | Remembers your cookie choice | 180 days |
| Strictly necessary | wg-slugs, PF_SHOP_DOMAIN (local storage) | Weglot; PageFly | Translated page addresses; names our store for our page builder | Until cleared |
| Performance and functionality | crisp-client/* (cookie and local storage) | Crisp | Keeps your chat conversation between pages | 182 days |
| Analytics and customization | _ga, _ga_RGN47LR4ER, _ga_8H6NDNEM8G, _ga_KYPF9FEZ05, _ga_0BK6F6GXYF | Google Analytics 4 | Counts visits and sources | 400 days |
| Analytics and customization | _gcl_au, _gcl_ls (local storage) | Google Ads | Links ad clicks to installs | 90 days |
| Analytics and customization | _clck, _clsk | Microsoft Clarity | Heatmaps, session recording | 1 year; 1 day |
| Analytics and customization | _hjSessionUser_*, _hjSession_* | Hotjar | Heatmaps, session recording | 1 year; 30 minutes |
| Analytics and customization | mp_*, __mpq_* (local storage) | Mixpanel | Product analytics | 1 year |
| Analytics and customization | EXP_* (cookie and local storage) | Amplitude | A/B experiments | 1 year |
| Analytics and customization | cmc_vid | ClickMagick | Ad click tracking | Per provider |
| Analytics and customization | _cioid | Customer.io | Links email clicks to your merchant account | Per provider |
| Analytics and customization | Smartlook, VWO, Microsoft Advertising storage | Each provider | Session recording, A/B tests, ad conversions | Per provider; set only on some pages |
| Analytics and customization | Referral ID | partners.pagefly.io (PageFly) | Credits the partner who referred you | For the referral window of our partner program |
| Analytics and customization | pf_client_id, PF_SESSION:*, PF_USER_TYPE:*, PF_CUSTOMER_EVENTS_TRACKER (local storage) | PageFly app (our own page analytics) | Page views and clicks on our PageFly-built pages | Until cleared |
Advertising measurement (Google Ads, Microsoft Advertising, ClickMagick) sits in the analytics group: one switch controls both.
7. How long we keep it
| Data | How long |
|---|---|
| Cookies and local storage | As in the table in section 6 |
| Website analytics in Google Analytics | 14 months |
| Session recordings (Clarity, Hotjar, Smartlook) | Each tool's retention setting, at most 13 months |
| Chat conversations (Crisp) and contact or partner form messages | 24 months after our last reply |
| Merchant account and app-use data | While the app is installed. Shopify sends us a deletion request 48 hours after a store uninstalls the app; we then delete the store's PageFly analytics and AI working data, unless the law requires us to keep something |
| Billing and payout records | As long as Vietnamese accounting and tax law requires |
| Partner and affiliate data | While you are in the program, then 5 years for payment records |
| Shopper data on merchant pages (processor role) | Heatmap data 30 days, element click data 90 days, section statistics 2 years, other page statistics while the app is installed; always as the merchant instructs, and deleted within 30 days of a Shopify deletion request |
8. Your rights and how to use them
Wherever you live, you can ask us to:
- see the personal data we hold about you and get a copy (access)
- correct it (rectification)
- delete it (erasure)
- limit how we use it (restriction)
- receive data you gave us in a machine-readable format (portability)
- object to processing based on legitimate interests, and to direct marketing at any time
- withdraw consent at any time, without affecting what we did before (for cookies, use the Cookies link in the footer)
How: email happytohelp@pagefly.io from the address linked to your account, or tell us which data you mean (for example your partner ID or store domain). Merchants can also delete store data by uninstalling the app; Shopify then sends us a deletion request.
When: we reply within one month. If a request is complex we may extend this by up to two more months and will tell you why within the first month. We may ask you to confirm your identity first. Requests are free unless they are clearly unfounded or excessive.
Marketing email: use the unsubscribe link in any email.
Complaints: you can complain to the data protection authority where you live or work. In the UK this is the Information Commissioner's Office; in the EU, see the list of authorities. We would appreciate the chance to fix things first.
9. Children, security, survey incentives, changes
Children. PageFly is a business tool for Shopify merchants. It is not meant for children under 16 and we do not knowingly collect their data. If you think a child has given us data, contact us and we will delete it.
Security. Our site is served over HTTPS only, and app data is stored with Amazon Web Services.
Google API data. PageFly's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Survey incentives. The rules for paid surveys are on our Survey Incentive Policy page. Survey answers are used as described in section 3.
Changes. When we change this policy we update the effective date at the top. If a change affects how we use data you already gave us, we will tell merchants and partners by email before it applies. Previous versions are available on request.
