Privacy policy
Agreement to our privacy policy
This Privacy Policy describes how Hoppn, Inc. ("Hoppn," "we," "us," or "our") handles personal information in connection with Infinite Color Search, hoppn.com, labs.hoppn.com, and the related search, discovery, merchant, and community services described in our Terms of Service (the "Services"). It does not cover Hoppn Studio, its desktop applications, or local file indexing. Those products require separate privacy disclosures.
This Policy explains our practices; using the Services does not replace any consent required by law. Merchant stores, Shopify, and other independently operated services have their own privacy policies. A merchant generally determines the purposes of processing shopper information through its store. Where we process personal information on that merchant’s behalf, we act under its authorized instructions and applicable agreements. For our own merchant account administration, billing, security, communications, and website activities, we determine the relevant purposes, subject to applicable law. The binding merchant personal-data processing terms are embedded in the "Data processing" section of our Terms of Service; no separate DPA is needed to accept those terms. Additional legally required transfer instruments or regional provisions may still be necessary.
Collection of your Personal Information
The information involved depends on the Services used, the merchant’s configuration, authorized permissions, and the information a person provides. The categories below describe the relevant sources and purposes; they do not grant access to data outside the permissions applicable to a particular integration.
Account and contact information: Information supplied by merchants and users, such as name, business or store name, email address, account identifiers, contact details, and communications, used for account administration, service delivery, and support.
Product and merchant content: Catalog information supplied through authorized integrations or uploads, such as images, titles, descriptions, prices, variants, specifications, publication status, and metadata, used to index, search, match, and display authorized products. Product content may contain personal information.
Search and usage information: Interactions with the Services, such as search inputs, selected colors, product interactions, service events, and related session or technical identifiers, used to provide results, measure performance, troubleshoot, and improve the Services within applicable permissions.
Commercial and transaction information: Subscription, billing, and payment-status information needed to administer Hoppn’s services. Customer or order information used for an authorized merchant feature or performance measurement is limited to the fields permitted and necessary for that feature. This description does not mean that installing the App grants Hoppn unrestricted access to customer, order, or payment records.
Technical information: Information received through service requests and related logs, such as IP address, browser or device information, access times, referring pages, and error information, used for service operation, reliability, analytics, and security.
Optional submissions: Content, feedback, profile information, and support materials a person chooses to provide. Information deliberately posted publicly may be visible to others; avoid posting sensitive personal information in public areas.
Information may come directly from you, from a merchant or its authorized platform integration, from a billing or other service provider supporting the Services, or automatically through interactions with the Services. Payment transactions are handled through the applicable billing provider. Its separate privacy policy governs information it processes in its own capacity. Do not send full payment-card numbers, passwords, or other unnecessary sensitive information through support messages or uploads.
For merchant integrations, Hoppn accesses only data the merchant authorizes through the App’s platform permissions, such as Shopify product data and images, or chooses to upload, and only to the extent necessary to provide the authorized Services. Hoppn does not access platform data outside those permissions. Hoppn does not browse, scan, or access files on a merchant’s or user’s device; it receives only files the merchant or user deliberately chooses to upload. These limits on platform data and device files do not describe routine service interactions, account information, or technical information received when using the Services, which are described in our Privacy Policy and remain subject to applicable permissions, notices, and consent requirements.
Shopify App: Infinite Color Search
This section describes the App’s processing through Shopify’s authorized APIs, merchant integration and support interactions, and requests and events from merchant storefronts. It supplements the categories above; it does not expand the App’s permissions or the content-use rights below.
Category and source Purpose and limits Retention Session identifier and associated cookie or similar browser storage, together with search/color selections and product interactions from the storefront Maintain and relate service interactions; provide search; measure permitted use and performance; support conversion attribution and service-billing calculations. A session identifier can be personal information even without a shopper’s name. Only as necessary for the session or authorized attribution/performance purpose, subject to consent choices, deletion requirements, and the applicable cookie notice. Browser-storage expiry and server-side event retention are distinct. IP address received with a request Deliver and secure the Services, diagnose errors, prevent abuse, and derive approximate location for permitted operational or measurement purposes. Deleted within 90 days of collection, including relevant logs and copies held by processors; earlier applicable deletion requirements control. User-agent and browser/device information received with a request Compatibility, troubleshooting, security, and permitted performance analysis. Only as necessary for the relevant operational or measurement purpose; applicable deletion requests and Shopify limits control. The 90-day IP limit does not by itself establish the lifetime of every non-IP log field. Approximate location derived from IP Coarse geographic context for permitted service operation and measurement. This describes IP-derived location rather than precise device GPS tracking. Only as necessary for that purpose. Retaining location together with an IP address does not extend the IP retention limit. Limited order and conversion-attribution information from authorized Shopify APIs/webhooks and relevant storefront events Relate eligible transactions to App use, measure conversions, and calculate or verify applicable usage-based charges. Access is limited to necessary, authorized data rather than an unrestricted customer/order database. Only as long as necessary for attribution, verification, and applicable billing, subject to earlier Shopify deletion requirements. Legally required financial records may have a different retention period, limited to necessary recordkeeping data. Merchant account, integration, subscription, billing-status, and support information supplied by the merchant, Shopify, or the billing channel Install and administer the integration, communicate with the merchant, provide support, and manage charges. Shopper payment details are distinct from the merchant’s Hoppn subscription records. During the necessary account/support relationship and any legally required financial or legal-record period, subject to Shopify’s restrictions on source data. Authorized product catalog information, including images, descriptions, titles, prices, variants, and metadata from Shopify or merchant uploads; derived palettes, color indexes, and permitted analytical representations Synchronize and index products, provide color search, matching and discovery, and display products within the permissions and artist protections below. Catalog content may itself contain personal information. During the authorized integration and permitted purpose; remove source data and affected derived indexes when deletion is required. Prior indexing does not grant perpetual retention rights.
The App does not use Shopify shopper/customer IDs for routine search, analytics, or attribution. Shopify may supply customer or order identifiers in mandatory privacy-request payloads so that we can locate and respond to a request. We handle those identifiers as necessary to validate and fulfill that request, rather than using them to reintroduce shopper tracking. Session identifiers, order-related data, and technical information may still relate to an individual; removing the Shopify shopper ID does not make them anonymous.
The categories above do not assert a verified exhaustive list of individual API fields. The actual authorized scopes and necessary fields govern; a general category does not give permission to collect additional protected fields. Access to protected customer data remains subject to Shopify approval where required, and we will not collect or use unnecessary data merely because an API or webhook can supply it.
Storefront consent and privacy choices
The App supports applicable Shopify customer privacy and consent signals and applies the relevant consent and opt-out decisions to its processing. Optional analytics or attribution tracking that requires consent does not begin before that consent, and withdrawal or an applicable opt-out stops the affected future processing. Receipt of a storefront event does not itself establish consent. The merchant must configure its notices and consent controls appropriately and explain its own storefront practices; Hoppn remains responsible for its processing. Necessary service and security processing follows the applicable legal basis and must not be used to bypass choices for optional tracking. Browser controls and applicable opt-out signals are described under "Use of Cookies" and "Privacy Rights and Opt-Out Choices."
Shopify privacy requests and uninstall
Hoppn supports and authenticates Shopify’s customers/data_request, customers/redact, and shop/redact webhooks for access requests, customer deletion, and shop deletion. Required actions are completed within Shopify’s applicable deadlines, currently 30 days from receipt, except where a legal retention obligation permits or requires withholding deletion. These Shopify processes apply regardless of the individual’s location. Shoppers may contact the relevant store, which generally directs the response, or contact hello@hoppn.com for assistance. Hoppn supplies relevant information to the merchant through the appropriate process and does not disclose a shopper’s data to an unverified requester.
Uninstalling ends ongoing authorized access and initiates applicable deletion processes. Shopify’s shop-deletion webhook and other binding deletion triggers govern removal of store and customer data; an ordinary retention schedule is not permission to keep it longer. Required deletion includes copies and derived representations subject to the request and instructions to relevant processors. Necessary records retained under a permitted legal exception remain protected and restricted to that purpose. The "Right to Deletion" section provides additional details.
Use of your Personal Information
We process information as appropriate to:
Operate accounts and authorized integrations and provide search, color matching, product discovery, and related visual functionality.
Provide support, respond to requests, investigate errors, and maintain and secure the Services.
Administer subscriptions, collect amounts owed, keep necessary business records, and communicate about accounts or service changes.
Measure service performance and improve the Services within the permissions and limits described below.
Send permitted communications about Hoppn’s services, subject to applicable consent requirements and opt-out choices.
Prevent abuse and fraud, comply with legal obligations, and establish, exercise, or defend legal claims.
When acting on behalf of a merchant, we process personal information within its authorized instructions and applicable agreements. We do not obtain broader rights over merchant or shopper data merely because the data passes through our systems. Using contact information supplied directly to Hoppn for Hoppn’s own account relationship is distinct from repurposing a merchant’s private customer list for marketing.
Nonpublic merchant and user data, including unpublished products and private customer, order, payment, and account information, is processed to provide, support, secure, maintain, and troubleshoot the authorized Services and meet applicable legal obligations. Hoppn does not use that data for public product displays or third-party advertising. General operational knowledge gained while providing the Services, such as identifying and correcting a software defect, may be used to improve the Services without disclosing that data or repurposing it contrary to applicable permissions. Aggregated or de-identified information may be used for service analytics and improvement only where legally permitted, consistent with applicable merchant instructions, and allowed by the source platform. Aggregation or de-identification does not itself remove Shopify restrictions or create permission to train a model. Hoppn will not use nonpublic merchant content or personal information to train a shared model for other merchants without the specific permissions required by applicable law and platform requirements, and never for the prohibited generative-training or style-imitation uses described below.
Hoppn may disclose nonpublic data to service providers acting on Hoppn’s behalf and to connected platforms as necessary to provide the authorized Services, subject to appropriate confidentiality, security, and use restrictions and applicable platform requirements. Hoppn may also disclose information as required by law or binding legal process, or as otherwise legally permitted and necessary to protect security, investigate fraud, enforce agreements, or establish or defend legal claims, but only to the extent consistent with applicable platform restrictions. A permitted corporate transaction may involve confidential disclosure or transfer to advisers or successors subject to applicable law, platform restrictions, and continued protection of the data. These permissions do not authorize recipients to use the data for independent advertising, prohibited training, or style imitation. The no-sale-of-content commitment is not permission to transfer a content collection as a separately marketable asset; any permitted corporate transfer must support continuing the Services and remain subject to these protections.
How we use your images
We analyze your images to help people find and explore your products. We do not use your content to train generative models, generate new work for the purpose of imitating your style, or offer tools designed for that purpose. We do not sell your content or license it to others for AI training. Necessary service providers may process information subject to data-use restrictions. We do not guarantee against independent third-party misuse. The detailed provisions below and the Terms of Service control this summary.
Hoppn may use authorized product content to operate, evaluate, configure, and improve non-generative search, matching, classification, indexing, retrieval, and ranking systems. Permissions for improvements benefiting multiple merchants remain subject to the applicable data permissions, merchant instructions, law, and source-platform restrictions. Hoppn does not treat aggregation, de-identification, or configuration as an exception to those requirements. Use of Shopify-sourced information for model development or improvement requires the consent specified by Shopify’s applicable terms in addition to compliance with its other data-use restrictions.
Hoppn may analyze and transform a merchant’s own images to provide the Services, including extracting color palettes, generating search embeddings, creating depth maps or similar display effects, resizing, and cropping. These are analytical representations or service-related versions of the merchant’s existing images, not newly generated artwork or substitutes for the merchant’s content. Where displayed, these outputs are displayed only in connection with that merchant’s own products. Search embeddings and other internal representations need not themselves be displayed. These permissions do not authorize generating new scenes, designs, or expressive content or transferring one merchant’s style to another merchant’s content.
Adjusting model configuration, such as thresholds, ranking parameters, similarity cutoffs, and processing steps, is ordinary operation, not model training, when it does not involve learning or fitting model parameters from content. Automated learning or fitting of parameters from content is not reclassified as ordinary configuration merely because those parameters are called thresholds or ranking settings. Hoppn may evaluate and improve eligible non-generative systems, including through learning or fitting their parameters, only within the permissions and restrictions in this section and applicable law and platform requirements. No such activity may train, fine-tune, or improve a generative model or a generative component of a mixed-purpose system.
Notwithstanding any other provision of this Policy or our Terms of Service, Hoppn will not use merchant or user content, including product images, Contributions, Submissions, or personal information provided to or collected by the Services, to train, fine-tune, or improve generative models that create images, text, audio, video, or other expressive content. Hoppn will not authorize service providers, sublicensees, or other recipients to do so.
Notwithstanding any other provision of this Policy or our Terms of Service, Hoppn will not use merchant or user content for the purpose of generating new artwork, designs, or other expressive content that imitates or reproduces that merchant’s or user’s style, aesthetic, or creative work, and will not offer features designed for that purpose. Displaying or resharing original content as authorized, identifying existing products with similar visual attributes, extracting palettes, or providing the limited analytical representations and transformations described above is permitted and is not itself style imitation. These ordinary features do not authorize Hoppn to generate imitation work. Hoppn does not promise to control how an independent user draws inspiration from lawful search results or publicly available content.
Notwithstanding any other provision of this Policy or our Terms of Service, Hoppn does not sell merchant or user content or license that content to third parties for AI training. Operational sublicenses do not permit independent training uses by the recipient. Hoppn will require service providers and sublicensees receiving content to comply with the applicable content-use protections in this section and will not authorize them to circumvent those protections. Transfer, sublicensing, derivative-work, promotional, feedback-ownership, or other rights granted elsewhere in this Policy or our Terms of Service do not override these commitments.
These commitments also apply to information retained from earlier use of the Services. Previously using content or incorporating it into a model does not create an exception.
Sharing Information with Third Parties
We disclose information only within the purposes and restrictions described in this Policy, the Terms of Service, applicable agreements, and legal and platform requirements. Relevant recipients may include:
Service providers: Providers of hosting, storage, infrastructure, security, analytics, billing, and support that need information to perform authorized services for Hoppn. Identified infrastructure providers include Amazon Web Services (AWS), for cloud hosting, storage, and supporting infrastructure, and Elastic Cloud, for hosted search/indexing and associated operational data processing. They receive only information needed for their assigned services and process it under contractual confidentiality, security, purpose, and deletion restrictions. This names the identified infrastructure providers rather than asserting that every support or business vendor has been inventoried. Merchants may request the current relevant subprocessor list and processing locations at hello@hoppn.com; the Terms govern notice of subprocessor changes.
Merchants and connected platforms: The merchant whose Services a shopper uses, and Shopify or another authorized platform, as needed to provide and manage the integration or respond to the merchant’s authorized instructions.
Authorized public audiences: People viewing product information or other content authorized for public display. Nonpublic information is not authorized for public display merely because it is received through an integration.
Legal and security recipients: Courts, regulators, advisers, or other recipients where disclosure is required by law or otherwise legally permitted and necessary for security, fraud prevention, enforcement, or legal claims, subject to source-platform restrictions.
Corporate transaction recipients: Advisers and prospective or actual successors in a permitted financing, reorganization, merger, acquisition, or similar transaction, under appropriate confidentiality protections and continued restrictions on use. This does not authorize selling a content collection as a separate asset or transferring information contrary to applicable law or platform requirements.
Hoppn will use contractual restrictions, applicable provider settings, and reasonable diligence appropriate to the Services to implement these commitments. Service providers processing Shopify-sourced data on Hoppn’s behalf must be bound by agreements restricting their use to providing services to the App and requiring the confidentiality and security protections required by Shopify. Hoppn’s obligations for those providers remain subject to applicable law and Shopify’s requirements.
These commitments concern Hoppn’s own conduct and the uses Hoppn authorizes. They are not a representation about how a third-party model was originally developed or about content obtained independently of Hoppn. Hoppn does not guarantee that unrelated third parties will not copy, scrape, misuse, or independently obtain publicly available content. This clarification does not authorize Hoppn to provide content for prohibited uses, excuse Hoppn from its obligations concerning its service providers or sublicensees, or limit responsibility that cannot be excluded under applicable law or platform requirements. If Hoppn learns that a provider is using content supplied by Hoppn contrary to the applicable restrictions, Hoppn will take reasonable steps to stop the unauthorized use, including restricting or ending the relevant processing where appropriate, and fulfill any applicable notification and remediation obligations.
The no-sale-of-content commitment is distinct from legal definitions of the sale or sharing of personal information, which can cover some advertising or tracking disclosures without a monetary payment. This Policy does not authorize such disclosures contrary to applicable consent or opt-out requirements, or permit merchant data to be used for independent third-party advertising.
Privacy Rights and Opt-Out Choices
Depending on your location, our role, and the law that applies, you may have rights to access or obtain a copy of personal information, correct it, request deletion, withdraw consent, object to or restrict processing, or obtain information in a portable form. Where applicable, you may also opt out of sale or sharing of personal information or targeted advertising, limit certain uses of sensitive personal information, and appeal a decision on a request.
Contact hello@hoppn.com to submit a request, exercise an applicable opt-out, or appeal a response. We may request information reasonably necessary to verify identity or an authorized agent’s authority, without requiring unnecessary sensitive information. We respond within applicable legal deadlines and do not unlawfully discriminate for exercising privacy rights. Certain requests are subject to legal exceptions or verification requirements. Where required by law, we honor recognized opt-out preference signals, including Global Privacy Control, for the processing to which the signal applies.
For information processed on behalf of a merchant, the merchant may need to direct the response. You may contact the store directly; we will assist or refer requests as appropriate to our role. If a request is denied, we will provide the explanation and any appeal information required by law. You may also complain to the privacy regulator for your jurisdiction.
California residents may have rights under the California Consumer Privacy Act, where applicable, including rights to know, access, correct, delete, and opt out of sale or sharing. Applicable category-specific, historical, or collection notices supplement this Policy where required. Other regional requirements may require additional notices or agreements; this Policy does not replace them.
Tracking User Behavior
We may measure interactions with the Services to understand which functions are used, evaluate search performance, and diagnose problems. For storefront activity processed on behalf of a merchant, the merchant’s configuration, permissions, and applicable privacy choices govern. Information used for analytics remains subject to the restrictions on nonpublic data and model improvement above.
Automatically Collected Information
Technical information may be received when your browser, device, or store sends requests to the Services, including IP addresses and request or error logs. Receiving this information is different from browsing files on your device. We use it for service delivery, security, troubleshooting, and permitted performance analysis, subject to applicable retention limits and privacy choices.
Use of Cookies
Cookies, local storage, or similar technologies may support functions such as maintaining sessions, remembering settings, security, and measuring service use. Their use depends on the site or feature and the applicable configuration. Nonessential technologies requiring consent must not be activated without that consent. Where used, their purposes and any additional choices are described in the applicable cookie or collection notice.
You may use your browser settings to manage cookies and local storage. Blocking necessary technologies may affect functionality. Browser cookie settings do not necessarily control every tracking technology. Where provided, site privacy controls offer additional choices; you may also contact hello@hoppn.com. Visiting a site alone is not consent where a separate choice is legally required. Merchant websites may operate their own technologies under their separate policies and controls.
Links
Our Services may link to merchant stores, platforms, or other independently operated services. Their own policies govern their independent collection and use of information. Hoppn’s commitments do not describe their independent practices. This does not relieve Hoppn of responsibilities for providers processing information on its behalf.
Security of your Personal Information
Hoppn will maintain reasonable administrative, technical, and organizational safeguards appropriate to the information and risks, as required by applicable law and platform requirements. For Shopify protected customer data, these include encryption at rest and in transit, least-privilege access controls, restricted service identities for automated processes, audit logging and review of relevant access, and an incident-response process, together with additional safeguards required for the data accessed. If we become aware of a personal data breach affecting data processed for a merchant, we notify the merchant without undue delay, provide available information and updates, and assist with response obligations. Hoppn also makes notifications to affected individuals, regulators, and Shopify when required by applicable law or binding Shopify requirements. This does not promise a fixed hour count or complete information in the first notice. No system or method of transmission is completely secure. This is not a guarantee against every loss, unauthorized access, or disclosure, and it does not limit any security, notification, or remediation obligation imposed by applicable law or binding platform requirements.
Right to Deletion
We retain personal information only for as long as reasonably necessary for authorized purposes, subject to legal and platform limits. Relevant criteria include the active account or service relationship, the purpose and sensitivity of the information, support and security needs, outstanding billing or disputes, and applicable recordkeeping requirements. Catalog indexes and related representations are tied to the authorized integration and permitted service purpose. IP addresses are deleted within 90 days of collection, including relevant logs and processors’ copies, with earlier applicable deletion requirements taking priority. Other technical logs are retained only as necessary for their operational and security purpose; the App category table above explains the relevant retention criteria. Necessary billing, legal, or dispute records may have different retention requirements.
You may request deletion through hello@hoppn.com. Where applicable, we delete personal information and direct providers acting on our behalf to do so, subject to permitted exceptions. Those exceptions may include meeting legal obligations, handling claims, maintaining required records, and addressing security or fraud, but only where permitted by the law and platform requirements that apply.
Hoppn will retain, delete, or de-identify data in accordance with our Privacy Policy and applicable legal and platform requirements. Where a platform requires deletion, de-identification is not a substitute unless that platform’s requirements and applicable law permit it. For Shopify-sourced data, Hoppn will comply with Shopify’s applicable deletion deadlines and triggers, including uninstall, loss of a permitted purpose, and enforceable deletion requests, subject to any exceptions permitted by applicable law. Copies, backups, embeddings, and other derived data remain subject to applicable deletion requirements; incorporation into a model does not itself exempt data. Operational know-how and improvements that may lawfully be retained remain Hoppn’s property, subject to the content-use protections above.
Backups are not a blanket exception to deletion. Where delayed removal from backups is permitted, retained information must remain protected and limited to the purposes allowed during that period. Content previously displayed or reshared is not automatically exempt. Hoppn cannot guarantee deletion of copies independently retained by unrelated third parties, but remains responsible for requests and provider instructions it is required to carry out.
Children Under Thirteen
The Services are not directed to children under 13. Children under 13 must not submit personal information to Hoppn. If we learn that we collected a child’s personal information in circumstances requiring deletion, we take the steps required by law. Contact hello@hoppn.com if you believe a child has supplied information to us. Merchant account holders must have authority to enter into the applicable agreement; permitted use by older minors remains subject to the Terms of Service and applicable law.
Opt Out and Unsubscribe from Third-Party Communications
Hoppn does not obtain permission to give a merchant’s nonpublic customer list to an independent advertiser through this Policy. If you separately choose to engage with another company or receive its communications, its privacy and unsubscribe processes apply. Contact Hoppn about disclosures or communications made by Hoppn; contact the third party about communications it sends independently.
Email Communications
We may send account, billing, security, support, and other service communications. Where permitted by law, we may also send information about Hoppn’s services to contacts with whom we have an appropriate relationship or consent. You may opt out of marketing emails through the unsubscribe mechanism or by contacting hello@hoppn.com. Necessary service messages may continue. Measurement of email delivery or interaction, where used, is subject to applicable notice and consent requirements.
External Data Storage Sites
Hoppn uses third-party infrastructure and other providers to support the Services. Information may be processed in the United States and other countries where Hoppn or authorized providers operate. Those countries may have different privacy protections. We remain responsible for the safeguards required for our processing and transfers, including applicable contractual protections or other recognized transfer mechanisms where required. Consent to use the Services alone is not a substitute for a legally required transfer safeguard.
Where European, UK, or comparable laws apply to processing for which Hoppn determines the purposes, relevant legal grounds may include performing a contract with you, complying with legal obligations, consent where required, or legitimate interests such as providing and securing the Services where those interests are not overridden by your rights. Processing on behalf of a merchant follows its authorized instructions and the applicable processing agreement. Contact hello@hoppn.com for information about relevant recipients, processing locations, or applicable safeguards, including how to obtain a copy where required. Additional regional notices apply where supplied or legally required.
Changes to This Statement
We may update this Policy to reflect changes to the Services, our practices, or applicable requirements. We will provide notice of material changes and obtain consent where required before applying them. Posting a revised Policy does not by itself authorize new uses of previously collected information where additional notice, consent, or other legal authority is required. The content-use protections in the Terms of Service also apply; this Policy does not expand them.
Contact Information
Hoppn, Inc.
1713 Artesia Blvd, Suite A
Manhattan Beach, CA 90266, United States
Email: hello@hoppn.com
This version becomes effective when published on hoppn.com, subject to any later effective date or acceptance requirement stated in a notice to existing users. Required notice and consent obligations continue to apply.
Updated: October 26, 2026
