Privacy policy | Ninety9

Last updated: October 14, 2026

This policy explains what Ninety 9 LTD ("we", "us", "our") collects when you visit ninety9.dev, use our free tools, or install our Shopify apps (Addy, Addly, Goalify, Monet, Reviso, or Rankly).

1. Who is responsible

When an app processes a merchant's customers so the app can run, that merchant is responsible for the data and we handle it on their behalf.

We are responsible for our own records: accounts, billing, support, security logs, how people use this website, reports from our free tools, and anything we must keep by law.

2. What we collect

2.1 When you visit this site

Our host briefly keeps the usual server log (your IP address, browser, the page you opened, and the time) so we can keep the site safe.
We remember your cookie choice on your device so we do not ask every time.
We use Google Analytics to see which pages people visit. If you allow Analytics cookies, Microsoft Clarity can also show us how people use the site, including a recording of the visit. Password fields are not shown in those recordings.
If you allow Advertising cookies, we use Reddit and ChatGPT to measure our ads.
In the EEA, UK and Switzerland we ask before setting Analytics or Advertising cookies. Elsewhere we set them unless you turn them off in Cookie settings.
We still count visits if you reject optional cookies. Those cookies are not set, and we do not record the visit.
If you email us, we receive what you send.

2.2 When you use a free tool

The CRO Audit for Shopify stores and the ChatGPT SEO check for Shopify stores only look at what a shopper can already see. They do not open Shopify admin, checkout, orders, or customer lists. Do not submit a store you are not allowed to check.

We use the URL you paste, public page content needed for the check, and (if the shop is password-protected) the storefront password you type. That password is used only to open the check, then discarded. We also see your IP address and browser so we can stop abuse.

A CRO audit is saved as a report you can share with a link (the store, the score, the findings, and optional screenshots). Anyone with that link can open it. We keep anonymous totals from reports (no store name, URL, or screenshots) so we can talk about results across many shops.

To stop new audits, add <meta name="ninety9-audit" content="no"> in the head of layout/theme.liquid, then submit the shop URL on the CRO audit page. Use content="no,delete" to also erase saved reports. If you cannot edit the theme, email [email protected].

2.3 When you use a Shopify app

Each app only asks for the access shown on its App Store listing. Depending on the app, that can include:

store name, domain, and staff contact details;
products, collections, discounts, and theme settings the app needs;
order lines, prices, and fulfilment status the app needs — Addy, Addly, Goalify, and Monet do not keep customer names, emails, phones, or addresses on our servers;
for Reviso only: name, email, and shipping details needed to change an order after purchase;
for Rankly: product titles, descriptions, tags, alt text, meta fields, redirects, theme SEO files (including robots.txt and llms.txt), locales and translations, Online Store navigation, files, and store analytics the listing asks for — not customer checkout names or addresses;
app settings and activity we need for support;
billing through Shopify — we never see full card numbers;
messages you send us.

3. What we do not collect

Full card numbers or security codes.
Shopify account passwords.
Customer names, emails, phones, or addresses for any app except Reviso.
Admin, checkout, or customer data through the free tools.

4. How we use it

To run and support the website, tools, and apps.
To bill through Shopify.
To make and keep the reports you ask for, until you delete them. Anonymous totals may stay so we can publish overall findings.
To send service and support messages.
To stop abuse and keep the services safe.
To meet the law and Shopify's rules.
To see how this website is used, as described above.

We do not sell your data. We do not use merchant store data to train other companies' AI models.

5. Legal bases

Where the law asks us to name a basis (including GDPR):

Contract — to provide the apps and support you asked for.
Legitimate interests — security, support, and counting visits without extra cookies. Outside the EEA, UK and Switzerland, also Analytics and Advertising cookies unless you turn them off.
Legal obligation — tax, accounts, and lawful requests.
Consent — Analytics and Advertising cookies where we must ask first.

6. Who we share it with

Only what is needed, with:

Shopify;
Google Analytics, Microsoft Clarity, and — if you allow Advertising cookies — Reddit and ChatGPT;
companies that host or run the site for us, under contract;
advisers, authorities, or a buyer of the business, when the law or a deal requires it.

Ask [email protected] for the current list of processors.

7. Cookies

Change your choice any time with Cookie settings in the footer.

Necessary — remembers this choice and counts visits without extra cookies. Always on.
Analytics — Google and Clarity cookies so we can see how people use the site, including a recording of the visit. Off in the EEA, UK and Switzerland until you accept. If you leave this off, we still count visits, but we do not record them.
Advertising — Reddit and ChatGPT cookies so we can measure our ads. Same rule.

We host our own fonts. A search-engine tag on the site only proves we own the domain. It does not follow you.

8. How long we keep it

CRO audit reports stay until you delete them from the CRO audit page or ask us at the address below. Anonymous totals may stay after that.
SEO & AI Audit checks are not kept as a shareable report.
App data stays while the app is installed, then we delete it on Shopify's schedule.
Everything else only as long as we need it for support, security, or the law.

9. Security

We take reasonable care with the data we hold. No site is perfectly secure.

10. Where data is processed

Data may be processed outside your country, including where our providers operate. Where the law requires it, we use the usual safeguards.

11. Your rights

Depending on where you live, you may ask us to see, correct, or delete your data, object to some uses, withdraw consent, or complain to a data-protection authority. Some requests have limits if we need the data to run the service or meet the law.

If you are a shopper whose details were used through Reviso, start with the store you bought from. We will help that merchant when we must.

To delete a CRO audit report, use the CRO audit page or email [email protected].

12. Shopify

We only use Shopify store data to run the apps and to follow Shopify and the law. Every app honours Shopify's required privacy requests.

13. Children

These services are for businesses, not for children. We do not knowingly collect data from anyone under 16. If we learn we have, we delete it.

14. Other sites

Links to Shopify or anyone else follow their own policies.

15. Changes

We may update this page. The date at the top will change. If a change matters for an app, we will say so here, in the app, or by email.

16. Contact

Ninety 9 LTD
ul. "27-mi yuli", No 23
Center Odesos, 9000 Varna
Bulgaria
[email protected]